Preparing for a Key-Signing Party

A keystroke-by-keystroke guide

Charles Shapiro
Gracious Assistance by Judy Thompson
[ed Aaron Ruscetta]
15 Nov 2009
Revised 1 Dec 2021

There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files.

Bruce Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, John Wiley and Sons, New York, 1994

Introduction

Modern cryptography involves codes which have separate encryption and decryption keys. The mathematics involved ensures that it's impossible to guess one key from the other with current technology. Because the two keys are separate, it's possible to let any stranger send you a message which only you can read, or to identify a message's only possible originator as you. Both of these properties can be very useful on the internet, where the security of face-to-face interaction is missing.

This guide will give you step-by-step instructions on how to create and use a two-part key with gpg (a free and open program), and how to prepare for a key-signing party. Key-signing parties are important because they provide the crucial face-to-face interaction you need to verify that a gpg key belongs to someone; after one meeting, you can be sure that anything using that key had to come from them. Once you have successfully attended a key-signing party, you will posess a key which is indubitably bound to you, and this fact will be easy to verify for anyone else, even if they were not at the party you attended.

So what is this really good for?

A properly attested GPG key is something which you'll probably seldom use. But, like a pistol, when you need it, you will really need it. Here are some scenarios where it might be crucial:

Finding a Job

Technical recruiters are an untrustworthy lot. They have been known to alter resumes to make them more attractive to hiring companies, adding experience or qualifications which applicants lack. This leads to unhappiness and unwarranted damage to reputations. With your GPG key, you can sign your resume in such a way that: a) only you could have signed it and b) any alterations will be obvious. A bad signature check might mean that you won't get that particular job, but it'll expose the recruiter's dishonesty and keep your prospective employer from blaming you for lying.

Getting Credentials at your new job

So you have finally landed that dream work-from-home job. Your new corporate masters want to send you a whole passel of credentials, access codes, and username/password pairs to let you into their VPN and their other systems. You can simply give them your public GPG key ID for this purpose. They can verify that your key is attested by a bunch of folks (hence, it's clearly really yours), and they can then use it to send a file which only you can read. Anyone who intercepts the key ID you send them over email won't be able to substitute their own key ID since that would require counterfeiting not only your key, but all of the keys of the people who attested to it.

I have personally used this method to on-board contractors who lived in another country.

Talking to people in private

The gpg key infrastructure gives you the power to transfer any data completely privately. Maybe you want to email your wife your bank information, or discuss pay scales with your co-workers, or transfer some code you wrote to your own machinery. This technology lets you do these things safely and discretely, regardless of the security of your email server, your company laptop, or any other piece of electronic gear you happen to be using. As long as a trustworthy copy of gpg is available and you have access to the correct public keys, you can encrypt anything you need to so that only you and your friends can read it.

Tasks for the Key-Signing Party, in order

Before the Party

After the Party

First, Catch Your Chicken

In order to make your gpg key, you will need to have the Gnu Privacy Guard program loaded on your machine. This guide assumes that you already have this step done. Most modern linux distributions ship with gpg as part of the base operating system set. If gpg isn't on your system, you can use your package manager to load it, or download and build the latest and greatest version from the Gnu Privacy Guard website ( http://www.gnupg.org/ ). I also assume that you can get to a bash command prompt; this guide will tell you how to generate and publish your gpg key from the command line. I am also assuming that you're a version or so back from the most current version of gpg, which is 1.4.10. This seems to be the norm on the machines which I control. If you're using windows, you are pretty much on your own; I know that gpg exists for those machines, but I've no idea how (or if) it works.

To determine if gpg is properly installed and up-to-date on your machine, get to a command-line prompt and type in: 
gpg --version

gpg should respond with something like:

gpg (GnuPG) 2.2.12
libgcrypt 1.8.4
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/devel/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Be sure that the "version" is at least 2.2; if not, you should update your copy of gpg or use a machine with a more up-to-date copy.

Steps to make your gpg key

In this example, I will use the name "Millicent Arondofique" for your name, and the email address "millicent.arondofique@tomshiro.org" for your email address. Substitute your information for these as needed. Your real name and your email address are the only two pieces of information you will need to create a gpg key. From the command prompt, type the following: 


gpg --full-generate-key
gpg will respond with: 

gpg (GnuPG) 2.2.12; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1

Select "RSA and RSA (default)" (here by pressing "1" and "enter").

gpg will next say: 

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072)

You can take the default by pressing >enter< here.

