Re: [Key Signing] Problems Downloading Some of the Keys
On Sat, Aug 02, 2003, Shachar Shemesh wrote about "Re: [Key Signing] Problems Downloading Some of the Keys": > Yes, but it is impolite to force me to publisice my key. I may or may > not choose to do so. I'm sorry Shachar, but you do not have this choice. PGP is based on the web-of-trust model where people are encourage to post keys on public servers. In fact, you are explicitly allowed to post someone else's public key to the servers. If the servers had wanted, they could have easily asked you to prove that you own this key, but they don't. Deliberately. So even if you don't post your own key to one of the keyrings, don't be surprised if sometime in the future your public key pops up there. How? If someone does so deliberately (like Muli did), unintentionally (like someone signing your key, and not knowing your "policy" send it to a keyring rather than directly to you) or entirely by accident (if one of the people who know you send their entire public-key ring to a key server). This is not the only privacy problems with public public-key rings, by the way. Another problem is that people can sign your public-key at their whim, without you needing to authorize it. This means spammers (or other bad guys) can get a list of your friends and acquaintances, whether you want that or not. Someone who's not you're friend could sign your key for fun or profit (imagine a signature by "Bin Laden" popping up on your public key). Someone could sign and then retract his signature a hundred times on your public key, making it annoyingly big, just to mess with you. > If I have a seperate public key for friends or if I don't want spammers > to use my gpg email are two random examples. I wonder when people will understand that hiding your email address from spammers is a losing battle... Trying to hide something that was *designed* to be public, be it email addresses or PGP public-keys, is futile. -- Nadav Har'El|Sunday, Aug 3 2003, 5 Av 5763 [EMAIL PROTECTED] |- Phone: +972-53-245868, ICQ 13349191 |My password is my dog's name. His name is http://nadav.harel.org.il |[EMAIL PROTECTED], but I change it every month. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
Nadav Har'El wrote: On Sat, Aug 02, 2003, Shachar Shemesh wrote about "Re: [Key Signing] Problems Downloading Some of the Keys": In the future, please don't upload other people's keys to keyservers. Whether someone's key is published or not should be up to that someone to decide. It is considered impolite to upload someone elses' key. This is silly. If your public key is public, *anybody* could upload it to a keyserver anytime in the future. One of the 25 people who just signed your key might choose to upload your key when they're done. In fact, it's the most obvious thing for them to do. Yes, but it is impolite to force me to publisice my key. I may or may not choose to do so. I find it very strange that someone might not want his public key to be public. Could you give us a scenario why this might make sense? If I have a seperate public key for friends or if I don't want spammers to use my gpg email are two random examples. Think of it this way - you also know my email address. Still, you don't go around publicising that, do you? Shachar -- Shachar Shemesh Open Source integration consultant Home page & resume - http://www.shemesh.biz/ = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Sat, Aug 02, 2003, Shachar Shemesh wrote about "Re: [Key Signing] Problems Downloading Some of the Keys": > In the future, please don't upload other people's keys to keyservers. > Whether someone's key is published or not should be up to that someone > to decide. It is considered impolite to upload someone elses' key. This is silly. If your public key is public, *anybody* could upload it to a keyserver anytime in the future. One of the 25 people who just signed your key might choose to upload your key when they're done. In fact, it's the most obvious thing for them to do. I find it very strange that someone might not want his public key to be public. Could you give us a scenario why this might make sense? -- Nadav Har'El| Saturday, Aug 2 2003, 5 Av 5763 [EMAIL PROTECTED] |- Phone: +972-53-245868, ICQ 13349191 |"A mathematician is a device for turning http://nadav.harel.org.il |coffee into theorems" -- P. Erdos = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Orna Agmon wrote: > On Fri, 1 Aug 2003, Shlomi Fish wrote: > > > there is a limited number of key IDs and supposedly a greater number of > > circulating keys, then there must be two keys which share the same ID. > > It is not SUPPOSEDLY a greater number of keys. If your key is1024 bit > long, you will need 64 hexa signs to express it. The fingerprint only > contains 40 hexa signs, and the key ID only contains 8. So there are more > keys to choose from than key IDs or fingerprints. > Hmmm... I was talking about the keys that were already allocated. Out of all the possible keys not all keys were yet allocated. So even though there's a 1024-bit-space of keys, if there's only a million of them around, it is possible none