OpenPGP key transition to 6CD1AFCE

Monday, 30 Nov 2009 16:22:43 +0100

For a number of reasons, I’ve recently set up a new OpenPGP key, and
will be transitioning away from my old one.

The old key will continue to be valid for some time, but i prefer all
future correspondence to come to the new one. I would also like this
new key to be re-integrated into the web of trust. This message is
signed by both keys to certify the transition.

the old key was:

pub 1024D/88438F59 2001-09-06
Key fingerprint = 686E A9ED 7924 D8AE 9C0F A437 1FF8 4BD0 8843 8F59

And the new key is:

pub 2048R/6CD1AFCE 2009-11-30
Key fingerprint = 7D2B 1953 0509 DF80 B580 995E F4B6 EA16 6CD1 AFCE

To fetch the full key, you can get it with:

wget -q -O- http://www.kuppe.org/Markus-Alexander-Kuppe-0x6CD1AFCE-pub.asc | gpg –import -

Or, to fetch my new key from a public key server, you can simply do:

gpg –keyserver pgp.mit.edu –recv-key 6CD1AFCE

If you already know my old key, you can now verify that the new key is
signed by the old one:

gpg –check-sigs 6CD1AFCE

If you don’t already know my old key, or you just want to be double
extra paranoid, you can check the fingerprint against the one above:

gpg –fingerprint 6CD1AFCE

If you are satisfied that you’ve got the right key, and the UIDs match
what you expect, I’d appreciate it if you would sign my key:

gpg –sign-key 6CD1AFCE

Lastly, if you could upload these signatures, i would appreciate it.
You can either send me an e-mail with the new signatures (if you have
a functional MTA on your system):

gpg –armor –export 6CD1AFCE | mail -s ‘OpenPGP Signatures’ markus@kuppe.org

Or you can just upload the signatures to a public keyserver directly:

gpg –keyserver pgp.mit.edu –send-key 6CD1AFCE

Please let me know if there is any trouble, and sorry for the
inconvenience.

Regards,
Markus Alexander Kuppe

Signed version of this file can be found at http://www.kuppe.org/KeyTransitionTo6CD1AFCE.txt

3 Responses to OpenPGP key transition to 6CD1AFCE »»


comments

  1. Comment by Markus Alexander Kuppe | 2009/11/30 at 18:39:16
  2. Comment by hugo | 2009/12/01 at 01:19:32

    Das der Fingerprint über den unsicheren Kanal wertlos ist, ist dir aber schon klar?

  3. Comment by Markus Alexander Kuppe | 2009/12/01 at 13:05:07

    Stimmt, der Fingerprint (FP) innerhalb des Dokuments ist redundant und insbesondere nicht zur Echtheitsprüfung des neuen Schlüssels zu verwenden. Es sei denn, der FP ist über einen sicheren Kanal mit mir abgeglichen/verifiziert worden.


leave a reply »»