Differences

This shows you the differences between two versions of the page.

--- blug-canary-1 [2020/06/26 10:55]
BLUG Admin
+++ blug-canary-1 [2025/08/30 10:07] (current)
BLUG Admin
@@ Line 15: / Line 15: @@
 ====================================
-Issued for June 2020.
+Issued for August 2025.
 Don't just trust the contents of this file blindly! Verify the
@@ Line 24: / Line 24: @@
 * biergaizi: 0x255211B2395A5A3E0E48A0F1FAD3EB05E88E8D6D
-* persmule : 0xEDFFE248ECFACDE3C805906804A40D21DBB89B60
+* persmule : 0x7636112A33805777A0646B1BFA7C50B699AC61D2
 * vimacs   : 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
@@ Line 70: / Line 70: @@
 . We plan to publish the next of these canary statements in the first three
-weeks of July 2020. Special note should be taken if no new canary is published
+weeks of September 2025. Special note should be taken if no new canary is published
 by that time or if the list of statements changes without plausible explanation.
+. Due to the ongoing security issues of OpenPGP keyservers, it makes signature
+verification an issue and somewhat a challenge. For completeness, complete
+procedures for canary verification is included here.
 Special Announcements
 ~~~~~~~~~~~~~~~~~~~~~~~~
-. Due to personal reasons, wnereiz (0xFDFF2E13AA25BE72) voluntarily decided
+None.
-to quit from the warrant canary team and he is no longer a signer of the
-warrant canary documents since April 15th, 2020. All statements from the
-warrant canary documents before this date are still valid. This is an official
-decision that can be verified by checking the warrant canary document in April,
-signed by wneriez.
-. In the previously mentioned document designed by wneriez in April 2020,
-the date in its statements was mistakenly written as "April 15th, 2019",
-which was a typo, but cannot be changed due to the nature of digital signature.
-We declare that it's hereby corrected to "April 15th, 2020".
-. A new member, vimacs (0xEA2DB82FE04A9403) has became a new signer since this
-month. You can validate the new keys by cross-checking the other two copies of
-this document, signed by biergaizi and persmule.
-. Due to the ongoing security issues of OpenPGP keyservers, it makes signature
-verification an issue and somewhat a challenge. For completeness, complete
-procedures for canary verification has been added.
 Canary Verification Procedures
@@ Line 109: / Line 95: @@
 . To verify persmule's signature...
-    a. Unfortunately, it's not possible yet. Recent attacks on OpenPGP key-
+    a. Due to the previous attacks on OpenPGP keyservers, persmule has published
-    servers have raised great security concerns within the community, as a
+    the OpenPGP public key to https://keys.openpgp.org without a User-ID. Using
-    countermeasure, persmule's new public key has been published to the
+    the standard method, it's impossible to import a OpenPGP public key without
-    https://keys.openpgp.org/ keyserver, but without a User-ID. Currently,
+    User-ID. But since April 2013, we have developed a workaround, described
-    it's impossible to import a OpenPGP public key without User-ID for a
+    below.
-rd-party to verify the canary document signed by persmule.
-    b. We are looking for a solution. But for now, you should check the
+    b. Obtain the dummy public key from any traditional OpenPGP Keyserver,
-    canary documents signed by biergaizi and vimacs to decide the validity
+    such as https://keyserver.ubuntu.com, and import the public key. The
-    of the canary documents. This effectively reduced the number of signers
+    fingerprint is 0x7636112A33805777A0646B1BFA7C50B699AC61D2. Note that, to
-    to two people. It reduces the level of confidence, but currently there is
+    import this key, one must copy and paste the key in ASCII from the Keyserver
-    no alternative option yet.
+    website to a file or console and use the command "gpg --import". Due to a
+    technical problem, Using "gpg --recv-key" or "gpg --search-keys" does not
+    work.
