Tails signing key verification

Question

When I use the following command:

gpg --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F

Instead of getting this:

sig!         0x1202821CBE2CD9C1 2015-01-19  Tails developers (signing key) <tails@boum.org>

..I get this:

pub   4096R/58ACD84F 2015-01-18 [expires: 2017-01-11]
uid       [ unknown] Tails developers (offline long-term identity key) <tails@boum.org>
sig!3        58ACD84F 2015-01-18  Tails developers (offline long-term identity key) <tails@boum.org>
sig!3        58ACD84F 2015-09-27  Tails developers (offline long-term identity key) <tails@boum.org>
uid       [ unknown] Tails developers <tails@boum.org>
sig!3        58ACD84F 2015-09-27  Tails developers (offline long-term identity key) <tails@boum.org>
sub   4096R/752A3DB6 2015-01-18 [expires: 2017-01-11]
sig!         58ACD84F 2015-09-27  Tails developers (offline long-term identity key) <tails@boum.org>
sub   4096R/2F699C56 2015-01-18 [expires: 2017-01-11]
sig!         58ACD84F 2015-09-27  Tails developers (offline long-term identity key) <tails@boum.org>

134 signatures not checked due to missing keys

I do not see 1202821CBE2CD9C1 anywhere here, and the expiration date of 2017-01-11 doesn't seem right. I presume I am doing something wrong.

Thanks.

Answer 1

You're not doing anything wrong. But here is an explanation of your output and a way to get some level of further verification by showing that the old key has actually signed the key you downloaded.

The command you typed in gpg --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F checks the tails signing key's signatures and it prints the signatures that were made by keys you have downloaded and are in your gpg public keyring. Therefore keys that are not in your public keyring will not appear.

The tails website says the following,

The new signing key is itself signed by the old signing key. So you can transitively trust this new key if you had trusted the old signing key.

0x1202821CBE2CD9C1 2015-01-19 Tails developers (signing key) This is the old tails signing key that expired in April. This output shows that it signed the current signing key on the date 2015-01-19.

To print all the signatures use the command

gpg --keyid-format long --list-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F

I added --keyid-format long to give the longer key ids shown on the tails website.

There will be a lot of output because list-sigs will include the 134 signatures not checked due to missing keys. The keys that are not in your public keyring will have a message like [User ID not found] so the old tails key which will be close to the top of the list will look (to you) like

1202821CBE2CD9C1 2015-01-19 [User ID not found]

Seeing this output will show you that the old key was used to sign the key you downloaded.

Checking to see if the old key has signed the new key is primarily intended for those of us who downloaded the old key when it was still in use i.e. people that have used tails since version 1.3 and before and even more beneficial to the people who actually signed the old key, because as it said on the website these people can transitively trust this new key.

The old key is still available from key servers but you cannot better verify the new key if you download the old key in this way because you got the key id of the old key from the new key.

---

The expiration date of 2017-01-11 is fine. as long as gpg keys have not expired (when their date in the past), you don't need to worry about them too much. It is different from the expiration date of the old key because it is a different key. As I stated above, the old key expired in April that is why it was replaced.