Subject: [75attendees] No PGP Key Signing session??

From: Teddy Hogeborn <[email-masked]>
Date: Tue, 28 Jul 2009 07:57:00 +0200

I am very surprised to NOT see a PGP signing session on the agenda for
IETF 75 .  Is there an unofficial one planned outside the agenda?

If there is nothing planned, I could organize it.  I propose that it
be held on friday, 7:30 to 9:00, since there is no BOF at that time
that I could see.  Everybody who wanted to participate would send
their public keys to me (privately!).

If any organizers want to give this activity an official room and/or a
more suitable time, that would be very welcome.  It looks like the PGP
key signing events were traditionally held on the wednesday afternoon
snack break, but this wednesday's break is too short for that, and the
days following are too tightly scheduled for this to fit in somewhere.

/Teddy Hogeborn

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 28 Jul 2009 09:22:42 +0200

> IETF 75 .  Is there an unofficial one planned outside the agenda?

What I understand is that there is no checking of government IDs at  
theses IETF PGP signing sessions. That doesn't seem very useful to me...

Iljitsch

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 28 Jul 2009 09:32:58 +0200

> theses IETF PGP signing sessions. That doesn't seem very useful to  

That is completely up to you. If you want to see the ID of someone  
before you sign that persons key, just request it.

    Patrik -- has checked ID at IETF PGP Key Signing Session last time  
in Dublin (my last such session)

---

From: Teddy Hogeborn <[email-masked]>
Date: Tue, 28 Jul 2009 09:34:03 +0200

Iljitsch van Beijnum <[email-masked]> writes:

>> I am very surprised to NOT see a PGP signing session on the agenda
>> for IETF 75 .  Is there an unofficial one planned outside the
>> agenda?
>

What do you mean?  Whether to check IDs is up to the individual
signers.  Anyway, if *I* hold the key signing events, there will be
opportunities to check any and all IDs, if provided.

/Teddy

---

From: Pete Resnick <[email-masked]>
Date: Tue, 28 Jul 2009 10:13:18 +0200

>theses IETF PGP signing sessions. That doesn't seem very useful to 

I think checking government IDs is a TERRIBLE idea (though you are 
certainly allowed to do so). When I sign a key, I am saying that *I* 
know the person. I am not saying that I am an expert in determining 
forged or true government IDs and that I see that this person has a 
valid one. Personally, if I think you have signed someone's key 
because you checked their government ID, I will not trust your 
signature.

pr
-- 
Pete Resnick <http://www.qualcomm.com/~presnick/>
Qualcomm Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 28 Jul 2009 10:18:47 +0200

On 28 jul 2009, at 10:13, Pete Resnick wrote:

> know the person.

There's a difference between knowing the person and knowing the  
person's identity...

> Personally, if I think you have signed someone's key because you  
> checked their government ID, I will not trust your signature.

Truth in advertising is all we can ask for.

BTW, was friday 7.30 - 9 AM or PM? There wouldn't be any BoFs at  
either time, and I would _hope_ there are no bar BoFs at 7.30 in the  
morning...

---

From: Teddy Hogeborn <[email-masked]>
Date: Tue, 28 Jul 2009 10:32:50 +0200

> either time, and I would _hope_ there are no bar BoFs at 7.30 in the

I meant 7:30-9 AM friday; I'm used to 24 hour times here in Europe.  I
was afraid that the venue might be closed on friday evening, which is
why I did not dare place it then.  Also, some people might have to
leave early on friday.

/Teddy Hogeborn

---

From: Henrik Nordstrom <[email-masked]>
Date: Tue, 28 Jul 2009 11:43:43 +0200

> theses IETF PGP signing sessions. That doesn't seem very useful to me...

OpenPGP does not enforce a specific signing policy. The policy on how
you verify the identity of the entity having of the key identities you
sign is basically up to you to define, just as it is you who decide and
accept to sign the key identities in question. Some have ID policies,
some have other policies.

If you want others to trust your signatures it's recommended you have a
reasonably clear policy defined and that you communicate this policy via
suitable means. To help in this the OpenPGP signatures includes an
option to indicate a location where one can look up the policy you used
when making that signature.

Regards
Henrik

---

From: Ted Lemon <[email-masked]>
Date: Tue, 28 Jul 2009 13:19:26 +0200

> because you checked their government ID, I will not trust your

Right, what I care about is that you vouch for the person as being the  
owner of the particular network identity they are asserting, not that  
they have some particular legal identity. We aren't qualified to  
assert the latter, and should not.

---

From: Pete Resnick <[email-masked]>
Date: Tue, 28 Jul 2009 13:28:46 +0200

On 7/28/09 at 10:18 AM +0200, Iljitsch van Beijnum wrote:

>>certainly allowed to do so). When I sign a key, I am saying that 
>>*I* know the person.
>

[Philosophy warning....tread carefully]

What difference is there between knowing a person and knowing their 
identity? You're not requiring me to have some knowledge of the 
person's soul, are you?

Cartesian concepts of identity need to be divorced from key signing. 
I think Wittgenstinian concepts might work a bit better.