Next, gpg will say: 


Requested keysize is 3072 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0)

You want to make a permanent key, unless (a) you're very paranoid or (b) you're making a key for some special purpose which will expire. To make a permanent key, just press <enter>.

gpg will next give you a chance to go over these steps: 


Key does not expire at all
Is this correct? (y/N)

Press "y" and <enter> here.

gpg will respond with: 


    GnuPG needs to construct a user ID to identify your key.

Followed by a short text form for you to fill out: 


Real name: Millicent Arondofique
Email address: millicent.arondofique@tomshiro.org
Comment: Sample Key

It's best to use an email address which you know you will control for a long time here; a work email, for example, is a Bad Idea. My email address on a domain I control, which forwards to whatever current email address I am actually using. A key without a valid email address is far less useful.

After the final prompt, gpg will check that this is really what you want: 

You selected this USER-ID:
    "Millicent Arondofique Sample Key <{{your real email address}}>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?

Press the letter "O" and hit <enter> here unless you want to make changes. gpg will then ask for a passphrase. If you're in a text window on a GUI, this will come up in a separate window; otherwise, it will probably come up right there. gpg passphrases have no length limit. I tend to rely on length more than Caps and 9umbers, although your mileage may vary here. Substituting numbers for letters is useless, since most password crackers will crack common substitutions such as "9" for "N" or "1" for "i" and makes pass phrases hard to remember. A phrase or a bit of poetry can work well here. Extra points if it's not in English. If you lose or forget your passphrase, you will lose the ability to revoke the key as well as the ability to use it, so it's important to be able to keep this safe.

After this, gpg will actually generate the key: 

    We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    
gpg: key E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111 marked as ultimately trusted
gpg: directory '/home/devel/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/home/devel/.gnupg/openpgp-revocs.d/E8ED6BCB08FAEDAD4DB0CD116D73AA10D588411.rev'
public and secret key created and signed.

pub   rsa3072 2021-11-30 [SC]
      E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111
uid   Millicent Arondofique Sample Key 
sub   rsa3072 2021-11-30 [E]

The keys are generated in files located in your "${HOME}/.gnupg". directory. If you look inside that directory, you'll find a "pubring.gpg" and a "private-keys-v1.d" directory. This is where the keys you created actually reside. You'll use gpg to manage and export them from here. Make sure to keep these files backed up or distributed; if you lose the contents of your "private-keys-v1" directory, you're basically in the same boat as you are if you forget your passphrase. The "pubring.gpg" file contains the parts of the key which you'll publish, so it is marginally less critical -- but you probably want to keep it backed up as well, because that's where all your friends' public keys go, and it'll be painful to reconstruct should you lose it.

Testing Your Key

You have now created your gpg key on your local machine. You can test it with the following commands:

gpg --list-key "Millicent Arondofique" should list the key: 

    pub   rsa3072 2021-11-30 [SC]    
    E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111
uid           [ultimate] Millicent Arondofique Sample Key 
sub   rsa3072 2021-11-30 [E]

Note in this listing the big long number just under "rsa3072". This is your key's identifier, which we will use in the formal setting of the keysigning party to verify that this is indeed your key. The common un-ambiguous way to refer to a gpg key is with a "fingerprint", which is the last 8 digits of this key -- "A4AC 3C50" in this case. You can use this fingerprint to look up a key on a keyserver, but beware that it is not totally secure. It's easy to create a key identified by an identifier with the same last 8 digits, and that in turn is easy to confuse with your real key. Always use full identifiers to verify a key.

You can list your key locally through its fingerprint: 


    gpg --list-key --fingerprint D5884111

Which should give you something like: 


    pub   rsa3072 2021-11-30 [SC]
      E8ED 6BCB 08FA EDAD 4DB0  CD11 6D73 AA10 D588 4111   
uid           [ultimate] Millicent Arondofique Sample Key 
sub   rsa3072 2021-11-30 [E]

Note that the last 8 digits of the full key ID and the fingerprint are the same. You should not use 8-digit key fingerprints in public, however, since with only 32 bits of data they're vulnerable to counterfeiting.

To encrypt a file, use the "encrypt" command on it. Specify your key's fingerprint as the receiver. If you need to send it through email, the "--armor" option will convert the encrypted file to an all-ASCII representation. This is slightly bigger but guaranteed not to be corrupted in transit: 


    gpg -r A4AC3C50 --armor --encrypt gorey.txt

You can, of course, also use the name: 

gpg -r "Millicent Arondofique" --armor --encrypt gorey.txt

And you can specify multiple recipients, as long as they are in your public keyring: 

gpg -r "Millicent Arondofique" -r"Annette Arondofique" --armor --encrypt gorey.txt

In this case you will get a file which Millicent and Annette can read.

