Differences

This shows you the differences between two versions of the page.

--- blug-canary-1 [2019/11/30 15:50]
Tom Li
+++ blug-canary-1 [2025/11/30 04:14] (current)
BLUG Admin
@@ Line 15: / Line 15: @@
 ====================================
-Issued for November 2019.
+Issued for November 2025.
 Don't just trust the contents of this file blindly! Verify the
@@ Line 24: / Line 24: @@
 * biergaizi: 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D
-* persmule : 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60
+* persmule : 0x7636112A33805777A0646B1BFA7C50B699AC61D2
-* wnereiz  : 0x0A6A91990AC98712274AA18DFDFF2E13AA25BE72
+* vimacs   : 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
 THREE DOCUMENTS IN TOTAL.
@@ Line 70: / Line 70: @@
 . We plan to publish the next of these canary statements in the first three
-weeks of December 2019. Special note should be taken if no new canary is published
+weeks of December 2025. Special note should be taken if no new canary is published
 by that time or if the list of statements changes without plausible explanation.
+. Due to the ongoing security issues of OpenPGP keyservers, it makes signature
+verification an issue and somewhat a challenge. For completeness, complete
+procedures for canary verification is included here.
 Special Announcements
 ~~~~~~~~~~~~~~~~~~~~~~~~
-. Since mid-October, persmule's old signing key 0x2987A25DAC8454A5 has
+None.
-expired. A new key, 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60, has been
-created and uploaded to https://keys.openpgp.org/, it can be obtained from
+Canary Verification Procedures
-this keyserver.
+~~~~~~~~~~~~~~~~~~~~~~~~
+. To verify biergaizi's signature...
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    is 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D.
+    b. Use the latest GnuPG in any operating system.
+. To verify persmule's signature...
-. The new key will be used by persmule to sign future warrant canary
+    a. Due to the previous attacks on OpenPGP keyservers, persmule has published
-documents. You can verify the signature by crosschecking the other two
+    the OpenPGP public key to https://keys.openpgp.org without a User-ID. Using
-documents signed by biergaizi and wnereiz for consistency.
+    the standard method, it's impossible to import a OpenPGP public key without
+    User-ID. But since April 2013, we have developed a workaround, described
+    below.
-. Due to this key rollover, the October message was not signed by persmule.
+    b. Obtain the dummy public key from any traditional OpenPGP Keyserver,
-This did/does not indicate a security incident, all of the statements above
+    such as https://keyserver.ubuntu.com, and import the public key. The
-were valid, and are still valid.
+    fingerprint is 0x7636112A33805777A0646B1BFA7C50B699AC61D2. Note that, to
+    import this key, one must copy and paste the key in ASCII from the Keyserver
+    website to a file or console and use the command "gpg --import". Due to a
+    technical problem, Using "gpg --recv-key" or "gpg --search-keys" does not
+    work.
-. Recent attacks on OpenPGP keyservers have raised great security concerns
+    c. This is a special dummy public key with its User-IDs and subkeys stripped
-within the community, as a countermeasure, persmule's personal User-ID has
+    that we specifically created, leaving only a "stub" User-ID (with an invalid
-not published to the https://keys.openpgp.org/ keyserver. Instead, only
+    E-mail address, "Kikek <othar7ok@ep2quey.invalid>"). Its sole purpose is
-cryptographic information can be obtained from the keyserver, without any
+    allowing the subsequent import of additional subkeys.
-User-ID. Currently, it's impossible to import a OpenPGP public key without
-User-ID to a standard GnuPG installation, as a result, it's not possible
-for a 3rd-party to verify the canary document signed by persmule.
-. We are looking for a solution. But for now, we decided that the best
+    d. Next, with the stub key already imported, obtain the public key from
-option is starting publishing new canary documents using the new key.
+    https://keys.openpgp.org using the same fingerprint, and import this key.
-As a temporary measure, you can check the canary documents signed by
+    Because the dummy key with its stub User-ID is already in presence, it's
-biergaizi and wnereiz to decide the validity of the Statements. By signing
+    now possible to import the https://keys.openpgp.org public key directly.
-their own copies, it indicates that the new key has been verified privately
-by them as valid.
-. This effectively reduced the number of signers to two people. It reduces
+    e. Use the latest GnuPG in most operating system, the signatures made by
-the level of confidence, but currently there is no alternative option yet.
+    persmule's key can now be verified as usual.
-. Once the technical problem of OpenPGP public key without User-ID is
+. To verify vimacs' signature...
-resolved, you can check the previous signatures retroactively, and this
-would effectively restore the level of confidence. You can archive
-persmule's signature as soon as it's published to your own machine to
-ensure no data tampering has occured.
-. Unlike persmule, biergaizi and wnereiz's signing keys are unchanged,
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
-but the Key-IDs have been changed to its full fingerprint format in the
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
-canary document for clarity.
+    is 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403.
-. When new information is available, it will be published in the "Special
+    b. Use the latest GnuPG in any operating system.
-Announcements" section in future warrant canary documents.
