web/keys.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
   3     <head>
   4         <meta http-equiv="content-type" content="text/xhtml+xml; charset=utf-8"
   5         />
   6         <title>ftp-master.debian.org Archive Signing Keys</title>
   7         <link type="text/css" rel="stylesheet" href="removals-style.css" />
   8         <link rel="shortcut icon" href="http://www.debian.org/favicon.ico" />
   9     </head>
  10     <body>
  11         <div id="logo">
  12             <a href="http://www.debian.org/">
  13                 <img src="http://www.debian.org/logos/openlogo-nd-50.png"
  14                 alt="debian logo" /></a>
  15             <a href="http://www.debian.org/">
  16                 <img src="http://www.debian.org/Pics/debian.png"
  17                 alt="Debian Project" /></a>
  18         </div>
  19
  20         <div id="titleblock">
  21             <img src="http://www.debian.org/Pics/red-upperleft.png"
  22             id="red-upperleft" alt="corner image"/>
  23             <img src="http://www.debian.org/Pics/red-lowerleft.png"
  24             id="red-lowerleft" alt="corner image"/>
  25             <img src="http://www.debian.org/Pics/red-upperright.png"
  26             id="red-upperright" alt="corner image"/>
  27             <img src="http://www.debian.org/Pics/red-lowerright.png"
  28             id="red-lowerright" alt="corner image"/>
  29             <span class="title">
  30                 Archive Signing Keys
  31             </span>
  32         </div>
  33         <div id="outer">
  34         <div id="inner">
  35         <div id="leftcol">
  36                 <ul>
  37                         <li><a href="/index.html">Main FTP Page</a></li>
  38                 </ul>
  39         </div>
  40
  41         <div id="maincol">
  42         <div id="intro">
  43             <p>This page contains information on the current and past archive
  44             signing keys.  The release files are signed by an automatic archive
  45             signing key in order to allow verification that software being downloaded
  46             has not been interfered with.</p>
  47
  48             <p>Please note that as this page is not available by a secure
  49             mechanism (for instance https), you cannot rely on keys or information
  50             available here for verification purposes.  The details here are
  51             for information only.</p>
  52
  53             <h2>Which release should be signed with which key?</h2>
  54             <p>Stable releases are signed by both the ftp-master automatic archive signing
  55             key in use at the time of the release, and a per-release stable key.  Release
  56             files for other releases (proposed-updates, testing, testing-proposed-updates,
  57             unstable and experimental) are signed only by the ftp-master automatic key.</p>
  58
  59             <p>The security archive is signed by the normal ftp-master key only.</p>
  60
  61             <p>The current procedure is that there is one ftp-master key per
  62             release (former procedure introduced a new key once per year).</p>
  63
  64         </div>
  65
  66         <div id="archivekey">
  67             <h1>Archive Keys</h1>
  68             <h2>Active Signing Keys</h2>
  69
  70             <p>The current (2007/etch) key can be <a
  71             href="/keys/archive-key-4.0.asc">downloaded here</a></p>
  72
  73             <h2>Upcoming Signing Keys</h2>
  74             <p> The new key, which will be used after the 4.0 key expires <b>or</b>
  75             after Lenny r1 is released, can be <a
  76             href="/keys/archive-key-5.0.asc">downloaded here</a>.  (The debian-devel announcement
  77             regarding this key can be read at
  78             <a href="http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html">
  79             http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html</a>)</p>
  80
  81             <h2>Stable Keys</h2>
  82             <h3>etch</h3>
  83             <p>The fingerprint of the etch stable release key is <tt>7EA3 91D7 2477 203B 58C0  4FBC B5D0 C804 ADB1 1277</tt></p>
  84
  85             <h3>lenny</h3>
  86             <p>The fingerprint of the lenny stable release key is <tt>7F5A 4445 4C72 4A65 CBCD  4FB1 4D27 0D06 F425 84E6</tt></p>
  87
  88             <h2>Retired Signing Keys</h2>
  89             <p>The following retired and in most cases expired keys are
  90             available.  <b>Note that these keys are no longer in use and are
  91             listed here for reference purposes only</b>:
  92                 <ul>
  93                 <li><a href="/keys/ziyi_key_2002.asc">/keys/ziyi_key_2002.asc</a></li>
  94                 <li><a href="/keys/ziyi_key_2003.asc">/keys/ziyi_key_2003.asc</a></li>
  95                 <li><a href="/keys/ziyi_key_2003v2.asc">/keys/ziyi_key_2003v2.asc</a></li>
  96                 <li><a href="/keys/ziyi_key_2004.asc">/keys/ziyi_key_2004.asc</a></li>
  97                 <li><a href="/keys/ziyi_key_2005.asc">/keys/ziyi_key_2005.asc</a></li>
  98                 <li><a href="/keys/ziyi_key_2006.asc">/keys/ziyi_key_2006.asc</a></li>
  99                 </ul>
 100
 101             </p>
 102         </div>
 103
 104         <div id="replacement">
 105             <h1>Key Replacement Procedure</h1>
 106
 107             <p>When the archive key is to be replaced, a new key will be generated by one of the
 108             ftpmasters.  This key will then be signed by that ftpmaster and other ftpmasters and
 109             members of the ftpteam (including verification by phone call of the fingerprint and
 110             other details of the key to be signed).</p>
 111
 112             <p>Once the new key is prepared, it will be placed on this page, put into the relevant
 113             archive packages and announced to debian-devel-announce well in advance of being used.</p>
 114
 115         </div>
 116
 117         <div id="revokation">
 118             <h1>Key Revocation Procedure</h1>
 119             <p>A revokation certificate for the archive key is produced at the time of the creation
 120             of an archive key.  The program gfshare (package
 121                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
 122                     (a Shamir's secret sharing scheme implementation) is then used to produce 12 shares of
 123                     which 7 are needed to recover the revokation cert.