This will get you a file with ".asc" appended to its name ("gorey.txt.asc" in the example). The contents should be encrypted; if you cat(1) it out to the screen, it should look something like this: 

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.9 (GNU/Linux)

hQEMAyH27YShGH15AQf/dT515stF4o4+HOfRCDyKTVyKOKhpPt8BjrMa3076fHzH
jrvRZz2kmzIiJRXmp16SKu4dbtZqdMzF71pDIkE1+PNTTciGLjqWlVnQGnP0qiXy
B0FjW3fdc0P9nFBCKktHMCC5POH7+UE70OE7ko8c7bb0Ac9Z7i9+28kfCFxcQeK7
YuEEy9Twkp8X4yIXzX6JhkfLTsus1Rna9d2r1h2MN1W9DXhA1wmwcwek8SR/yNLR
foY8pjfgraepLG12ZS9MY2uvXoI0hXFL6XgXmBH5SSxvJ9fenqptvbzYqFtzTWOs
/j2axn/9n4jr4fSAtvjCjvExlykNicBAvXQ2HOfCb9LpAbRoSunv8y5cpbQZjQKS
Uqk51FAnwpJ0H1h6uZEO/uZiYtR/Hhg3gpMoy3ITayob6+JW7d7NBTNa0B7Ut+WU
/3FzB0BdUJltIoUOBeeF2STCsPsNVOf4nAx3mgxGo2K/pKKXpOSjeZQbm8WodJa7
+rGPltt2Pegdutvtv3mAXk3QmlbMqm7tZQ1I5MI0KlKe9h0/RhNQjW2Jdp7cz92/
GJHkwSWwOl8Ql9ticf5xK1kN0zfX45hsbK57PMwJmStqbdYSAov8pCUr0OEj5UCs
ZB9zExKEP41p1n3RLdjF2BCi3i6q6nJMdO8mjA9tDGy8cbg/OjA/K00QJXLWvtnT
5Q9dEZaxyzL8TkpGHHFPlT4BXPTc090nnZMpFGLEQ6Y8/z+YBVlPGsty8gBaAWWg
dZb8vJ8C29ycqY++GJ1jkZGs2BuxBti7Stz+ALXg8DlQ0ZAJcfr/MEqAaBCKA25T
BGexkWQ6RaBUKE/DTaNjx2la1+ahleDZUEvZEa/ebs6Jel6MM101MiWzEuRG+3vA
FfY3CVnkNnXLjofJS/KNnl92HZbBFf6s2orVRDeppOaUN5Fyo/d6ZKGmcRxFa/kf
IQXPqIWfRBTPBGqjWvBnKyIc82ay2KZ+CSAcAOTZ4AVQsaYuKGwrxrSKpJ1mYcZ/
ZgbhL/DQ2GisE7fFeBCc4ioziH6M1/390e28cTSY4pFg8yKv4GbYb+X8e8s3DuWH
cYPqLKxV7AvuuWMhSX9QcvQCBW08
=9lFc
-----END PGP MESSAGE-----

You can decrypt the file with the "--decrypt" command: 

gpg --decrypt gorey.txt.asc

gpg will ask for your passphrase in a separate window if you're on a GUI.

When your pass phrase is correctly entered gpg will decrypt the file to stdout. You should see the original contents of your file on the screen.

Publishing your Key

 In order for your friends to use your key to send you stuff, and in order for you to be able to prove that you sent something, you must publish the public part of your key to the world. You do this by using gpg to upload it to a key server. The interweb contains many key servers, and they communicate with each other, so it's only necessary to publish your key once; eventually all the key servers will know about it. We are using ubuntu's key server ("keyserver.ubuntu.com") for this party, but many other organizations run keyservers. One of the most famous is run by MIT ("gpg.mit.edu"). To publish your key, use gpg as follows (using your key fingerprint, as explained earlier): 
gpg --keyserver keyserver.ubuntu.com --send-keys {{your fingerprint}}
gpg will hold for a little while, then respond with: 
gpg: sending key D5884111 to hkp server keyserver.ubuntu.com

At this point you should be able to see your key on the keyserver by pointing your browser at "https://keyserver.ubuntu.com" and typing your name into the first box. The key ID search feature appears slightly broken on ubuntu's site, but usually you can search for a key by its ID as well by prefixing the ID with "0x". This is only the Public portion of your key -- the Private portions are on your disk in your "${HOME}/.gnupg" directory, which you should back up carefully. Losing this directory is functionally equivalent to forgetting your passphrase.

