Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Status of the Debian OpenPGP keyring Jonathan McDowell, Gunnar Wolf What do we do Daniel Kahn Gillmor Jonathan McDowell Gunnar Wolf Escaping algorithmic fragility: So far Debian Project Better key handling practices DebConf 14 • Portland, Oregon
Contenidos Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, 1 What do we do Jonathan McDowell, Gunnar Wolf What do we do 2 Escaping algorithmic fragility: So far Escaping algorithmic fragility: So far Better key 3 Better key handling practices handling practices
We mantain your keyrings Status of the Debian OpenPGP keyring Maybe the naming is suboptimal. . . Daniel Kahn Gillmor, Jonathan McDowell, debian-keyring-gpg 1003 keys Gunnar Wolf debian-maintainers-gpg 221 keys What do we do Escaping debian-nonupload-gpg 10 keys algorithmic fragility: So far debian-role-keys-gpg 9 keys (unused) Better key handling emeritus-keyring-pgp 237 keys (unused) practices removed-keys-gpg 750 keys (unused)
We mantain your keyrings Status of the Debian OpenPGP keyring Maybe the naming is suboptimal. . . Daniel Kahn Gillmor, Jonathan McDowell, debian-keyring-gpg 1003 keys Gunnar Wolf debian-maintainers-gpg 221 keys What do we do Escaping debian-nonupload-gpg 10 keys algorithmic fragility: So far debian-role-keys-gpg 9 keys (unused) Better key handling emeritus-keyring-pgp 237 keys (unused) practices removed-keys-gpg 750 keys (unused)
Active Debian keys Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Evolution of the number of active keys, by type (inactive keys omitted)
Contenidos Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, 1 What do we do Jonathan McDowell, Gunnar Wolf What do we do 2 Escaping algorithmic fragility: So far Escaping algorithmic fragility: So far Better key 3 Better key handling practices handling practices
Getting rid of PGPv3 Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, PGPv3: Weak keys (key fingerprint weakness, short Gunnar Wolf keylength. . . ) What do we do 2005: 261 PGPv3 keys, 903 GPG keys Escaping algorithmic September 2010: zero PGPv3 keys fragility: So far Better key handling practices
Getting rid of PGPv3 Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of keys in the DD keyring, by type
Forcefully removal Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Evolution of PGPv3 key migration was good Gunnar Wolf Some people just didn’t act on time What do we do In the end: Forcefully removed Escaping algorithmic 17 active keys removed fragility: So far Better key handling practices
But. . . What’s wrong with 1024D? Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices
But. . . What’s wrong with 1024D? Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices
But. . . What’s wrong with 1024D? Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices
The situation WRT 1024D (1/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of Nonuploading DD keys, by key length — Absolute
The situation WRT 1024D (2/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of Nonuploading DD keys, by key length — Absolute
The situation WRT 1024D (3/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of Maintainer keys, by key length — Absolute
The situation WRT 1024D (4/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of Maintainer keys, by key length — Absolute
The situation WRT 1024D (5/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of DD keys, by key length — Absolute
The situation WRT 1024D (6/6) Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices Figura: Number of DD keys, by key length — Absolute
Warning Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Until this point, we have stated facts. Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices
Warning Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Until this point, we have stated facts. Jonathan McDowell, Gunnar Wolf What do we do Escaping algorithmic From this point on, it’s all a proposal for fragility: So far Better key discussion. handling practices
The way out. . . ? Status of the Debian OpenPGP Some ideas we put on the table keyring Daniel Kahn Gillmor, Jonathan Set a hard-cutoff date McDowell, Gunnar Wolf Say, Time.now() + 6.months ? Or rather, the last day of this year? What do we do Whatever: +- that timeframe Escaping algorithmic fragility: So far But. . . What about key migration difficulties? Better key People socially disconnected from Debian handling practices People geographically disconnected Consideration to special cases But aren’t we all somehow. . . Special ?
The way out. . . ? Status of the Debian OpenPGP Some ideas we put on the table keyring Daniel Kahn Gillmor, Jonathan Set a hard-cutoff date McDowell, Gunnar Wolf Say, Time.now() + 6.months ? Or rather, the last day of this year? What do we do Whatever: +- that timeframe Escaping algorithmic fragility: So far But. . . What about key migration difficulties? Better key People socially disconnected from Debian handling practices People geographically disconnected Consideration to special cases But aren’t we all somehow. . . Special ?
What about signing based on. . . Status of the Debian OpenPGP keyring Migration documents? Daniel Kahn Gillmor, Non-personal contact? Jonathan McDowell, Gunnar Wolf Personal identification: Unenforceable, but widely What do we do expected Escaping algorithmic fragility: So far Better key handling practices
What about signing based on. . . Status of the Debian OpenPGP keyring Migration documents? Daniel Kahn Gillmor, Non-personal contact? Jonathan McDowell, Gunnar Wolf Personal identification: Unenforceable, but widely What do we do expected (And mostly honored) Escaping algorithmic fragility: So far Better key Where should we encode this expectation? (i.e. DMUP handling practices and friends?)
Contenidos Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, 1 What do we do Jonathan McDowell, Gunnar Wolf What do we do 2 Escaping algorithmic fragility: So far Escaping algorithmic fragility: So far Better key 3 Better key handling practices handling practices
Key handling practices should improve Status of the Debian OpenPGP keyring Many people don’t handle their keys carefully Daniel Kahn Gillmor, enough Jonathan McDowell, Separating master keyring from key du jour Gunnar Wolf Key expiration What do we do Revocation certificates Escaping algorithmic Proper offline storage for master private key fragility: So far material Better key handling . . . practices Cannot have technical solutions for social issues. . .
Expiration: Technical solution for a technical issue Status of the Debian OpenPGP keyring Daniel Kahn Could we require keys to have a set expiration date? Gillmor, Jonathan McDowell, Say, requiring 3 years expiration (+maintaining the Gunnar Wolf key updated, of course) What do we do Demonstrable key update activity (HKPS) Escaping Set a timeframe for expiring keys to be enforced algorithmic fragility: So far Periodic service where we inform you your expiration Better key handling is soon. . . practices
Questions? Status of the Debian OpenPGP keyring Daniel Kahn Gillmor, Jonathan McDowell, Questions? Gunnar Wolf What do we do Escaping algorithmic fragility: So far Better key handling practices keyring-maint@debian.org
Recommend
More recommend
