web/keys.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
   3     <head>
   4         <meta http-equiv="content-type" content="text/xhtml+xml; charset=utf-8"
   5         />
   6         <title>ftp-master.debian.org Archive Signing Keys</title>
   7         <link type="text/css" rel="stylesheet" href="removals-style.css" />
   8         <link rel="shortcut icon" href="http://www.debian.org/favicon.ico" />
   9     </head>
  10     <body>
  11         <div id="logo">
  12             <a href="http://www.debian.org/">
  13                 <img src="http://www.debian.org/logos/openlogo-nd-50.png"
  14                 alt="debian logo" /></a>
  15             <a href="http://www.debian.org/">
  16                 <img src="http://www.debian.org/Pics/debian.png"
  17                 alt="Debian Project" /></a>
  18         </div>
  19
  20         <div id="titleblock">
  21             <img src="http://www.debian.org/Pics/red-upperleft.png"
  22             id="red-upperleft" alt="corner image"/>
  23             <img src="http://www.debian.org/Pics/red-lowerleft.png"
  24             id="red-lowerleft" alt="corner image"/>
  25             <img src="http://www.debian.org/Pics/red-upperright.png"
  26             id="red-upperright" alt="corner image"/>
  27             <img src="http://www.debian.org/Pics/red-lowerright.png"
  28             id="red-lowerright" alt="corner image"/>
  29             <span class="title">
  30                 Archive Signing Keys
  31             </span>
  32         </div>
  33         <div id="outer">
  34         <div id="inner">
  35         <div id="leftcol">
  36                 <ul>
  37                         <li><a href="/index.html">Main FTP Page</a></li>
  38                 </ul>
  39         </div>
  40
  41         <div id="maincol">
  42         <div id="intro">
  43             <p>This page contains information on the current and past archive
  44             signing keys.  The release files are signed by an automatic archive
  45             signing key in order to allow verification that software being downloaded
  46             has not been interfered with.</p>
  47
  48             <p>Please note that as this page is not available by a secure
  49             mechanism (for instance https), you cannot rely on keys or information
  50             available here for verification purposes.  The details here are
  51             for information only.</p>
  52
  53             <h2>Which release should be signed with which key?</h2>
  54             <p>Stable releases are signed by both the ftp-master automatic archive signing
  55             key in use at the time of the release, and a per-release stable key.  Release
  56             files for other releases (proposed-updates, testing, testing-proposed-updates,
  57             unstable and experimental) are signed only by the ftp-master automatic key.</p>
  58
  59             <p>The security archive is signed by the normal ftp-master key only.</p>
  60
  61             <p>The current procedure is that there is one ftp-master key per
  62             release (former procedure introduced a new key once per year).</p>
  63
  64         </div>
  65
  66         <div id="archivekey">
  67             <h1>Archive Keys</h1>
  68             <h2>Active Signing Keys</h2>
  69
  70                   <p>The current (2009/lenny) key can be <a
  71             href="/keys/archive-key-5.0.asc">downloaded here</a><br/>
  72                   The fingerprint of this key is <tt>150C 8614 919D 8446 E01E  83AF 9AA3 8DCD 55BE 302B</tt>.<br/>
  73                   The announcements regarding this key can be read at
  74             <a href="http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html">
  75                   http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html
  76                   </a> and <a href="http://www.debian.org/News/2009/20090523">http://www.debian.org/News/2009/20090523</a>.
  77                   </p>
  78
  79                   <p>The soon-to-be-retired (2007/etch) key can be <a
  80             href="/keys/archive-key-4.0.asc">downloaded here</a>.<br/>
  81                   The fingerprint of this key is <tt>A999 51DA F9BB 569B DB50  AD90 A70D AF53 6070 D3A1</tt></p>
  82
  83             <h2>Stable Keys</h2>
  84             <h3>etch</h3>
  85             <p>The fingerprint of the etch stable release key is <tt>7EA3 91D7 2477 203B 58C0  4FBC B5D0 C804 ADB1 1277</tt></p>
  86
  87             <h3>lenny</h3>
  88             <p>The fingerprint of the lenny stable release key is <tt>7F5A 4445 4C72 4A65 CBCD  4FB1 4D27 0D06 F425 84E6</tt></p>
  89
  90             <h2>Retired Signing Keys</h2>
  91             <p>The following retired and in most cases expired keys are
  92             available.  <b>Note that these keys are no longer in use and are
  93             listed here for reference purposes only</b>:
  94                 <ul>
  95                 <li><a href="/keys/ziyi_key_2002.asc">/keys/ziyi_key_2002.asc</a></li>
  96                 <li><a href="/keys/ziyi_key_2003.asc">/keys/ziyi_key_2003.asc</a></li>
  97                 <li><a href="/keys/ziyi_key_2003v2.asc">/keys/ziyi_key_2003v2.asc</a></li>
  98                 <li><a href="/keys/ziyi_key_2004.asc">/keys/ziyi_key_2004.asc</a></li>
  99                 <li><a href="/keys/ziyi_key_2005.asc">/keys/ziyi_key_2005.asc</a></li>
 100                 <li><a href="/keys/ziyi_key_2006.asc">/keys/ziyi_key_2006.asc</a></li>
 101                 </ul>
 102
 103             </p>
 104         </div>
 105
 106         <div id="replacement">
 107             <h1>Key Replacement Procedure</h1>
 108
 109             <p>When the archive key is to be replaced, a new key will be generated by one of the
 110             ftpmasters.  This key will then be signed by that ftpmaster and other ftpmasters and
 111             members of the ftpteam (including verification by phone call of the fingerprint and
 112             other details of the key to be signed).</p>
 113
 114             <p>Once the new key is prepared, it will be placed on this page, put into the relevant
 115             archive packages and announced to debian-devel-announce well in advance of being used.</p>
 116
 117         </div>
 118
 119         <div id="revokation">
 120             <h1>Key Revocation Procedure</h1>
 121             <p>A revokation certificate for the archive key is produced at the time of the creation
 122             of an archive key.  The program gfshare (package
 123                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
 124                     (a Shamir's secret sharing scheme implementation) is then used to produce 12 shares of
 125                     which 7 are needed to recover the revokation cert.