Sending your Key to the Partymaster

The point of a keysigning party is to get other people to connect the key you have made to you personally. They do this by seeing you and the key fingerprint together, then attesting that you are connected by signing your key (see "Signing a Key", below). To make it convenient for everyone involved, you must send your key to the party master, so that he can print out its fingerprint and provide the key itself to your friends.

I will take care of managing the keys for this party. You will need to email me your key at charlesshapiro@annuitas.com . First, you need to export your key in a form which is easily emailed. Use gpg to do this as follows: 

gpg --armor --export "Millicent Arondifique" > /tmp/pubkey.txt

You can check /tmp/pubkey.txt by cat(1) ing it out. It should look something like this: 

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)

mQENBEsAFAoBCADQCKADsYZhDm8fFQL/t2b/8BytmgtPvNYeBKUUbz9gxjXIOGNN
5Kw+DyF76ZLF3yiTSek98KuV0dCs6/pO2XOp9GfrDOlIbdIE8CC0kT6iXhF4p96I
6HHw0ykPChlOuMzUE8aHSVGK5ww20t3CzfdIsccNd77eFHnjCDvWxJfdJaqb6H4C
x3Rq/0rywIcrYeNIELNldL6npE9RuAeCujO8/rNHvqbofmWCbz2ouWWkxF1MuZkU
V8tOTmT0MiZDD0QsOFF8o+MnEmMrYytJH8LrpYsQ8kVE+0JpiKhfajk69CM3JjHb
BFsJr8IsghoV3NtqqMpo2gLSvblT8y9x7Bn5ABEBAAGJAU0EIAECADcFAksAKhMw
HQNUaGlzIGlzIGFuIGV4YW1wbGUga2V5IHdpdGggbm8gbGVnaXRpbWF0ZSB1c2Uu
AAoJEG1zqhDViEEROkoIAIxOLIKstWDmKBgLTjraO9QRP2VvMfK/LQ0UXQkGwoYL
1TgQ+38I2/n+HIdApK0kSMQBHNmsL+fWqEZyvPG11vMVJzI9uyy8vm1zWII+QeT3
j3aIQrvsCVg5A7GPvTsTvU1Rl8ANPSVhqwHPjjvJynMgUuyPZin7RBE8d23dB9/K
bZp6VElsa5BsdHyVeESwhHMyd0ryQbGuvx7ZuPvA/euoxPkrCYhkC+2Ced46wigR
0kpC4rWaBU7S+LJqeHcyawcUCn2tbgQUCo4yiT+JOgOadDH1DAPM9jQ5AF0xjg15
wdOLWG3iQVSR8j2p9XQuCK9i2rZjbpBR3fgJy6OxP2W0TE1pbGxpY2VudCBBcm9u
ZG9maXF1ZSAoRXhhbXBsZSBncGcga2V5KSA8bWlsbGljZW50LmFyb25kb2ZpcXVl
QHRvbXNoaXJvLm9yZz6JATYEEwECACAFAksAFAoCGwMGCwkIBwMCBBUCCAMEFgID
AQIeAQIXgAAKCRBtc6oQ1YhBEY3dCACDIUhak8AWaUj3JtdfXYCBi2bZnhOPHbVZ
abPrkKTbOeLdPn6DEACu091h4It6uYYp52OQk8iF2AQBOO3AEDY3ZFk2QNEmrsoo
te7/tuu+DVbfFdUTWRrcPZvk/egBgGVtFf5TnWya8w9wMrU+9rN/RSchiJVNeDXB
vrb17OgMU0kjzDyuQADe57sVUO2VgSRsBWWa/1eqthu0XpFh9hcIY2q3jrsltX+G
7JDc3GW9j93IW/gFYmU3QpaMRZVLOYtyGjlBCedkVK6IKgMqIAnstkOaOgOsFBYl
2wHipez/pv66H9MPKcFKZWSsgiHWP2fqgFci5Yo69eNM7eKUUdS9iEYEEBECAAYF
AksAInEACgkQyTB7how4fUcu2QCfcHkSuoaeYF3G/d70LhQ47C/oyF8AoPfo+u7f
WBQJFReLi2wq69EU4BciuQENBEsAGTwBCACuACNS6W6q1wVkd+IIkRGCYta/9e+s
9wqNceh+d/aQuDW/trBUqd+0ew0if7nAeINBvXCuKjWeb3T/FNIpVuWmN4OocYjs
gxjKtU3aMCM1TQcz+KGCTxqYKUtsWBdvOvG6jqyhYMk3AOfbbrO8mli8LrkSM2Wj
SfNKOuZYpZyJsJRiWDVuAkPmWvLsnY7OFn7lqZtAar+EKi0/oXBmdpIPWqyb8P92
b/wARlHlFZsgTDip9qJYnswPmycCGKdaK+WA6lFNQLh/9U45AFpBG7wgC50BusG6
ASF5aKhot7juWw0TD36rxDHeVp4lZfybJtLeBOPfvCm5QWWw3fF5qzbPABEBAAGJ
AR8EGAECAAkFAksAGTwCGwwACgkQbXOqENWIQRGVTgf8CoMRp8qbnMVgLTsgaswV
ilx+1rZvN0dns7KNTtE0lsiCKeVSIDM7LcmlKFhWO5Fvs09M1f5fsmbRVmExWW/n
Zra0XBRAnSREOoSwpLjllNE/xBxquQQ/aj9azk9jniOMhGZh+OM3YrZKJhtLmEbc
6V4LFKQiP5SKPsK4FVp4pnmq90G/sX13/KgBgc3XHGIp8YNSO3WDSqjZ95sCtT8M
mBDxVog9XTG4P+GDgi2SczA69B0P8piKB+J3x4saxstCrLHrojrUbD+raxj030sU
f6S6qzNjnGnWyluohaVZ4txVX88L3hav24KOZiIxIZaIvpgeTGmcAyd8q/M1UibG
Eg==
=mXNc
-----END PGP PUBLIC KEY BLOCK-----
All you need to do now is email this file to <charlesshapiro@annuitas.com>, either as part of an email message or as an attachment to an email message. I will update the keyring you'll download to sign other peoples' keys with your public key. This is the end of the tasks you need to do before the keysigning party.

