Keysigning Party @ Grazer Linuxtage 2013

Kultiges Zusammensitzen und gemeinsames Murmeln magischer Zahlen.
Gert Döring, FdI 95
At the Grazer Linuxtage 2013 in Graz there will be an OpenPGP (pgp/gpg) keysigning party.

The party will be on Saturday, April 20th, at 18:30. It will be located behind the buffet.

What is/Why keysigning?

Please read section One of the GnuPG Keysigning Party HOWTO (note: we are doing the party slightly different, so the other chapters do not 100% apply).


The party will be conducted using Len Sassaman's Efficient Group Key Signing Method:

  1. If you intent to participate please mail your public-key to us: - until Wednesday, April 17th, 2013 - 23:59.

    If your key is not listed at now, please contact us personally.

    This deadline has now passed. If you haven't submitted your key yet, it's too late.

    If you still want to participate, please follow the points listed below, like everybody else (i.e. grab the file, check the checksum and bring the printout with you). This is so that you can sign other people's keys.

  2. By Thursday, April 18th 2013 you will be able to access all the keys that were submitted along with a text file (ksp-glt13.v2.txt) giving the fingerprint of each key on the ring.
  3. At home, verify that the fingerprint of your key in ksp-glt13.v2.txt is correct. Also compute the ripemd160 hash of ksp-glt13.v2.txt. One way to do this is with gpg invoked as follows:

    % gpg --print-md ripemd160 ksp-glt13.v2.txt

    Just to be sure that you have no problems with the download, here is the ripemd160 hash as we have calculated it:

    BB90 D375 1D01 6682 7832 AD4A 91FB 88AB 67FE C64C
    Note that this is just a hint - you must do the check yourself offline.

    We will also read the SHA256 hash, so you should calculate that too (gpg --print-md sha256).

  4. At the Linuxtag, come with the hash you computed, a hardcopy of ksp-glt13.v2.txt and an official identification document (passport or identity card) with photo!
  5. A reader at the party will recite the ripemd160 hash of ksp-glt13.v2.txt. Verify that the hash recited matches what you computed. This guarantees that all participants are working from the same list of keys.
  6. In turn, each participant will stand and acknowledge that the fingerprint of his or her key listed is correct. Mark the key verified on your hardcopy. Since we already ensured that everybody has the same copy a simple statement like "yes, this information is correct" is sufficient.
  7. The next step is to verify each participant's identity by checking her passport or similar form of ID.
  8. Later that evening, or perhaps when you get home, you can sign the keys which you were able to verify hardcopy. After you signed a key send it to its owner together with your signature.

Summary: What to bring with you

Relevant Information and Sources for More Information


CA Fire and Forget is a script that helps you in keysigning. It takes a list of keyids on the command line, fetches them from a keyserver and calls GnuPG so that you can sign it. It then mails each key to all its email addresses - only including the one UID that we send to in each mail, pruned from all but self sigs and sigs done by you.

Download it: caff.

Depends: gnupg (>= 1.3.92), perl, libgnupg-interface-perl, libmime-perl, libmailtools-perl (>= 1.62)


Uli Martens wrote a small perl script that, given a key ID and ksp-glt13.v2.txt tells you which keys (UIDs) you already signed by annotating the UID with (S).

153  [ ] Fingerprint OK        [ ] ID OK
(S)  pub  1024D/52698E9F 2001-11-07 Uli Martens <>
     Key fingerprint = A48F 8894 37A0 FDE9 60D5  212A 2A58 CEAA 5269 8E9F
(S)  uid     Uli Martens <>
( )  uid     Uli Martens <>
(S)  uid     Uli Martens <>

Download it: gpgsigs.

It requires perl, gnupg (>=1.2.x) and either Locale::Recode (in Debian Package libintl-perl, in testing and unstable) or recode (Debian Package recode).

Mainained by @CryptoPartyGraz
Based on 2011's info-page by Alexander Wirt This Page Is Valid HTML 4.0 Transitional!