Differences

This shows you the differences between two versions of the page.

--- blug-canary-1 [2019/09/30 17:37]
BLUG Admin
+++ blug-canary-1 [2023/10/31 07:51]
BLUG Admin
@@ Line 15: / Line 15: @@
 ====================================
-Issued for September 2019.
+Issued for October 2023.
 Don't just trust the contents of this file blindly! Verify the
@@ Line 23: / Line 23: @@
 ~~~~~~~~~~~~~
-* biergaizi: 0xFAD3EB05E88E8D6D
+* biergaizi: 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D
-* persmule : 0x2987A25DAC8454A5
+* persmule : 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60
-* wnereiz  : 0xFDFF2E13AA25BE72
+* vimacs   : 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
 THREE DOCUMENTS IN TOTAL.
@@ Line 62: / Line 62: @@
 . Our personal safety and security is not threatened.
-. To avoid security breaches and emphasize the clarity of the warrent canary
+. To avoid security breaches and emphasize the clarity of the warrant canary
 documents, if a signer is temporarily unavailable, only existing signers in the
 "Signer" list SHALL sign a special placeholder notice (this notice itself SHOULD
 NOT be considered a valid canary document) until the signer becomes available
-again and signs the missed documents. A new signer SHOULD NOT sign a warrent
+again and signs the missed documents. A new signer SHOULD NOT sign a warrant
 canary document only due to the temporary unavailability of a existing signer.
 . We plan to publish the next of these canary statements in the first three
-weeks of October 2019. Special note should be taken if no new canary is published
+weeks of December 2023. Special note should be taken if no new canary is published
 by that time or if the list of statements changes without plausible explanation.
+. Due to the ongoing security issues of OpenPGP keyservers, it makes signature
+verification an issue and somewhat a challenge. For completeness, complete
+procedures for canary verification is included here.
 Special Announcements
 ~~~~~~~~~~~~~~~~~~~~~~~~
-None.
+. We've found a workaround for importing keys on https://keys.openpgp.org
+without User-ID. The instructions for verifying persmule's signatures have
+been added.
+Canary Verification Procedures
+~~~~~~~~~~~~~~~~~~~~~~~~
+. To verify biergaizi's signature...
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    is 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D.
+    b. Use the latest GnuPG in any operating system.
+. To verify persmule's signature...
+    a. Due to the previous attacks on OpenPGP keyservers, persmule has published
+    the OpenPGP public key to https://keys.openpgp.org without a User-ID. Using
+    the standard method, it's impossible to import a OpenPGP public key without
+    User-ID. But since April 2013, we have developed a workaround, described
+    below.
+    b. Obtain the dummy public key from any traditional OpenPGP Keyserver,
+    such as https://keyserver.ubuntu.com, and import the public key. The
+    fingerprint is 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60. Note that, to
+    import this key, one must copy and paste the key in ASCII from the Keyserver
+    website to a file or console and use the command "gpg --import". Due to a
+    technical problem, Using "gpg --recv-key" or "gpg --search-keys" does not
+    work.
+    c. This is a special dummy public key with its User-IDs and subkeys stripped
+    that we specifically created, leaving only a "stub" User-ID (with an invalid
+    E-mail address, "glahamm <yiam5Od@gliwrad.invalid>"). Its sole purpose is
+    allowing the subsequent import of additional subkeys.
+    d. Next, with the stub key already imported, obtain the public key from
+    https://keys.openpgp.org using the same fingerprint, and import this key.
+    Because the dummy key with its stub User-ID is already in presence, it's
+    now possible to import the https://keys.openpgp.org public key directly.
+    e. Use the latest GnuPG in most operating system, the signatures made by