of them would have the same key ID. Regards, Shlomi Fish > With central coordination, a database maybe, and probably not making it > possible to compute the key ID and fingerprint from the key itself, it > might be possible to assign the first 16**8 keys a different key ID, but > since the gpg can work in a distributed manner (i.e. the keyserver just > holds the key, it does not compute its key ID), then we must resolve to > the natural way of doing it: > > Simply compute the fingerprint (and hence the ID) from the key itself. > > Orna. > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Sat, Aug 02, 2003 at 12:31:45PM +0300, Shachar Shemesh wrote: > In the future, please don't upload other people's keys to keyservers. > Whether someone's key is published or not should be up to that someone > to decide. It is considered impolite to upload someone elses' key. If the key is not on the key server, there's no much point to the whole business of expanding the web of trust, since the effort of finding your public key becomes too great, especially in this age of spam munged email addresses. What I will do in the future, however, is mention in key signing party announcements that anyone who does NOT want his key to be published should tell me so, and I will comply with their wishes. This is in accordance with the gpg key signing howto, which states: "I don't recommend that you keep your public key secret as it will discourage others from using PGP in their communications with you. To address the issue of the possibility of a compromised or broken keyserver returning an invalid key you can take steps to protect yourself from having messages sent to you encrypted with invalid keys, such as publishing your key's fingerprint in your .signature file or on your web page. To address the concern about the attacking of your key pair though your publicly available public key, I would say that if you are very concerned about the strength of your keypair or truly paranoid about the secrecy of your communications, you could generate additional keypairs (which expire in a matter of hours or days) for each communication and exchange the public keys of those keypairs though encrypted communications with the individual you'll be communicating with. If you don't wish to have your key on a public keyserver, you should skip this step and instead email your public key to the keysigning party coordinator with a message stating that you don't want your key on a public keyserver. The coordinator can then extract your public key information and forward your key on to the other participants via encrypted e-mail, or some other method, along with a note stating that the key should be returned to its owner after signature rather than uploaded to a keyserver. " -- Muli Ben-Yehuda http://www.mulix.org http://www.livejournal.com/~mulix/ pgp0.pgp Description: PGP signature
Re: [Key Signing] Problems Downloading Some of the Keys
Muli Ben-Yehuda wrote: On Fri, Aug 01, 2003 at 06:31:25PM +0300, Shlomi Fish wrote: If you are the owner of one of these keys and can instruct me (and others) from which keyserver to download them, I'd appreciate it. I just sent an email with the keyring for all of the people who registered to take part in the keysigning. Enjoy. See you all in Aug. Peng. 2004, Muli. Hi Muli, In the future, please don't upload other people's keys to keyservers. Whether someone's key is published or not should be up to that someone to decide. It is considered impolite to upload someone elses' key. Shachar -- Shachar Shemesh Open Source integration consultant Home page & resume - http://www.shemesh.biz/ = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
Alexander Maryanovsky wrote: First, I'll nitpick a little - you must put at least two pigeons in at least one hole, you don't necessarily have a hole with exactly two pigeons :-) The exact phrase of the pigeonhole principle is that if n pigeons try to enter a pigeonhouse with m holes, there will be at least one hole with at least n/m pigeons. This means that if 1000 pigeons try to enter a pigeonhouse with 30 holes, there will be at least one hole with at least 34 (1000/30=33 1/3) pigeons. Hence, whenever the mapped space is bigger than the mapee space, a colision is inevitable. Now, to something a bit more interesting. It is true that if the keyspace is bigger than the id-space then you will necessarily have several keys sharing the same key-id, *but* in practice you can make it so that the id-space is much, much bigger than the actual number of keys out there making it statistically unlikely for two existing keys to have the same key-id. This is relevant to hash arrays. The ratio between the size of the mapping (how many elements need to be mapped) and the size of the has is called alpha, and an optimal value is considered 0.8. It is totally irrelevant to this problem, as our problem is not the O(1) retrival, but identity verification. This is the case with, for example, good cryptographic hashes - although there obviously exist two (much more than two) messages with the same md5 hash, not only it is highly unlikely to happen for any two