GNU PRIVACY GUARD

Justin B Rye 29-May-04

Non-Geek Escape Route

I expect the majority of visitors to this site won't be familiar with the idea of GPG keys (hence its hiding place down in this subdirectory), but I'm not so sure which kind of ignorance is likeliest -

Public key?  What's a public key?

Half of a two-part personal cryptographic cipher doodad.  It's all a bit esoteric, unfortunately, but the basic idea is that I keep one of my keys secure and hand the other out freely; they're cunningly organised so that data can be encrypted with one and decrypted with the other, which is handy for things like secure messages.

Coded messages?  What, you mean you're a terrorist?

And presumably you send all your loveletters as postcards, and let your landlord tape your phone calls?  But in fact public key cryptography isn't used for making messages unreadable as often as it's used to prove them authentic.  I can use my private GPG key to generate a "signature" attachment for a given e-mail message, proving its origin and integrity to anyone who's got a copy of my public key.

GPG?  Don't you mean PGP?

No, "GNU Privacy Guard" - the free-software version, designed for maximum compatibility with "Pretty Good Privacy" but without depending on commercially patented algorithms.  PGP's fine from a technical standpoint, but the intellectual property issues make it unsafe as a basis for an open internet standard.

The weak link in this system is: how do you know that I (writing this page and sending those e-mails) am the same person as the real life Justin B Rye?  For some purposes it doesn't matter - Esperantists don't want to know my National Insurance number, they only want to be sure they're arguing with the author of the JBR website - but when it does matter, it's fortunate that I know other people with GPG/PGP keys who can vouch for my identity, as certified by an exchange of signatures on our keyrings.

However, I haven't yet got myself tied in very well to the Web of Trust (I'm not sure I'd even recognise Kevin Bacon), so I'd be glad to exchange key-signatures with anyone I meet who can provide good identification.  If you've still got that printout of my key from last night in the pub but can't remember whose it was, this page may help, but don't countersign and upload it unless you're happy to certify that it came from the real Justin B Rye.

My 1024-bit DSA public key has the following key-ID:

E9B6E4B8

... and its fingerprint is as follows:

00C8 1C33 6F21 2FCF CBDF 
E766 3F0B 176D E9B6 E4B8

It currently carries only one user-ID, with the same address as is given on my mailto page (sorry about this awkward indirection, but it seems to help).  The full public key is hyperlinked in here in ASCII-text and raw-binary forms, or you can paste the following:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBD2hrqcRBAC2fLgm7lCSJgRlfzO9+Z3+FsuaZt3WiAD9XRcHZWo4JYbZOJXr
Po9PoQcpoA0wOb8Alk96+eE9gupaXASMqJn63GzbxQE+KGqotmB2PnFyhkacYMV9
A0RuPS5iBrjXBpXwht1CSsAUPic+PDAOXyNI5PopDV1aMihPR142moNR+wCg94fu
bYFQAnn1L0bFe1AWNtmBVckEAKxUMWpJCRPr3UvJCg4eSmYyGlIUb7raud1eb7w2
GE3dzX7zFf/oxqIUzNDwX0WiNQQQHP+RRq+E0iJofWnbz7TUQXAq5SDBO6eUpdg/
hEtCekKqZbxEyJjRggHDfo/Q1r5pq8zl+EAj08h3MGGuVmxH1jDadLD6xF1CHHWk
fokAA/0Q8PEMvD54HIBUPHZP1Mwviu9+qY8h3s2QC9vUaY/8zTrOfMzATcs6+Geu
ZVkH2rvqEYbC07Hv3RWilVSQEzXXI6SmQShrQaZ1teN0y6hcIll28NuCes6LTkpC
ooWWGiLG+gD/BtSjncq4easeeBQVeSr6LIWRPG1JRM8rSn1YJ7QmSnVzdGluIEIg
UnllIDxqYnJAeGliYWxiYS5kZW1vbi5jby51az6IVwQTEQIAFwUCPaGupwULBwoD
BAMVAwIDFgIBAheAAAoJED8LF23ptuS4cvwAnj7Y5L3odzKV/1pqy7T9ONrILZCS
AJ98nfTea3LD/ACINDd8ACoBd4YE1bkBDQQ9oa62EAQA1zCK+1HsDzximVsOtkak
h/Ev1stFYWkRaTkwT8WYR7t/JDszBlZFaMi/u217y5hkwHN+FZ18tMCF9McnpwYG
1i+mbuOt+YlTMRVzW3OHLNmVuzzGE53xBlEJ15m2qxwC9ON8czEl0q3gTPRmCVkF
JdvlNChRcJ24E2NPFIVXtV8AAwUEAKnvZkGXGHMUEm1wPvk1u7+F1C/XuzibK4gZ
W86k7vyuF8V0dafFRsDXfcLWTDfBI3483QSqyNtQ09XUOju75IKLaAVEJo2TqRjx
E+vI5d0j6R2xxce1DONkzo0Y34h+JY14WGQe6wigVZ7uy1PiE/heLaRMnbWPVudk
ZuHhgeQjiEYEGBECAAYFAj2hrrYACgkQPwsXbem25Lj/RgCgyNCJfu3JnTP9JTXQ
LaYUTOyBBzAAoNPyDmkPVDYUkPhVIeTNl2SNVbC/
=SQ7w
-----END PGP PUBLIC KEY BLOCK-----

Then again of course you can also fetch it from a keyserver, just in case this site has been hacked and they haven't.