Getting the keys of the other people in this key-signing party

I will email you a file containing the public keys of everyone in the key-signing party. Add them to your keyring with the import command. I'm assuming that you have downloaded "pubring.gpg" to your /tmp directory here: 

gpg --import /tmp/pubring.gpg

This will import the new keys, giving your a short report on what happened. It will skip any keys already in your keyring (such as yours) and give you a brief report of its actions at the end: 

gpg: Total number processed: 9
gpg:               imported: 4  (RSA: 2)
gpg:              unchanged: 2
gpg:           new user IDs: 15
gpg:         new signatures: 464
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0  valid:   4  signed:  20  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1  valid:  20  signed:   5  trust: 20-, 0q, 0n, 0m, 0f, 0u

Signing a Key

The "Web of Trust" works by having validated key-holders verify that other key-holders are really connected to their keys and then signing their keys. Signing a key technically involves encrypting its checksum with your private encryption key; that way, anyone can use your public decryption key to decrypt the checksum, verify that it is indeed the same, and (a since they used your public decryption key to arrive at it) know that you yourself actually signed the key ( and thus attested that it is real). gpg handles all this automagically. You need to sign the key of everyone you saw with their key at the key-signing party. If you were there, they will do the same for you, and your key will also become more trustworthy. To sign a key on your keyring, use the "sign-key" command: 

gpg --sign-key  D5884111

gpg will display the key you wish to sign and give an "Are you sure?" message: 

pub  2048R/D5884111  created: 2009-11-15  expires: never       usage: SC  
                     trust: ultimate      validity: ultimate
sub  2048R/A1187D79  created: 2009-11-15  expires: never       usage: E   
[ultimate] (1). Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>


pub  2048R/D5884111  created: 2009-11-15  expires: never       usage: SC  
                     trust: ultimate      validity: ultimate
 Primary key fingerprint: E8ED 6BCB 08FA EDAD 4DB0  CD11 6D73 AA10 D588 4111

     Millicent Arondofique (Example gpg key)
     <millicent.arondofique@tomshiro.org>

Are you sure that you want to sign this key with your
key "Charles Shapiro (correct email address)
<charles.shapiro@tomshiro.org>" (8C387D47)

Really sign? (y/N)

You can verify the fingerprint of the key you're about to sign with the paper you brought back from the party. If they match,say "y" here, and gpg will ask for your passphrase: 

You need a passphrase to unlock the secret key for
user: "Charles Shapiro (correct email address)
<charles.shapiro@tomshiro.org>"
1024-bit DSA key, ID 8C387D47, created 2003-01-30

Enter passphrase:

If you enter the correct passphrase, gpg will sign the key and exit.