given messages, but it is also infeasible (with current mathematical/algorithmical knowledge) to find two such messages. The point about cryptographic hashes is that, while it is possible, and in fact inevitable, that two messages will have the same hash, it is very very difficult to actually find such two messages. If any two messages are fine, then the birthday paradox applies, and I can lessen the difficulty. In this case, the fingerprints are used to authenticate the key. As such, the system only breaks when both fingerprint AND name are the same. If Orna's key has the same fingerprint as my key, that does not break the system. Noone is likely to think that a key labled "Orna Agmon" belongs to me. This means that the system only breaks when someone DELIBERITLY generates a key with the same fingerprint. Cryptographic hashes mean that this is extremely unlikely to happen (and the birthday paradox doesn't apply, as Melica is aiming for a static target). I'll just add that while the keyspace is 1024 bits, the actual keys in that space are rather sparse. This is also the reason that a 1024 asymetrical key is considered about as secure as a 128bit symmetrical key (all 128 bits are valid symetrical keys). This also reduces the chances of collisions considerably. I find it hard to believe that there are no collisions at all, but if you generate all possible 1024 bit asymetrical bits, you are still unlikely to have more than a few collisions all told. Shachar -- Shachar Shemesh Open Source integration consultant Home page & resume - http://www.shemesh.biz/ = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
I'm going to jump into the middle of this discussion not having read it from the beginning so I apologize upfront if I say something stupid or unrelated because of this. The birdhouse principle says that if one is trying to put n+1 birds in n bird-houses, then you must put 2 birds in at least one bird-house. Since there is a limited number of key IDs and supposedly a greater number of circulating keys, then there must be two keys which share the same ID. First, I'll nitpick a little - you must put at least two pigeons in at least one hole, you don't necessarily have a hole with exactly two pigeons :-) Now, to something a bit more interesting. It is true that if the keyspace is bigger than the id-space then you will necessarily have several keys sharing the same key-id, *but* in practice you can make it so that the id-space is much, much bigger than the actual number of keys out there making it statistically unlikely for two existing keys to have the same key-id. This is the case with, for example, good cryptographic hashes - although there obviously exist two (much more than two) messages with the same md5 hash, not only it is highly unlikely to happen for any two given messages, but it is also infeasible (with current mathematical/algorithmical knowledge) to find two such messages. Disclaimer: I don't actually understand anything in cryptology - these are just things I read (or worse, thought of myself), so if I'm wrong, please educate, but don't flame :-) Alexander (aka Sasha) Maryanovsky. At 21:50 01.08.2003 +0300, Shlomi Fish wrote: On Fri, 1 Aug 2003, Shaul Karl wrote: > On Fri, Aug 01, 2003 at 08:17:53PM +0300, Orna Agmon wrote: > > > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > > that vary a little have a very different KEY ID, but since it holds a lot > > less information than the actual key, there is no way of it being uniqe. > > Bird house principle (? - SHOVACH YONIM). > > > > > What is the birdhouse principle and how it gets demonstrated in the > KEY ID space? The birdhouse principle says that if one is trying to put n+1 birds in n bird-houses, then you must put 2 birds in at least one bird-house. Since there is a limited number of key IDs and supposedly a greater number of circulating keys, then there must be two keys which share the same ID. Regards, Shlomi Fish > -- > > Shaul Karl,shaul @ actcom . net . il > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED] = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Orna Agmon wrote: > On Fri, 1 Aug 2003, Shlomi Fish wrote: > > BTW, how does GnuPG know how to generate a unique key ID? I thought the > > server assigned it a key ID out of its key pool. Surely, if any GPG > > program generates key IDs independetly there will be some collision > > between two specific keys? > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > that vary a little have a very different KEY ID, but since it holds a lot > less information than the actual key, there is no way of it being uniqe. > Bird house principle (? - SHOVACH YONIM). Pigeon hole principle (ASLE LAANE KABOOTARI). > Orna. > > = > To unsubscribe, send mail to [EMAIL PROTECTED] with > the word "unsubscribe" in the message body, e.g., run the command > echo unsubscribe | mail [EMAIL PROTECTED] > -- Behdad Esfahbod 11 Mordad 1382, 2003 Aug 2 http://behdad.org/ [Finger for Geek Code] If you do a job too well, you'll get stuck with it. