Key signing parties are a
pain and hopefully, one day, we will have better ways to authentication keys
than reading hexadecimal strings out loud.
The
Zimmermann Sassaman key-signing
protocol
makes them much more bearable already by having only one single hexadecimal
string read out loud. That string is the cryptographic hash of a document
given to every participant listing all participants and their fingerprints.
If everyone has the same hash, then we assume that everyone has the same
document. Then, participants in turn will confirm that they fully recognize
the fingerprint listed in the document.
Alexander Wirt wrote a
small key
server dedicated to receive keys from
the participants. There is also a script that will generate the document from
the submitted keys and a ready-to-use keyring. The latter can be run
automatically using
inoticoming when a new key
arrives. Finally, it would be nice if participants could confirm that their key
has been properly added to the document, e.g. by making the list available on a
web server.
Setting all this up seemed like a good opportunity to play with
Tor hidden services and
systemd-nspawn.
Here's the setup log with some comments. This was done on a small
armhf
device with Debian Jessie.
Create a new hidden service
Edit
/etc/tor/torrc on the host to setup the hidden service:
HiddenServiceDir /var/lib/tor/ksp/
HiddenServicePort 80 10.0.0.2:80
HiddenServicePort 11371 10.0.0.2:11371
Run:
host# systemctl reload tor.service
Then, to learn the name of the newly created hidden service name:
host# cat /var/lib/tor/ksp/hostname
ksp123456789abcd.onion
Install the container
debootstrap as always:
host# debootstrap --variant=minbase jessie /var/lib/container/ksp
Preliminary container configuration
We do the following step simply using
chroot as we are going to
use the host network configuration for this stage. The container itself will
not have access to the Internet.
host# chroot ksp
Let's set the hostname:
ksp-chroot# echo 'ksp' > /etc/hostname
Set up APT:
ksp-chroot# echo 'deb http://httpredir.debian.org/debian jessie main' > /etc/apt/sources.list
ksp-chroot# apt update
We need
dbus to get systemd to work well:
ksp-chroot# apt-get install dbus
Make sure that we can resolve our own hostname:
ksp-chroot# apt-get install libnss-myhostname
ksp-chroot# sed -e '/^hosts:/s/files/myhostname \0/' -i /etc/nsswitch.conf
These are dependencies of the keyserver:
ksp-chroot# apt-get install --no-install-recommends libhttp-daemon-perl \
liblog-loglite-perl libproc-reliable-perl
These ones are needed for the script generating the list:
ksp-chroot# apt-get install bzip2 inoticoming
And we will use the smallest HTTP server available:
ksp-chroot# apt-get install netcat-traditional micro-httpd
Finally, let's unconfigure all DNS resolvers:
ksp-chroot# echo > /etc/resolv.conf
And we are done with the chroot:
ksp-chroot# exit
Let's retrieve the
ksp-tools repository now:
host# cd /var/lib/container/srv
host# git clone https://github.com/formorer/ksp-tools
Container setup
We will now start the container with a shell to configure it:
host# systemd-nspawn -D ksp --network-veth
Let's ask systemd to configure the network for us:
ksp# systemctl enable systemd-networkd
Let's not forget to set a root password:
ksp# passwd
We add a dedicated user to run the keyserver and the list generation script:
ksp# adduser --system --group --disabled-password --disabled-login --home /var/lib/ksp ksp
Let's configure the keyserver:
ksp# cp /srv/ksp-tools/keyserver.conf /var/lib/ksp/keyserver.conf
Let's edit
/var/lib/ksp/keyserver.conf:
homedir = /var/lib/ksp
Now create the GnuPG homedir for the keyserve:
ksp# mkdir /var/lib/ksp/keys
ksp# install -d -o ksp -g ksp -m 0700 /var/lib/ksp/keys/gpg
Copy the template list generator:
ksp# cp -r /srv/ksp-tools/example /var/lib/ksp/keys/ksp123456789abcd_onion
Create the key repository:
ksp# install -d -o ksp -g ksp -m 0700 /var/lib/ksp/keys/ksp123456789abcd_onion/keys
Create a directory accessible to the web server where the participant list will
be generated:
ksp# mkdir -p /var/www
ksp# install -d -o ksp -g ksp -m 0755 /var/www/keys
Let's configure the list generation script by editing
/var/lib/ksp/keys/ksp123456789abcd_onion/conf/vars:
KS=ksp123456789abcd.onion
export GNUPGHOME=/tmp/ksp-gpg
KSPFILE="/var/www/keys/ksp-event.txt"
Don't forget to adjust the header in
/var/lib/ksp/keys/ksp123456789abcd_onion/conf/list-header.