You can now see the signature if you list the key with the "list-sigs" command: 
gpg --list-sigs D5884111

pub   2048R/D5884111 2009-11-15
uid                  Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>
sig 3        D5884111 2009-11-15  Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>
sig          8C387D47 2009-11-15  Charles Shapiro (correct email address) <charles.shapiro@tomshiro.org>

To update the key server with your new key signature, simply send the signed key to it: 

gpg --keyserver keyserver.ubuntu.com --send-keys D5884111

After a short time, you should be able to search the key server for the key you signed and see your signature on it.

Revoking a Key

You cannot remove a key from the network of key servers. Under some circumstances (for example, making an example key which will never be legitimate), you will want to mark your gpg key as unusable on the servers.

Start by using the "gen-revoke" command to make a "revocation certificate": 

gpg --gen-revoke D5884111

sec  2048R/D5884111 2009-11-15 Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>

Create a revocation certificate for this key? (y/N)

Press "y", and gpg will respond with: 

Please select the reason for the revocation:
  0 = No reason specified
  1 = Key has been compromised
  2 = Key is superseded
  3 = Key is no longer used
  Q = Cancel
(Probably you want to select 1 here)
Your decision? 3

Next, you will get a chance to enter a comment: 

Enter an optional description; end it with an empty line:
> This is an example key with no legitimate use.
>

Next, you'll get a "go back" dialogue: 

Reason for revocation: Key is no longer used
This is an example key with no legitimate use.
Is this okay? (y/N)

Press "y" and <enter> here, and gpg will prompt for the key's passphrase. Get that right and you'll see: 

You need a passphrase to unlock the secret key for user:
"Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>"
2048-bit RSA key, ID D5884111, created 2009-11-15

ASCII armored output forced.
Revocation certificate created.

Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable.  But have some caution:  The print
system of your machine might store the data and make it available
to others!

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: A revocation certificate should follow

iQFNBCABAgA3BQJLACoTMB0DVGhpcyBpcyBhbiBleGFtcGxlIGtleSB3aXRoIG5v
IGxlZ2l0aW1hdGUgdXNlLgAKCRBtc6oQ1YhBETpKCACMTiyCrLVg5igYC0462jvU
ET9lbzHyvy0NFF0JBsKGC9U4EPt/CNv5/hyHQKStJEjEARzZrC/n1qhGcrzxtdbz
FScyPbssvL5tc1iCPkHk9492iEK77AlYOQOxj707E71NUZfADT0lYasBz447ycpz
IFLsj2Yp+0QRPHdt3Qffym2aelRJbGuQbHR8lXhEsIRzMndK8kGxrr8e2bj7wP3r
qMT5KwmIZAvtgnneOsIoEdJKQuK1mgVO0viyanh3MmsHFAp9rW4EFAqOMok/iToD
mnQx9QwDzPY0OQBdMY4NecHTi1ht4kFUkfI9qfV0LgivYtq2Y26QUd34CcujsT9l
=4wK2
-----END PGP PUBLIC KEY BLOCK-----
!:/tmp>
Use <copy> to put this into a text file, beginning with the -----BEGIN and ending with the BLOCK-----

Import this revocation into your local keyring: 

gpg --armor --import millicent.revoke

gpg: key D5884111: "Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>" revocation certificate imported
gpg: Total number processed: 1
gpg:    new key revocations: 1
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0  valid:   4  signed:  20  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1  valid:  20  signed:   5  trust: 20-, 0q, 0n, 0m, 0f, 0u

If the import was successful, you can update your key server with the revoked key: 

gpg --keyserver keyserver.ubuntu.com --send-key D5884111

If you search for the key, you should now see an indication that it has been revoked: 

sig revok  D5884111 2009-11-15 __________ __________ [selfsig]

Chicken Soup for Your Security

As a group, most of the members of ALE would strongly agree that GPG is an extremely valuable resource for enhancing the security of your data, as well as protecting both your identity and your civil liberties in a world that is increasingly driven by computers and information technology.  We hope the detailed directions above have made it easier for you to understand the processes of generating, storing, signing, registering and using GPG keys, and have served to encourage you to create a personal GPG key and participate in this Key Signing party.