Topic: Recording my PGP key on the forum (Read 198 times)

Can anyone provide me a reliable article or video link to understand the working of PGP keys ? I want it to use for daily email communication

Quoted and verified it for myself.

By the way, figure it out @RGBKey

Alright, I'll try to address those issues:


There's a signed message proving that the owner of the key and the person controlling this forum account at least are the same person. To try to more widely establish my name, I've also hosted my public key at https://rgbkey.github.io/pgp.txt. That site has been used by me for years as a platform for my provable fairness verification tools and is under a github account separate from the forum. Additionally I've changed my personal text to reflect that full key instead of a short, insecure fingerprint (thanks nullius).

As I am just a nym as nullius also mentioned, if requested I could provide proof as the account RGBKey on the sites that I've been known to be on (just-dice, yolodice, primedice, etc.)

Quoted below as requested.  But the important part is to establish a fingerprint which people can check.  The fingerprint I observe is: 0xABE2DC997C2233012A86D8BE66F1B6C95688A943

Archival link changed to https: https://archive.li/ZabYw  ...and .onion, for Tor users: http://archivecaslytosk.onion/ZabYw

Edit:  Archive of this post (and the rest of the thread): https://web.archive.org/web/20180424215333/https://bitcointalk.org/index.php?topic=3323999.msg35510465#msg35510465


I agree with that assessment.  I see that you use Ed25519, which I also currently use for my identity key.

(Aside:  I am disappointed that the current draft in the process to revise RFC 4880 does not specify anything stronger, such as Ed448-Goldilocks.  I should probably do something about that.  It does prospectively specify Ed25519/Curve25519 as OpenPGP standard.)


This is always problematic for someone who exists as a nym.  How would you propose binding 0xABE2DC997C2233012A86D8BE66F1B6C95688A943 to “RGBKey” and the given e-mail address?  It’s not as if you would be flashing state-issued ID documents at me.  I think that some level of TOFU is necessary in these situations.  For my part, I have simply tried to spread my PGP fingerprint anywhere I can (forum post sigs, sigs in mailing list archives, etc., etc.).

As it stands, all I know is that somebody with sufficient Bitcointalk.org access to create a forum post as #182468 claims that key unidirectionally.  This could hypothetically include forum admins, blackhats, Cloudflare, the NSA...  There is no cryptographic binding of identity, and there can’t be, insofar as you may have no other cryptographic anchor to which to bind.  If you have a long-established, widely-published Bitcoin address, an X.509 certificate (LOL, CAs), or some other form of public-key crypto more or less strongly linked to “RGBKey”, that could be helpful.


The (weak) binding of forum uid #182468 → PGP key is unidirectional; I see no statement signed by the key, claiming uid #182468 “RGBKey”.  This is typically resolved with a clearsigned statement acknowledging the identity.  But if the Bitcoin Forum is especially important to your identity, you may want to instead add a PGP userid to your key specifying your forum identity.  All userids must be certified by your (C) key to be valid.  I added that to my key last month; please have a look:

RGBKey

Edit: I've uploaded a text file to my github pages website which hosts all my verifiers. It can be found here https://rgbkey.github.io/pgp.txt

Who do you say you are?

Here is the archive link: http://archive.li/ZabYw

Hey folks,

I've been a longstanding advocate of encryption, but I've come to realize that I don't really have an established PGP key to use for communications here. I've just created a new one (I created one ~4 years ago and have since lost it) and I'm going to publish it here and record it. I would greatly appreciate it if a few (please don't go too overboard) people would quote this post to establish it. I will also use archive.is to record this post and post it in a follow-up reply.

Here is my key:

It is an ECC key, which I believe is currently the best (or at least better than standard) key type to use.

I've also published it to MIT's keyserver.

If any established forum members would like to attempt to verify that I am who I say I am and sign my key, I would appreciate it.

If I've missed anything here, please let me know.