Now we create a unit file for the keyserver in
/etc/systemd/system/keyserver.service:
[Unit]
Description=Key signing party keyserver
[Service]
Type=simple
Environment="KSP_HOMEDIR=/var/lib/ksp"
ExecStart=/srv/ksp-tools/bin/kspkeyserver.pl --nodaemonize
User=ksp
Group=ksp
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib/ksp
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target
Another unit for the list generator as
/etc/systemd/system/ksp-list-generator.service:
[Unit]
Description=Key signing party list generator
[Service]
Type=simple
EnvironmentFile=/var/lib/ksp/keys/ksp123456789abcd_onion/conf/vars
ExecStart=/usr/bin/inoticoming --foreground /var/lib/ksp/keys/ksp123456789abcd_onion/keys --chdir /var/lib/ksp/keys/ksp123456789abcd_onion bin/generate-list \;
User=ksp
Group=ksp
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=/var/www/keys
CapabilityBoundingSet=
[Install]
WantedBy=multi-user.target
For the web server, we first configure a socket listening on port 80 in
/etc/systemd/system/micro-httpd.socket:
[Unit]
Description=micro-httpd socket
[Socket]
ListenStream=80
Accept=yes
[Install]
WantedBy=sockets.target
And then the web server in
/etc/systemd/system/micro-httpd@.service:
[Unit]
Description=micro-httpd server
[Service]
ExecStart=-/usr/sbin/micro-httpd /var/www/ksp
StandardInput=socket
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
CapabilityBoundingSet=
Let's now ask systemd to start all of these at boot time:
ksp# systemctl daemon-reload
ksp# systemctl enable keyserver.service
ksp# systemctl enable ksp-list-generator.service
ksp# systemctl enable micro-httpd.socket
One way to kill the container is to type Control+
] three times.
Boot the container
Let's get this party started!
host# systemd-nspawn -b -D /var/lib/container/ksp --network-veth
Hopefully, things should work now. Participants to the KSP should then be able
to send their key with:
$ torsocks gpg --keyserver ksp123456789abcd.onion --send-key $KEYID
(Sadly, this is
broken with GnuPG
2.1 at the
moment.)
The participant list should be available at
http://ksp123456789abcd.onion/ksp-event.txt.
Final steps
We need to tell systemd to start the container started at boot time:
host# systemctl enable systemd-nspawn@ksp.service
But the default command-line will not use a dedicated network, so we need
to override that part of the configuration. First create a directory:
host# mkdir /etc/systemd/system/systemd-nspawn@ksp.service.d
And edit
/etc/systemd/system/systemd-nspawn@ksp.service.d/use-network-veth.conf:
[Service]
# The empty line because we want to override all previous ExecStart
# and not add an extra command
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --directory=/var/lib/container/%i --network-veth
Let's reload systemd and verify that our snippet is there:
host# systemctl daemon-reload
host# systemctl cat systemd-nspawn@ksp.service
All good? Let's start it:
host# systemctl start systemd-nspawn@ksp.service
One should also add a firewall to disallow any outgoing connections from the
ve-ksp interface as an extra protection.
A bugfix release of 
[As You Like It, Act III, Scene V]
Hey Beautiful
I thought of you on the Fourth of July; which does not, in and of itself,
distinguish the day from any other since I met you. It was remarkable
only in that it was justifiable, given our conversation about fireworks
displays. Of course, I'm happy to take the flimsiest of displays as an
excuse to mark you.
I'm home alone right now, after watching The Bad Seed. Truth be told,
the shadows keep spooking me. I can't seem to stop myself from imagining
precocious blonde murderers in them. It's a manageable silliness, but
made a little less so by the fact that I forgot to lock the door. Less
troublesome than the night I spent after Ringu (the original Japanese
version of The Ring). I finished watching it in the wee hours of the
morning, and I wanted to go to sleep. I was in half a stupor, but the
incessant inner critic in me kept imagining all the changes that could
have been made to make the movie more truly unsettling until visions of
Obake were swimming around me.
Ordinarily I doubt I'd be bothered particularly by a 50's classic, but
went back up to Boston this afternoon. 's at a conference in
Finland, so I invited him down to visit while I have the apartment all
to myself. It was strange to have a visitor actually in my home for
whom I didn't have to play at being contented. At any rate, being
around for three days essentially meant carrying on a three-day-long
conversaiton, and the abrupt drop of sociability makes me feel my
isolation a little more acutely.
