PGP/GPG Key Signing Policy 2013-11-07

Introduction

This policy is valid from 2013-11-07 for all signatures made by the following PGP/GPG key:

sec   4096R/D7079C77 2011-09-28
uid                  Ian A. Young <ian@iay.org.uk>
uid                  [jpeg image of size 6036]
ssb   2048R/AEDCA1C7 2011-09-28

You can download a copy of this key here, or from one of the key servers.

This policy may be replaced at any time with a new version. If a new version incorporates changes that might affect the strength or perceived strength of the resulting signature, the old version will be linked from the new one. The current policy can always be found at https://iay.org.uk/identity/pgp/policy/.

Prerequisites for Signing

Identity Verification

The key owner who wishes to obtain a signature to their key from me must prove their identity to me by way of a passport, national ID card, a driver’s licence, or a similar token. The token must feature a photographic picture of the key owner. This also implies that the key must feature the key owner’s real name.

For people from outside the European Union, only a combination of at least two of the above tokens will be accepted. Exceptions will be made when the key owner can come up with other means of proof of identity. But at least one of the above tokens will stay the minimum requirement.

Hardcopy of Fingerprint

The key owner should have prepared a printout of the output of gpg --fingerprint for the key, or the equivalent command from another OpenPGP client. A web-based tool for creating “key slips” can be found here.

A hand-written sheet featuring the key ID, the fingerprint and all user IDs the key owner wishes to obtain a signature to will also be accepted.

If the key owner wishes to obtain a signature to a photographic user ID, the printout should contain the image of that photographic user ID. A printout or photocopy of a photo clearly showing the same person as in the photographic user ID will also be accepted.

You can download a copy of my own fingerprint printout page here as an example.

Miscellaneous

The above must take place under reasonable circumstances, i.e. at a calm place, both parties not being in a hurry, etc.

The key owner should make their public key available on a publicly accessible key server, such as pgp.re.

The key owner should be willing to cross-sign with me.

The Act of Signing

Fingerprint Verification

At home I will verify the key’s fingerprint using the hardcopy of the fingerprint that has been given to me.

Email Verification

After successful fingerprint verification, I will sign all user IDs which I was asked to sign. Each signature is then individually sent to the email address listed in the corresponding user ID, encrypted to the associated key.

As only the key owner can decrypt and thus publish the signatures, this procedure ensures that the email addresses listed in each user ID with a published signature belongs to the key owner.

Signature Certification Levels

Level 3

Certification level 3 is used for user IDs that passed identity, fingerprint and email verification and photographic user IDs that passed identity and fingerprint verification as described above.

Level 2

Certification level 2 is used for user IDs that passed identity and fingerprint verification as described above.

Certification level 2 is also used for user IDs of keys belonging to organizations such as Certification Authorities that passed fingerprint verification by providing the fingerprint in an official publication in printed form.

Level 1

Certification level 1 is never used, keys are never signed without appropriate verification.

Acknowledgements

This policy is heavily based on Elmar Hoffman’s key signing policy.

I use the caff script from the signing-party package to operate the procedure described above.

Revisions

• 2014-05-14: minor change: added “passport” to the list of identity tokens accepted.
• 2014-05-16: minor change: added a link to a nice slip-printing tool.
• 2021-07-05: minor change: altered the key server referenced for copies of my key, now that sks-keyservers.net has ceased operation.