 126             This procedure is for use in emergencies only (such as losing ftp-master.debian.org and
 127             all of the backups, a hopefully unlikely event) as the key can normally be used to produce
 128             its own revokation certificate.</p>
 129         </div>
 130
 131                 <div id="keysplit">
 132                   <h1>Key Backup / Restore Procedure</h1>
 133                   <p>After the creation of the archive key, the secret part of it will be backed up in one additional
 134                   way. The program  gfshare (package
 135                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
 136                   (a Shamir's secret sharing scheme implementation) is used to produce 14 shares of which 9 are needed
 137                   to recover the secret key.</p>
 138         </div>
 139
 140                 <div id="ssss">
 141                   <h1>SSSS holders</h1>
 142                   <p>The following people each hold one of the shares of the revocation certificate / private key.</p>
 143                   <h2>Revocation shares</h2>
 144                   <p>7 of those shares are needed to reproduce the revocation certificate</p>
 145                   <table>
 146                         <tr><th>Debian uid</th><th>Name</th></tr>
 147                         <tr><td>sho</td><td>Samuel Hocevar</td></tr>
 148                         <tr><td>don</td><td>Don Armstrong</td></tr>
 149                         <tr><td>neilm</td><td>Neil McGovern</td></tr>
 150                         <tr><td>djpig</td><td>Frank Lichtenheld</td></tr>
 151                         <tr><td>jimmy</td><td>Jimmy Kaplowitz</td></tr>
 152                         <tr><td>killer</td><td>Kalle Kivimaa</td></tr>
 153                         <tr><td>noodles</td><td>Jonathan McDowell</td></tr>
 154                         <tr><td>rra</td><td>Russ Allbery</td></tr>
 155                         <tr><td>marga</td><td>Margarita Manterola</td></tr>
 156                         <tr><td>thijs</td><td>Thijs Kinkhorst</td></tr>
 157                         <tr><td>meike</td><td>Meike Reichle</td></tr>
 158                         <tr><td>miriam</td><td>Miriam Ruiz</td></tr>
 159                   </table>
 160
 161                   <h2>Key shares</h2>
 162                   <p>9 of those shares are needed to reproduce the secret key</p>
 163                   <table>
 164                         <tr><th>Debian uid</th><th>Name</th></tr>
 165                         <tr><td>luk</td><td>Luk Claes</td></tr>
 166                         <tr><td>maxx</td><td>Martin Wuertele</td></tr>
 167                         <tr><td>adeodato</td><td>Adeodato Simó</td></tr>
 168                         <tr><td>myon</td><td>Christoph Berg</td></tr>
 169                         <tr><td>93sam</td><td>Steve McIntyre</td></tr>
 170                         <tr><td>bdale</td><td>Bdale Garbee</td></tr>
 171                         <tr><td>sgran</td><td>Stephen Gran</td></tr>
 172                         <tr><td>dannf</td><td>Dann Frazier</td></tr>
 173                         <tr><td>weasel</td><td>Peter Palfrader</td></tr>
 174                         <tr><td>enrico</td><td>Enrico Zini</td></tr>
 175                         <tr><td>wouter</td><td>Wouter Verhelst</td></tr>
 176                         <tr><td>mhy</td><td>Mark Hymers</td></tr>
 177                         <tr><td>bzed</td><td>Bernd Zeimetz</td></tr>
 178                         <tr><td>stew</td><td>Mike O'Connor</td></tr>
 179                 </table>
 180                 </div>
 181     <hr />
 182     <address><a href="mailto:ftpmaster@ftp-master.debian.org">Debian FTP team</a></address>
 183
 184     </body>
 185 </html>