We watched The Way We Were together, and agreed that it should be
remade with casting that actually works. I hadn't seen it before, and
was surprised to find it unusually nuanced and substantial, yet still
not good. It was nice to have someone around who would dissect it with
me afterward. It's been a while since I actually discussed a film with
someone. Partly out of my own fault; I don't always enjoy verbalizing
my opinions of movies immediately after watching them if I've found them
in the least bit moving. I guess I consider the aftertaste part of the
experience. In this case, we both felt the film had missed its
emotional mark so it wasn't so much of an issue. On the other hand, I
don't find most movies moving. I find them frustratingly flawed, and by
the time they end I'm raring to rant about their petty contradictions
and failures of logic. I think it might give people the impression that
I don't actually make any effort to tease out the messages filmmakers
weave into their work. Or maybe I'm just making excuses for having
uninteresting friends. Either way, it was pleasant to be in the company
of someone eager to tolerate the convolutions of my thought process.
On Wednesday night, I have a date to meet up with some former
co-workers/friends that I've been passively avoiding for several years
now. Every time I fail to carefully manage my visibility, people seem
to come flooding back into my life. This time the culprit was a day
spent logged into instant messaging without stringent privacy settings.
I should feel lucky for that, I suppose. I'm not sure how I actually
feel. One of the formers is a woman I was very close to, as far as
most of the world her included could discern. The other is a Boston
boy I admired for the touch of golden child in the air that hung about
him. The main theme of his life was (and I suspect still is) getting
to drinks with friends at one of his regular bars at the end of every
evening. Which did not at all stop him from being productive,
interested in the world, and bright. If he had been a girl I would
have been hateful with envy. Instead he's always stood out in my
memory as the only person I've had a bit of a crush on despite not
finding him particularly intellectually stimulating. A month or so
ago he sold his company to google. Now he spends a lot of time out of
town giving lectures. I suspect I may be generally happy for him,
and I'm not quite sure what to do with that.
Thursday I'm leaving for a few days in Denver. I wish I hadn't
scheduled it for a time when I could have been the sole occupant of
my domicile, but other than that I'm looking forward to it. I've
no idea what I'll do there, but at least that means I really am
going someplace that wouldn't occur to me outside of a peculiar set
of constraints. I think it would be advisable to work out the
transportation system before I depart, though.
I hope this letter finds you relatively satisfied, at a minimum.
I don't actually need to tell you how much I miss talking to you, do I?
You're wonderful.
Affectionally, as always,
And yet another upstream 
A few days ago, the French equivalent of
Usual regular update of the TeX Live packages. Now that Debian/unstable is back to full development speed thanks to the end of the bit gcc transition, probably this TeX Live update will be lost between the hundreds of others. Anyway a few interesting changes are still in there.
Most importantly the fix for unicode-math that was broken for a short time, and for the Japanese users it seems that the LaTeX3 packages have gained support for upTeX. Good to hear.
Of course, these are not the only updates and newcomers, see the list below.
Updated packages
abc, acro, alegreya, animate, arabxetex, babel-bosnian, babel-french, babel-greek, babel-latin, babel-welsh, beamer-FUBerlin, bidi, bigfoot, blochsphere, bxjscls, chemformula, chemmacros, chet, classicthesis, crossrefware, csplain, ctable, ctanify, datetime2, datetime2-basque, detlev-cm, disser, doclicense, drm, dtxgen, dtxtut, dvips, ecclesiastic, eledmac, embrac, etex-pkg, etoc, factura, fbb, fithesis, font-change, fontname, glossaries, gothic, greek-fontenc, IEEEtran, l3build, l3experimental, l3kernel, l3packages, latexconfig, lettrine, luatexja, mathastext, mcf2graph, media9, metrix, mhequ, minted, moderntimeline, newtx, ocgx2, pagecolor, pdftex, pgf, pstricks, reledmac, resphilosophica, roboto, shdoc, siunitx, suftesi, tetex, tex4ht, texlive-scripts, tikz-bayesnet, translations, ucharcat, udesoftec, ulthese, unicode-math, ut-thesis, withargs, xint.
New packages
checklistings, cleanthesis, easyreview, fei, medstarbeamer, mfirstuc, nevelok, old-arrows, proofread, uassign, xebaposter.
Enjoy.
during the last weeks, I spent time mostly with 
Another improvement would be to change the font from the canonical
Helvetica to something prettier, like suggested in 
It's time for some new music. And given that this artist was suggested to me at least twice by different people I guess I finally have to feature her. This time it's about 
Hm, wasn't there a