[End philosophy warning]

If I wanted to know whether who the government thinks a person is, 
I'd have asked the government to sign their key. I'll ask you to sign 
if I want to know if *you* know who the person is. "The person I've 
seen at the IETF who keeps wearing the Iljitsch badge" is close 
enough for me.

pr

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 28 Jul 2009 13:45:42 +0200

On 28 jul 2009, at 13:28, Pete Resnick wrote:

> I'd have asked the government to sign their key. I'll ask you to  
> sign if I want to know if *you* know who the person is. "The person  
> I've seen at the IETF who keeps wearing the Iljitsch badge" is close  
> enough for me.

So why not sign the key without the person and the badge? Isn't it  
good enough to know the link between the key and the email address?

---

From: Ted Lemon <[email-masked]>
Date: Tue, 28 Jul 2009 04:59:53 -0700

On Tuesday, July 28, 2009 4:45 AM, Iljitsch van Beijnum

> good enough to know the link between the key and the email address?

You can in fact do this if they've been signing their communications all along, and you have been tracking that.   This would be entirely reasonable.   But if you've never seen their key before, the f2f contact is a useful shortcut - you automatically track the relationship between faces and identities.  It would be unwise to sign the key of a person you have only just met, because you have not yet developed a meaningful comparison between that peson on email and that person at the meeting.

E.g. i would be comfortable signing your key because I've been exchanging email with you for years *and* arguing with you at f2f IETF meetings for roughly the same number of years.

---

From: Teddy Hogeborn <[email-masked]>
Date: Tue, 28 Jul 2009 14:50:40 +0200

Teddy Hogeborn <[email-masked]> writes:

> for IETF 75.  [...]

There is now a Biglumber event for this; if you want to participate in
the PGP key signing event, add your key to this event's keyring
instead of sending me any keys:

https://biglumber.com/x/web?ev=40556

/Teddy Hogeborn

---

From: Ondřej Surý <[email-masked]>
Date: Thu, 30 Jul 2009 18:15:34 +0200

Is this going to happen? Call me lazy, but I am not going to wake up
earlier just to get three signatures with low msd ranking.

Send me an email if you want you keys signed by me, we can arrange
quick signing during friday lunch break.

Ondrej.

On Tue, Jul 28, 2009 at 2:50 PM, Teddy
Hogeborn<[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFKbvQkOWBmT5XqI90RAvJXAJ9Kx+gl1TpjKOlV+xqLgb8vn1FCiACgxTAH
> 1y3ybI45dksNZwiFnMzKr7k=
> =unwA
> -----END PGP SIGNATURE-----
> _______________________________________________
> 75attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/75attendees
>

-- 
 Ondrej Sury
 technicky reditel/Chief Technical Officer
 -----------------------------------------
 CZ.NIC, z.s.p.o.  --  .cz domain registry
 Americka 23,120 00 Praha 2,Czech Republic
 mailto:[email-masked]  http://nic.cz/
 sip:[email-masked] tel:+420.222745110
 mob:+420.739013699     fax:+420.222745112
 -----------------------------------------

---

From: Joe Abley <[email-masked]>
Date: Thu, 30 Jul 2009 18:21:53 +0200

> quick signing during friday lunch break.

Oh!

It's a bit late, but I now remember in San Francisco volunteering at  
the key signing party to organise the next one. I completely forgot  
about that.

I am busy this evening, and I fly out tomorrow morning. If only I had  
remembered yesterday, or earlier.

Many apologies to those who wanted an organised venue to sign PGP keys.

Joe

---

From: Teddy Hogeborn <[email-masked]>
Date: Thu, 30 Jul 2009 22:53:08 +0200

> earlier just to get three signatures with low msd ranking.

Actually, you might find that my other key, 95EA23DD, is a bit more
highly ranked.  (I couldn't add it to the biglumber list because they
have the old version with the old UID with the old mail address in in,
and they'll only send the login password to that now-defunct
address...)

Anyway, yes, I'll certainly be there, and at least one other.  There's
one other person (besides you) who've added their key to the key ring;
I don't know about him.

> quick signing during friday lunch break.

I can certainly try to be available during lunch as well.  If I am,
I'll wave a sign around the registration area at 12:00-ish.

/Teddy

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 31 Jul 2009 01:20:09 +0200

> one other person (besides you) who've added their key to the key ring;

That's me, but unfortunately I can't come tomorrow.

Regards
Henrik

---

From: Teddy Hogeborn <[email-masked]>
Date: Fri, 31 Jul 2009 07:19:58 +0200

Henrik Nordstrom <[email-masked]> writes:

>> Anyway, yes, I'll certainly be there, and at least one other.
>> There's one other person (besides you) who've added their key to
>> the key ring; I don't know about him.
>

Then why did you send in your key?

Anyway, what I wanted to say that I'll still be there, even though the
event page at biglumber says that the event is closed; that's because
I entered yesterday's day for it by mistake.  The event is today, the
friday the 31st, 07:30 to 09:00 (or whenever we're finished).  I'll
also try to be available around the IETF reception area (or where it
used to be) at about 12:00.

/Teddy Hogeborn

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 31 Jul 2009 08:47:44 +0200

> Then why did you send in your key?

Because I intended to go.

Regards
Henrik

---

From: Teddy Hogeborn <[email-masked]>
Date: Thu, 30 Jul 2009 22:46:55 +0200

/Teddy