 124             This procedure is for use in emergencies only (such as losing ftp-master.debian.org and
 125             all of the backups, a hopefully unlikely event) as the key can normally be used to produce
 126             its own revokation certificate.</p>
 127         </div>
 128
 129                 <div id="keysplit">
 130                   <h1>Key Backup / Restore Procedure</h1>
 131                   <p>After the creation of the archive key, the secret part of it will be backed up in one additional
 132                   way. The program  gfshare (package
 133                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
 134                   (a Shamir's secret sharing scheme implementation) is used to produce 14 shares of which 9 are needed
 135                   to recover the secret key.</p>
 136         </div>
 137
 138                 <div id="ssss">
 139                   <h1>SSSS holders</h1>
 140                   <p>The following people each hold one of the shares of the revocation certificate / private key.</p>
 141                   <h2>Revocation shares</h2>
 142                   <p>7 of those shares are needed to reproduce the revocation certificate</p>
 143                   <table>
 144                         <tr><th>Debian uid</th><th>Name</th></tr>
 145                         <tr><td>sho</td><td>Samuel Hocevar</td></tr>
 146                         <tr><td>don</td><td>Don Armstrong</td></tr>
 147                         <tr><td>neilm</td><td>Neil McGovern</td></tr>
 148                         <tr><td>djpig</td><td>Frank Lichtenheld</td></tr>
 149                         <tr><td>jimmy</td><td>Jimmy Kaplowitz</td></tr>
 150                         <tr><td>killer</td><td>Kalle Kivimaa</td></tr>
 151                         <tr><td>noodles</td><td>Jonathan McDowell</td></tr>
 152                         <tr><td>rra</td><td>Russ Allbery</td></tr>
 153                         <tr><td>marga</td><td>Margarita Manterola</td></tr>
 154                         <tr><td>thijs</td><td>Thijs Kinkhorst</td></tr>
 155                         <tr><td>meike</td><td>Meike Reichle</td></tr>
 156                         <tr><td>miriam</td><td>Miriam Ruiz</td></tr>
 157                   </table>
 158
 159                   <h2>Key shares</h2>
 160                   <p>9 of those shares are needed to reproduce the secret key</p>
 161                   <table>
 162                         <tr><th>Debian uid</th><th>Name</th></tr>
 163                         <tr><td>luk</td><td>Luk Claes</td></tr>
 164                         <tr><td>maxx</td><td>Martin Wuertele</td></tr>
 165                         <tr><td>adeodato</td><td>Adeodato Simó</td></tr>
 166                         <tr><td>myon</td><td>Christoph Berg</td></tr>
 167                         <tr><td>93sam</td><td>Steve McIntyre</td></tr>
 168                         <tr><td>bdale</td><td>Bdale Garbee</td></tr>
 169                         <tr><td>sgran</td><td>Stephen Gran</td></tr>
 170                         <tr><td>dannf</td><td>Dann Frazier</td></tr>
 171                         <tr><td>weasel</td><td>Peter Palfrader</td></tr>
 172                         <tr><td>enrico</td><td>Enrico Zini</td></tr>
 173                         <tr><td>wouter</td><td>Wouter Verhelst</td></tr>
 174                         <tr><td>mhy</td><td>Mark Hymers</td></tr>
 175                         <tr><td>bzed</td><td>Bernd Zeimetz</td></tr>
 176                         <tr><td>stew</td><td>Mike O'Connor</td></tr>
 177                 </table>
 178                 </div>
 179     <hr />
 180     <address><a href="mailto:ftpmaster@ftp-master.debian.org">Debian FTP team</a></address>
 181
 182     </body>
 183 </html>