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, Aug 01, 2003 at 08:17:53PM +0300, Orna Agmon wrote: > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > that vary a little have a very different KEY ID, but since it holds a lot > less information than the actual key, there is no way of it being uniqe. > Bird house principle (? - SHOVACH YONIM). It is called 'The pigeonhole principle'. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Shlomi Fish wrote: > there is a limited number of key IDs and supposedly a greater number of > circulating keys, then there must be two keys which share the same ID. It is not SUPPOSEDLY a greater number of keys. If your key is 1024 bit long, you will need 64 hexa signs to express it. The fingerprint only contains 40 hexa signs, and the key ID only contains 8. So there are more keys to choose from than key IDs or fingerprints. With central coordination, a database maybe, and probably not making it possible to compute the key ID and fingerprint from the key itself, it might be possible to assign the first 16**8 keys a different key ID, but since the gpg can work in a distributed manner (i.e. the keyserver just holds the key, it does not compute its key ID), then we must resolve to the natural way of doing it: Simply compute the fingerprint (and hence the ID) from the key itself. Orna. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Shaul Karl wrote: > On Fri, Aug 01, 2003 at 08:17:53PM +0300, Orna Agmon wrote: > > > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > > that vary a little have a very different KEY ID, but since it holds a lot > > less information than the actual key, there is no way of it being uniqe. > > Bird house principle (? - SHOVACH YONIM). > > > > > What is the birdhouse principle and how it gets demonstrated in the > KEY ID space? The birdhouse principle says that if one is trying to put n+1 birds in n bird-houses, then you must put 2 birds in at least one bird-house. Since there is a limited number of key IDs and supposedly a greater number of circulating keys, then there must be two keys which share the same ID. Regards, Shlomi Fish > -- > > Shaul Karl,shaul @ actcom . net . il > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, Aug 01, 2003 at 08:17:53PM +0300, Orna Agmon wrote: > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > that vary a little have a very different KEY ID, but since it holds a lot > less information than the actual key, there is no way of it being uniqe. > Bird house principle (? - SHOVACH YONIM). > What is the birdhouse principle and how it gets demonstrated in the KEY ID space? -- Shaul Karl,shaul @ actcom . net . il = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Muli Ben-Yehuda wrote: > On Fri, Aug 01, 2003 at 06:31:25PM +0300, Shlomi Fish wrote: > > > If you are the owner of one of these keys and can instruct me (and others) > > from which keyserver to download them, I'd appreciate it. > > I just sent an email with the keyring for all of the people who > registered to take part in the keysigning. Enjoy. > Yes, I received this E-mail, signed all the keys and uploaded them to pgp.mit.edu. Thanks! Sorry for being misinformed. Regards, Shlomi Fish > See you all in Aug. Peng. 2004, > Muli. > -- > Muli Ben-Yehuda > http://www.mulix.org > http://www.livejournal.com/~mulix/ > > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Orna Agmon wrote: > On Fri, 1 Aug 2003, Shlomi Fish wrote: > > BTW, how does GnuPG know how to generate a unique key ID? I thought the > > server assigned it a key ID out of its key pool. Surely, if any GPG > > program generates key IDs independetly there will be some collision > > between two specific keys? > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > that vary a little have a very different KEY ID, but since it holds a lot > less information than the actual key, there is no way of it being uniqe. > Bird house principle (? - SHOVACH YONIM). > Actually, I think the birthday paradox is more appropriate. In order for the bird house principle to take effect, there must be at least 2**32+1 keys in the world, which I'm not sure if this is the case now. OTOH, according to the birthday paradox, it is enough to be around the square root of this figure (2**16 == 65536) to have a probability greater than half for any two identical key IDs to be present. For more information about the birthday paradox consult: http://burtleburtle.net/bob/hash/birthday.html Regards, Shlomi Fish > Orna. > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Sat, 2 Aug 2003, Dan Armak wrote: > On Friday 01 August 2003 20:17, Orna Agmon wrote: > > On Fri, 1 Aug 2003, Shlomi Fish wrote: > > > BTW, how does GnuPG know how to generate a unique key ID? I thought the > > > server assigned it a key ID out of its key pool. Surely, if any GPG > > > programgenerates key IDs independetly there will be some collision > > > between two specific keys? > > > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > > that vary a little have a very different KEY ID, but since it holds a lot > > less information than the actual key, there is no way of it being uniqe. > > Bird house principle (? - SHOVACH YONIM). > > Which is why you should always verify the fingerprint, which is much