Re: PGP keysigning at LPC/OSSE 2026

["Uwe Kleine-König" <u.kleine-koenig@baylibre.com>]

[-- Attachment #1: Type: text/plain, Size: 2480 bytes --]

Hello,

On Sun, Sep 27, 2026 at 02:33:22PM +0200, Uwe Kleine-König wrote:
> Hello,
> 
> now that the registration deadline is over here comes the list
> containing the registered participants in the attachment. In case of
> transfer issues (e.g. MTAs reencoding the text file), the list is also
> available at
> 
> 	https://openpgpkey.baylibre.com/Fei9keem/keysigning-lpcosse26.txt
> 
> .
> 
> In reply to Krzysztof's concern about how trustworthy a statement
> "yesyes, the fingerprint of my certificate on the list that this
> suspicious guy created is correct" I dropped the two middle nibbles from
> each fingerprint. So you can support your statement about your
> fingerprint by providing these two.
> 
> Please print out the list, fill in the hash sums (which we will verify
> when we meet), verify your fingerprint and memorize (or write down) the
> missing nibbles (if you're on the list) and bring the list to the
> meetings together with a pen and a proof of identity (as most people
> will probably want to see such a document before certifying your UIDs).
> If your hand writing is poor, I recommend filling in the hash sum before
> printing. Note that the start of the SHA256 hash sum is already
> prefilled, that prefill has to be kept as is when generating the hashes.

There is more than one report about confusion with the hash summing. One
issue is that if you download the keysigning list directly from lore or
via your mail provider's web interface the line endings might be changed
from \n to \r\n. So if you calculate

	SHA256: E0C7BC1A 4A4B2489 ...
	RIPEMD160: B6C3 5C63 7907 ...

retry after

	perl -p -i -e 's/\x0d\x0a/\x0a/' keysigning-lpcosse26.txt

or use the above link.

To minimize suprises in Prague: The correct hashsums are:

	SHA256 Checksum: 4E4F BA5D   C653 A423   48CE 7588   5D22 4780
			 9CA9 3DD5   0D10 D430   8FDB C4A6   F5E4 49FA              [ ]

	RIPEMD160 Checksum: ACC8 72E9 4760 E0A1 A459    D9E9 67B5 AD24 B853 DA82    [ ]

And as people also wondered how I managed to get the start of the SHA256
hash sum into the file: That's brute force iterating through the
possible prefixes, putting them into the file and check if the hash then
starts with the selected prefix by chance. It took ~1 minute to find
"4E4F BA" on my laptop. See
https://manpages.debian.org/trixie/signing-party/gpgparticipants-prefill.1.en.html
for the tool I'm using for that.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]