[tor-talk] Tor Browser Developers (signing key) key signing request (Was "Re: Problems? Verifying signatures in Tor 4.0.4")

[Richard Johnson <rdump@xxxxxxxxx>]

On 2015-02-26 06:02, andre76@xxxxxxxxxxx wrote:
> Is there anything that's wrong about the gpg verification performed on
> the version 4.0.4 as seen in the text below?
> It's quite different from previous Tor versions. No Erinn Clark.

We do have a chain from other Tor project personnel through Erinn Clark's key 
to a Tor Browser Developers (signing key) [1].  If you have physically 
verified their keys or Erinn's directly (or at least done a TOFU-like --lsign) 
in the past, you have a chain to the current Tor Browser Developers (signing key).

I think it would be great if the chain could be shortened.  Would more Tor 
project personnel be willing to confirm the Tor Browser Developers (signing 
key), and sign it directly?

Call it belt and suspenders with the web of trust alongside the published key 
info on the Tor site.


Richard

-------
[1]

$ gpg --list-sigs 0x93298290
pub   4096R/93298290 2014-12-15
uid                  Tor Browser Developers (signing key) 
<torbrowser@xxxxxxxxxxxxxx>
sig          63FEE659 2015-01-13  Erinn Clark <erinn@xxxxxxxxxxxxxx>
sig          4B7C3223 2014-12-15  Georg Koppen <gk@xxxxxxxxxxxxxx>
sig 3        93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser@xxxxxxxxxxxxxx>
sub   4096R/F65C2036 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser@xxxxxxxxxxxxxx>
sub   4096R/D40814E0 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser@xxxxxxxxxxxxxx>
sub   4096R/589839A3 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser@xxxxxxxxxxxxxx>


$ gpg --list-sigs 0x63fee659
pub   2048R/63FEE659 2003-10-16
uid                  Erinn Clark <erinn@xxxxxxxxxxxxxx>
sig          31B0974B 2010-02-15  Andrew Lewman <andrew@xxxxxxxxx>
sig 3        94C09C7F 2010-08-25  Peter Palfrader
...
sig 3        63FEE659 2010-01-16  Erinn Clark <erinn@xxxxxxxxxxxxxx>
sig          E012B42D 2010-07-19  Jacob Appelbaum <jacob@xxxxxxxxxxxxx>
sig          23291265 2010-07-19  Linus Nordberg <linus@xxxxxxxxxxx>
sig          D21739E9 2010-03-22  Daniel Kahn Gillmor <dkg@xxxxxxxxxxxxxxxxx>
...
sig          A71A6915 2011-08-05  George Kadianakis <desnacked@xxxxxxxxxx>
sig          28988BF5 2011-11-11  Roger Dingledine <arma@xxxxxxx>
sig          19F78451 2012-12-02  Roger Dingledine <arma@xxxxxxx>
sig          C11F6276 2013-03-19  David Fifield <david@xxxxxxxxxxxxxxx>
...

--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk