<commit_before>%h2 Signing Process

%p

  Various safeguards and checks are put into place to secure the
  signing process.

%h3 Master Signing Key authenticates the current Signing Key

%p

  A master signing key authenticates the current active signing key.
  If the signing key is compromised, it will be revoked and a new one
  will take its place.  The master signing key was generated on a
  computer that has never been and will never be on a network.  To
  compromise the master key an attacker would need to access this
  computer physically at its current undisclosed location.

Master key fingerprint:

%pre

  Blah

%h3

  User key authentication requires control of user's private key and
  email address

%p

  When you register a private key, an encrypted email is sent with an
  authentication link.  To be able to activate the key, someone must:

%ul

  %li Have control of your email address.

  %li Be able to use your private key.

%p

  With reasonable security precautions it is difficult for an attacker
  to gain access to both of these.

%h3 Signing occurs over an 'air gap'

%p

  Signatures are not issued via the web server where you registered
  your key.  After you have authenticated your key with the web
  server, the information is transferred to a signing computer via an
  'air gap'.  It is placed on a USB drive and migrated to the signing
  computer.

%p

  If the web server is compromised, an attacker cannot get to the
  signing computer.

%h3 Signing computer is physically located on-site

%p

  It is not in the cloud.  It is physically controlled by us.

%h3 Keys are validated by a human before signing

%p

  A human performs a sanity check on the key before signing it to
  ensure that it is actually tied to the email account that a user
  registered with.

  For example, somone could create a user id of "User X
  (<EMAIL>) <EMAIL>" to trick
  automatic validation of the UID.

%h3 Signing key is on an OpenPGP smart card

%p

  Once we're on the signing computer, the signing key is contained on
  an OpenPGP smart card that is only inserted and activated for the
  duration of signing.

%p

  If the signing computer is compromised remotely, an attacker won't
  be able to physically insert the smart card and activate it.

%p

  If the signing computer is compromised locally, an attacker still
  requires access to the smart card.

%p

  If the smart card lost or stolen, an attacker only has three<commit_msg>More security stuff<commit_after>%h2 Signing Process

%p

  To effectively act as a certificate authority, two conditions must
  be met.

  %ol
    %li

      Some verification must be performed that the keys we sign are
      authentic and belong to the purported owner.

    %li

      The signing keys must be secured so that unauthorized signatures
      are not issued.

%p

  Authentication is a hard problem.  Our first goal is to provide a
  medium grade base-level of authentication for users who cannot
  perform full authentication of signing keys.  Our second goal is to
  have enough safeguards in place that producing forged signatures is
  impractical.

%p

  Here's how we do it.

%h3 Master Signing Key authenticates the current Signing Key

%p

  A master signing key authenticates the current active signing key.
  If the signing key is compromised, it will be revoked and a new one
  will take its place.  The master signing key was generated on a
  computer that has never been and will never be on a network.  To
  compromise the master key an attacker would need to access this
  computer physically at its current undisclosed location.

Master key fingerprint:

%pre

  Blah

%h3

  User key authentication requires control of user's private key and
  email address

%p

  When you register a private key, an encrypted email is sent with an
  confirmation link.  The email must be decrypted to follow the
  confirmation link.  To be able to activate the key, someone must:

%ul

  %li Have control of your email address.

  %li Be able to use your private key.

%p

  With reasonable security precautions it is difficult for an attacker
  to gain access to both.

%h3 Signing occurs over an 'air gap'

%p

  Signatures are not issued via the web server where you registered
  your key.  After you have authenticated your key with the web
  server, the information is transferred to a signing computer via an
  'air gap'.  It is placed on a USB drive and migrated to the signing
  computer.

%p

  If the web server is compromised, an attacker cannot get to the
  signing computer.

%h3 Signing computer is physically located on-site

%p

  It is not in the cloud.  It is physically controlled by us.

%h3 Keys are validated by a human before signing

%p

  A human performs a sanity check on the key before signing it to
  ensure that it is actually tied to the email account that a user
  registered with.

  For example, somone could create a user id of "User X
  (<EMAIL>) <EMAIL>" to trick
  automatic validation of the UID, but a human will immediately notice
  that something is amiss.

  We reserve the right to reject signing any keys that seem suspicious
  for whatever reason.

%h3 Signing key is on an OpenPGP smart card

%p

  Once we're on the signing computer, the signing key is contained on
  an

  %a{:href => "http://g10code.com/p-card.html"} OpenPGP smart card

  that is only inserted and activated for the
  duration of signing.

%p

  If the signing computer is compromised remotely, an attacker won't
  be able to physically insert the smart card and activate it.

%p

  If the signing computer is compromised locally, an attacker still
  requires access to the smart card.

%p

  If the smart card lost or stolen, an attacker only has three
{'fraction_non_alphanumeric': 0.03128802363984008, 'fraction_numerical': 0.0027811576568746743, 'mean_word_length': 3.389016018306636, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4111240', 'n_tokens_mistral': 1590, 'n_tokens_neox': 1493, 'n_words': 940}