-    c. Once the technical problem of using a public key without User-ID is
+    c. This is a special dummy public key with its User-IDs and subkeys stripped
-    resolved, you can check the previous signatures retroactively, and this
+    that we specifically created, leaving only a "stub" User-ID (with an invalid
-    would effectively restore the level of confidence. You can archive the
+    E-mail address, "Kikek <othar7ok@ep2quey.invalid>"). Its sole purpose is
-    documents to your own machine as soon as it's published to ensure no data
+    allowing the subsequent import of additional subkeys.
-    tampering has occurred.
-. To verify vimacs' signature...
+    d. Next, with the stub key already imported, obtain the public key from
+    https://keys.openpgp.org using the same fingerprint, and import this key.
+    Because the dummy key with its stub User-ID is already in presence, it's
+    now possible to import the https://keys.openpgp.org public key directly.
-    a. Due to the recent attacks on OpenPGP keyservers, vimacs has published
+    e. Use the latest GnuPG in most operating system, the signatures made by
-    the OpenPGP public key to https://keys.openpgp.org, again, without a User-
+    persmule's key can now be verified as usual.
-    ID. But it's possible for a 3rd-party to verify the signatures by following
-    these steps.
-    b. Use Debian GNU/Linux operating system and install GnuPG. Other operating
+. To verify vimacs' signature...
-    systems may lack the necessary out-of-tree GnuPG patches required, Debian
-    must be used.
-    c. Fetch vimacs' old public key from a traditional OpenPGP Keyserver, such
+    a. Obtain the public key from any traditional OpenPGP Keyserver, such as
-    as https://keyserver.ubuntu.com, and import the public key. The fingerprint
+    https://keyserver.ubuntu.com, and import the public key. The fingerprint
-    is 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403. You should see an expired
+    is 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403.
-    public key.
-    d. Fetch vimacs' new public key from https://keys.openpgp.org, using the same
+    b. Use the latest GnuPG in any operating system.
-    fingerprint, and import the public key. You should see that the public
-    key has been updated.
-    e. Please note that the key is still shown as "expired" because the new key
-    has no UID associated. But you should be able to see a new, valid (not
-    expired) subkey by...
-        $ gpg --list-options show-unusable-subkeys 	--list-keys 0x7079B481F04B5D8B65A0ECDEEA2DB82FE04A9403
-    f. Now, it's possible to verify the signature by following the standard
-    procedures. Ignore the "key expired" warning (because the latest UID is
-    not published, only the expired UIDs are available).
 Proof of Freshness
@@ Line 162: / Line 134: @@
 $ rsstail -1 -n5 -N -u https://www.telegraph.co.uk/news/rss.xml
- Travel latest: 'Unenforceable' air bridges could lead to tourism subterfuge
+ GCSE results day 2025: What time will grades be released today?
- Do I need to self-quarantine for 14 days after travel - and what are the rules?
+ Ucas Clearing 2025: How to get a last-minute university place
- How do coronavirus home antibody tests work, and how do I get one?
+ Britain braces for heatwave temperatures to soar
- Mexican President rebuked for comments on women staying home
+ Man charged with murder of rugby player and father
- How many coronavirus cases are in your area? Use our tool to find out
+ Charity rowing crew mistaken for illegal migrants by Rupert Lowe
 $ rsstail -1 -n5 -N -u https://rss.nytimes.com/services/xml/rss/nyt/World.xml
- Chinas Military Provokes Its Neighbors, but the Message Is for the United States
+ Croquet, Anyone? Making Moscow a Vast Fun Zone to Divert Minds From War.