+    persmule's key can now be verified as usual. Debian is known to work, most
+    other systems should work just fine, but not Fedora. The subkeys contains
+    signatures made with Brainpool curves, which are disabled on Fedora due to
+    potential patent-licensing problems, causing a "Unknown elliptic curve"
+    error.
+. To verify vimacs' signature...
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    is 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403.
+    b. Use the latest GnuPG in any operating system.
 Proof of Freshness
@@ Line 82: / Line 140: @@
 $ rsstail -1 -n5 -N -u https://www.telegraph.co.uk/news/rss.xml
- Al-Shabaab claims twin attacks on US base and EU convoy in Somalia
+ NHS patients waiting longer than nine months to be offered chance to switch hospital
- Top City lawyer took advantage of 'exceptionally drunk' junior colleague to take her to bed, disciplinary hearing is told
+ UK weather: Amber warnings issued ahead of Storm Ciaran
- Donald Trump suggests Democrat leading impeachment inquiry should be 'arrested for treason'
+ Monday evening news briefing: Israeli tanks cut key road out of Gaza City
- Afghanistan election dispute looms as front-runners both declare victory ahead of results
+ Boris Johnson 'creating chaos', aides claimed on WhatsApp
- Prince Harry in Malawi during Africa tour, in pictures
+ Pictured: Police round up runaway swan in bizarre Hot Fuzz moment
 $ rsstail -1 -n5 -N -u https://rss.nytimes.com/services/xml/rss/nyt/World.xml
- Gems, Warlords and Mercenaries: Russias Playbook in Central African Republic
+ Israel-Hamas War: Israel Will Press On in Gaza, Netanyahu Says, as Troops Advance
- Hong Kongs Status as Neutral Ground at Risk as China Asserts Power
+ Near an Acapulco Beach: Food, Water and Prayer After Hurricane Otis
- Thousands in Indonesia Protest Bills to Limit Rights and Ban Extramarital Sex
+ Riot in Dagestan as Mob Storms Airport Looking for Israeli Passengers
- France Honors Jacques Chirac With a Day of Mourning
+ A Very Slow Game: Why the Pace of Israels Ground Operation Counts
- Xi Extols Chinas Red Heritage in a Land Haunted by Famine Under Mao
+ A Leaning Tower in Italy (Not Pisa) Becomes a Worry
 $ date -R -u
-Mon, 30 Sep 2019 17:34:43 +0000
+Tue, 31 Oct 2023 07:48:30 +0000
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAl2SPNEACgkQ+tPrBeiO
+iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAmVAsYUACgkQ+tPrBeiO
-jW3IBw//co+P9zFGAtkTKTKXtp7qxTNuss/g3fBn7WA91EeSaU2OClkSxfL57fY0
+jW1DDxAAhhS2KOKHchZ0uQci0sO38iQAiGfw0t4uSzNO+Wk+GGxx+rJwj81/l6YS
-/e2YHcH+e8IFhaLQOzeviSRSozb7YfjepSXGeboD96WBJpwn1pDlZ5X2symZJlbD
+g7kE6Hm3IHf8FJQSGzCT1HaURtABX279vS5MIxrbPnI+hPTi22py5140qyiSRpVh
-teTfmm/vtiVW+QgHRnLItibii4aBfbaa7ITWzHrBltKbCJkP+ZGWwCVYULv1pyML
+mSNDfa+R7xAwu5872v6cF8TbJNkDEg1q3vVgF6ubp0ibEzI79y/7IYAtgMU87o29
-kZ9cRlhII35K2TxXsLNjI3Yoq8dVyoSnrsPaSckknVeoeU2QdWH1nNP6cQ0nVqs8
+nQ1VMLxfENQTJa1eUijugc0rcGju9MajtAUqGCYGVjnJ31I5awGwa7v53vltjfzm
-PNVKFuR9RcHRK1b57beT/XfFqwJwE7sUV0FSLdRYRlAkJHH5tQ5/Zu3jnieWf/lA
+TY3FIprFsznLyWz9gcX/vSv4kDioY7JUkrPQIHDcyUtGAxCFaush6kmV54klWgH
-G2noZmFQCSGoxQ4ccOJEGWWEaxQ1Qp7w6WIUOsubWc2yUeGQTcOAvvKff8DbskGF
+ii6/z5aoiVDgtV0ojQ5BHDrLYxHB0OSEg6fe0gku+gmXIa6oCAsWUO1QEqhCusmH
-YoYonEcipAx1pyb1ljMHHK0Dw/9YMzHY+e5cHPN4SCJ94vxoXC53kJ1v+1i5gCHU
+khZZZ/2LTv031Xl4rJX4sIR4ns98J/FAQVNf9HYoGe65Yr2LoSA3pAkQc8wDakC
-QnliYVGsYSKuYL2W7/fyDR9DxmLljbjUWoiJWI2hebunFVIPHfkDfL9YgAJMPI6v
+nodBhkjghs9pyYtxmyv1e66r3DNlEY1baBxUwKArqFmQIj3CgytGKyiEjsl4Khkv
-zNiiWm/M/1x2t7weifiOs4u/jhVDQPHi5Bar5BICMLKOd6V96COWTUtgWHRz7nF
+ttO8Rz+Ez9PyA5zKNmuKE3/xkFs+2lV0K3DSA6ExvaXrTASLYDWgr3tx3hFxjfab
-noRF5vwCo+rbgb2AZzWzAcpB4pn7CF4T/wRO05hYHvaIBKkDto9AYlxe7pKJ9zgD
+vf8hWlRyulEZlRtUHp2ryPuxWz+yBpCdMhOmJKtmximc0/eU+8j5uNUlCH1W9lN
-FyXBmxMLF0nVFKmY6AdirI7FZtuQ36ajLiQk1cP2EC31gEcJ030=
+hJcaYy7HG9OQ/c+Cqy1GyflivDBO/ChgV/gjpW9rny/5TyIsg8=
-=Qx/8
+=x3A5
 -----END PGP SIGNATURE-----
 </code>

BLUG Wiki

User Tools

Site Tools

Differences

Page Tools