 Proof of Freshness
@@ Line 124: / Line 134: @@
 $ rsstail -1 -n5 -N -u https://www.telegraph.co.uk/news/rss.xml
- London Bridge attack: Usman Khan was studentand personal friend of Anjem Choudary
+ Ukraine: The Latest - the worlds most trusted and award-winning podcast on the war
- 'A beautiful spirit who always took the side of the underdog': London Bridge victim named as Jack Merritt
+ An artist made an anti-racist version of the UK flag. Youll never guess what happened next
- Cyprus farmers warn of halloumi shortages over EU protection plans
+ Strictly star arrested on suspicion of rape
- Europe becomes cocaine exporter as countries overflow with drug
+ Driver who hit grandfather dragged him further into the road then fled
- Crossbow killer, 51, who shot his heavily pregnant ex-wife in 'evil' revenge attack jailed for 33 years
+ Teenagers arrested after nursery cyber attack
 $ rsstail -1 -n5 -N -u https://rss.nytimes.com/services/xml/rss/nyt/World.xml
- Students Fainting From Hunger in Venezuelas Failing School System
+ Mourners Honor Victims of Hong Kong Apartment Fire
- For Filipino Seafarers, a Lonely Life Celebrated in Song
+ Top Trump Aides to Meet With Ukrainians in Florida on Sunday
- How an Anti-Brexit London District Could Help Boris Johnson Triumph
+ Gazans Say Israeli Forces Killed Two Children, Amid Persistent Violence
- Spains Leftist Outsiders Are on the Verge of Getting Inside
+ Latin American Leaders Face Both Trump and Voters Deported by the U.S.
- Stabbings Around London Bridge Kill 2 in Terrorist Incident
+ Did Pope Leo Pray in Istanbuls Blue Mosque? Not Visibly, at Least.
 $ date -R -u
-Sat, 30 Nov 2019 15:48:22 +0000
+Sun, 30 Nov 2025 04:12:35 +0000
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
-iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAl3ij1UACgkQ+tPrBeiO
+iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAmkrxEcACgkQ+tPrBeiO
-jW1ePA/7B0KjWXQU6bMlzrh9HggghVmRMju6d0Ox43UYa2jAKkG/XfxWk6h33kH1
+jW2N/A//cqoV6q8rmzj62jq58MehgQY0uEXKjNf1FxXDK4BcqDyVyOvHKPnDZZlF
-EZQu6HCTvUTJ3sygxWzJDapTM/8+lOhJ+SE1qCWYheeDuY9auvJaqXLDHMJ3ey7X
+eKxy1bbXUzDvjJDrpBqGpw4g5+CW5pG40blQnxjXPqrHMqdYQYawgAXprQ96Ftts
-ABPWJFWgEnJK42E/BTqHPirOPOaD1XOcbsqw8NCrKmqt4ijR8SD3JsTJRZS6EtKw
+YUgptFftMsbVDiQkDCER0IZCvLL0BiIlol7/StwLsIK7S38eAzZ8bdwqb1eF/MMc
-sYjSvwdFOv3SBza0nrCiOxisb2Pq48S5jk0LVCcod8i1hvVG1v9kSupzQJGMuswp
+wzJA0gkR9ev68vUmTLv6unyqn/KeA98PHhLBdC0EQVekHMoQ8Zcm3xUEtBt3qUHk
-SItYWz9JogO7s1V3GTn2rTp8kNtzo3QBINXU0dMv8o++rz1dwP1K9jh3E1LP3kNX
+HxMlQw9QlDwzR4kK6t0XT80QxgWKKahutoPPFxsVNJPNPiFoZmocLS56+Gks1T1A
-dbEMC8FRUFbKi9psL+LVHkchrdWJ9lIOUJy/6mUKc9+xlNkqyBLQHZI930qF4hYZ
+X/1jBKJt7BfOp4PPd0+ewj7wYntsXSDjCOlLbfbJtj4yP08i0/nbm+PREgTBhOz
-nY6KF0UsBlEan8BJEF2CjJ8pM9JkuQH33Ek9jtNDZoC1OAH0YUJSDyhkCthW6NDT
+j8kpqk2ETcZEItKcer9ADrXM2rf5y26mIuw56ilss/ONcwNQHTwVv2GUOWneEDQP
-o1DcFPZ/BaaBOooGtg9i/Hb81o0Rsft8atzPOyJH8DaNp2MD2dA7Sz2yWJG6yDAL
+SH10uCnSKHzg2FQ3AEbeWVjj3HVqxOWrdT2YDD8+Pyzwy/82nkjrow6vLuPsQ8qs
-kAi7ZOMSndxthpvvNbBobCKU9brCQzkNeL/0ZJS+nBkhqWwNilnp/WsxKcrwwF7s
+Zg4eJM65fk0FzQdBT9QdhhJps1eFBvMD/PzxJCGNN6Bdv709Ue0qC5bzSWfReBNr
-SFkXX7ZBY8qhQsDr7QHx0IWJitpwABFqfVZ1Wy8RCz9LGaEa1U84bu3cdaUVNjC
+AVGoOtVHrg4XubSIW+3mf/K6mk7LMtv2G+i36+O+K/t2RyGIUGWIFy4s3mi3b7ai
-qmc89M6GblgJXSQOeTCaspcuWR+x4VGuOX8mOzBs65tmmsm4YY0=
+QP3OsCSdBC924AMIM0Ls0pCF9Xnw+BYrg5q+2+g1rSjmmSCslM=
-=7+YM
+=QRZN
 -----END PGP SIGNATURE-----
 </code>

BLUG Wiki

User Tools

Site Tools

Differences

Page Tools