more > unique. The pub key ID is good only for specifying the key quickly when you > intend to veridy it later. > Yeah, so it seems. Upon closer inspection it seems the key ID is the last 8 digits of the key fingerprint. Regards, Shlomi Fish > -- > Dan Armak > Matan, Israel > Public GPG key: http://dev.gentoo.org/~danarmak/danarmak-gpg-public.key > Fingerprint: DD70 DBF9 E3D4 6CB9 2FDD0069 508D 9143 8D5F 8951 > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, Aug 01, 2003 at 06:31:25PM +0300, Shlomi Fish wrote: > If you are the owner of one of these keys and can instruct me (and others) > from which keyserver to download them, I'd appreciate it. I just sent an email with the keyring for all of the people who registered to take part in the keysigning. Enjoy. See you all in Aug. Peng. 2004, Muli. -- Muli Ben-Yehuda http://www.mulix.org http://www.livejournal.com/~mulix/ pgp0.pgp Description: PGP signature
Re: [Key Signing] Problems Downloading Some of the Keys
On Friday 01 August 2003 20:17, Orna Agmon wrote: > On Fri, 1 Aug 2003, Shlomi Fish wrote: > > BTW, how does GnuPG know how to generate a unique key ID? I thought the > > server assigned it a key ID out of its key pool. Surely, if any GPG > > program generates key IDs independetly there will be some collision > > between two specific keys? > > The KEY ID cannot be unique. It can be well distributed, such thatkeys > that vary a little have a very different KEY ID, but since it holds a lot > less information than the actual key, there is no way of it being uniqe. > Bird house principle (? - SHOVACH YONIM). Which is why you should always verify the fingerprint, which is much more unique. The pub key ID is good only for specifying the key quickly when you intend to veridy it later. -- Dan Armak Matan, Israel Public GPG key: http://dev.gentoo.org/~danarmak/danarmak-gpg-public.key Fingerprint: DD70 DBF9 E3D4 6CB9 2FDD 0069 508D 9143 8D5F 8951 pgp0.pgp Description: signature
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Shlomi Fish wrote: > BTW, how does GnuPG know how to generate a unique key ID? I thought the > server assigned it a key ID out of its key pool. Surely, if any GPG > program generates key IDs independetly there will be some collision > between two specific keys? The KEY ID cannot be unique. It can be well distributed, such thatkeys that vary a little have a very different KEY ID, but since it holds a lot less information than the actual key, there is no way of it being uniqe. Bird house principle (? - SHOVACH YONIM). Orna. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
Re: [Key Signing] Problems Downloading Some of the Keys
On Fri, 1 Aug 2003, Aviram Jenik wrote: > On Friday 01 August 2003 18:31, Shlomi Fish wrote: > > when I tried to actually download the keys from a key-server and sign > > them, I discovered that some of the keys generate the following error: > > > > <<< > > shlomi:~# key=05cd5901 > > shlomi:~# gpg --recv-keys $key > > gpg: no valid OpenPGP data found. > > gpg: Total number processed: 0 > > > > > > The keys I had problems with are: > > > > 05CD5901 - Aviram Jenik > > 2A6DC9D2 - Amos Shapira > > E098DFA0 - Amos Shapira > > 7E50D7F9 - Gilad Ben Yossef > > E0B10541 - Nethanel Elzas > > 628D2CA1 - Jason Friedman > > > > At least I'm in very good company :-) > > My excuse is that I actually didn't upload my key to those key servers (or any > key server, for that matter). Thanks for the reminder; I have uploaded my key > to both servers now. > Sign away :-) > Signed. BTW, how does GnuPG know how to generate a unique key ID? I thought the server assigned it a key ID out of its key pool. Surely, if any GPG program generates key IDs independetly there will be some collision between two specific keys? Regards, Shlomi Fish > -- > "It was only a one liner. A semi-illiterate chipmunk could've written > it. " -- MBY about his 2.5.73 kernel patch in tpam_queues.c > > - Aviram > -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
[Key Signing] Problems Downloading Some of the Keys
Hi! I recently returned from August Penguin II. It was a great event, and I enjoyed it very much. I also took part in the key signing party. However, when I tried to actually download the keys from a key-server and sign them, I discovered that some of the keys generate the following error: <<< shlomi:~# key=05cd5901 shlomi:~# gpg --recv-keys $key gpg: no valid OpenPGP data found. gpg: Total number processed: 0 >>> My key server is: keyserver x-hkp://pgp.mit.edu But I also tried keyserver.net. The keys I had problems with are: 05CD5901 - Aviram Jenik 2A6DC9D2 - Amos Shapira E098DFA0 - Amos Shapira 7E50D7F9 - Gilad Ben Yossef E0B10541 - Nethanel Elzas 628D2CA1 - Jason Friedman If you are the owner of one of these keys and can instruct me (and others) from which keyserver to download them, I'd appreciate it. Regards, Shlomi Fish -- Shlomi Fish[EMAIL PROTECTED] Home Page: http://t2.technion.ac.il/~shlomif/ There's no point in keeping an idea to yourself since there's a 10 to 1 chance that somebody already has it and will share it before you. = To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