- Huge Explosion Near Irans Chief Military Base Shakes Residents
+Dead in Indonesia After Jumping From Building Protesters Set on Fire, Official Says
- U.S. Postpones Balkan Peace Summit, in Blow to Trump Foreign Policy
+ Londons Peace Monk Chants, Drums and Walks to Urge an End to War
- Australian Politicians Home Raided in Chinese Influence Inquiry
+ The Economic Storm of Crises That Is Battering Afghanistan
- Seven Colombian Soldiers Charged in Rape of Indigenous Girl
+ China Revisits Its War With Japan, Stirring Pride and Fears of Hatred
 $ date -R -u
-Fri, 26 Jun 2020 10:50:29 +0000
+Sat, 30 Aug 2025 10:06:05 +0000
 -----BEGIN PGP SIGNATURE-----
-iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAl710+0ACgkQ+tPrBeiO
+iQIzBAEBCgAdFiEEJVIRsjlaWj4OSKDx+tPrBeiOjW0FAmiyzToACgkQ+tPrBeiO
-jW3Xvw/+KdlTtVEaN0dn3C5n9V+DiBfV37KwrXRuIhJhRsuX2Aaq6SAsFaNWPBhh
+jW1LkA//fmdt1w2wuunQx25/YhqeLU4O7X2XZDZ40bAk/3qThs8iHCQGIeP5vF6Q
-dE9aBWhuLNuMhKskYuSrhXcoA451BqcncELYRgU4LLkPX+Oedo6inbS3R1mHwc/y
+tiwem7XhitwhJb0XV0n09dOS4blycpDLWHkQqhrDoUBXCh0Otng1EyUUOxWvPaku
-VtY4mVGtVLpO7cz23qXaUExqrX1syjl3vZQ+1zyjH/pLJn7j7lhyompRWbawHJvj
+INBYc/OupQfNctW5KuB5OYeZRdfSISllwJeELyEFCBKL24MQ6SUzRFwDKtpJi5BB
-Ha+SaFl1Vvfs0Y8g/ukhqGCm6/NmBxTxHHa6HdfuU5ZNfnLQAHBkGuW/pdqGHA
+gx2fRmnxwL2QENfQudU/Runq1JkmameMf8V16A4UcJit8okfZsaxtuB/s1KQwxLh
-kI4sPHKz4KTsrvEKbhYLGU7gmhKwKqJXEFstfw4MKD5nJ008Gr+4mxo9C8Z5LJ4i
+hgON4BorXnfDdqTZH+HYbPulvKHOd3eZxcrJNyjdgEwe7FZfGPkg6fcR/GI30Dpq
-VNgMFkyN3bi7MNnifdURUYepSZTDIA8EOhznfMrCf5xHKcCenAjasmlOwVU4V5KH
+Hhc4suoV5aYCwlvIYEIwrFOGuHSYDt5gOxXJg1rA2BB4S1EIdYNnpIEPo7FYq2Rn
-vPnA05ezRcd1yQoYmyBKV58ihoKVsnkbx5KpSLJ65WZZaRnjdMHSzm7EvS3sVRqe
+o+ryhNkpo3JLSbPWnZb21+qKyNjWMEAqdDZxg9fnI/CPHhNbi7IWvmcgJSFzmRu3
-RKhsXOHoVyVJer6op73L5LjqziaMDRuVQNZeqoeX/AOVOozu+S5t/MdBGkY0jeZg
+iE40aiHRRdCwo10n94YcgTNEx7N9pwvoni+RDYUzMOB54mK5g1r+CX9agEHv7dL8
-pcx66e7DhArUAmNQun8beEZT+rz6X01hnHYdKiySX3AzfNLM2DRniAD7ZLZllN6
+f/NC1YTDP0E/nDw6MbxYNX8yfKBm9V/f1ONcrU9Tkj7rSuv7sO+JMkSykQ8YM7Mh
-doPvhM1HjiF2p1qEhsBFB4EXTGjwB3bXU057gFFIzNe2KLc8AJCTrGIeedWNZnGu
+HBihYevOczUZ53SMjKVJlFB2VM7f8Sh+jTN4KBDy1u02J2J+xjckES4GlW1rxmAM
-+baMpYWKTnFM2DtUv+b5R9bM4ZM731dljOkx+SzuQ3MzGzz+EPQ=
+ldopmUSaWala4J3R5K2RPhoR7xVmdjjEiv45uSc2G9zU35G0qds=
-=q8k+
+=xUZX
 -----END PGP SIGNATURE-----
 </code>

BLUG Wiki

User Tools

Site Tools

Differences

Page Tools