Document cmdgen ability to read public-only keys.

[PuTTY.git] / doc / pgpkeys.but

diff --git a/doc/pgpkeys.but b/doc/pgpkeys.but
index e31bbdf6cf00fccf1f8a2ab687d11a86e285d622..9ec900665863ff5ef422b70475daef4fe7f8d595 100644 (file)
--- a/doc/pgpkeys.but
+++ b/doc/pgpkeys.but
@@ -22,11 +22,11 @@ the origin of files distributed by the PuTTY team.)
 
 \H{pgpkeys-pubkey} Public keys
 
 
 \H{pgpkeys-pubkey} Public keys
 

-We maintain a set of three keys, stored with different levels of
-security due to being used in different ways. See \k{pgpkeys-security}
-below for details.
+We maintain multiple keys, stored with different levels of security
+due to being used in different ways. See \k{pgpkeys-security} below
+for details.

 
 

-The three keys we provide are:
+The keys we provide are:

 
 \dt Snapshot Key
 
 
 \dt Snapshot Key
 


@@ -38,15 +38,20 @@ we send to particular users.
 
 \dd Used to sign manually released versions of PuTTY.
 
 
 \dd Used to sign manually released versions of PuTTY.
 

+\dt Secure Contact Key
+
+\dd An encryption-capable key suitable for people to send confidential
+messages to the PuTTY team, e.g. reports of vulnerabilities.
+

 \dt Master Key
 
 \dt Master Key
 

-\dd Used to tie the other two keys into the GPG web of trust. The
-Master Key signs the other two keys, and other GPG users have signed
+\dd Used to tie all the above keys into the GPG web of trust. The
+Master Key signs all the other keys, and other GPG users have signed

 it in turn.
 
 it in turn.
 

-The current issue of those three keys are available for download from
-the PuTTY website, and are also available on PGP keyservers using the
-key IDs listed below.
+The current issue of those keys are available for download from the
+PuTTY website, and are also available on PGP keyservers using the key
+IDs listed below.

 
 \dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/master-2015.asc}{\s{Master Key}}
 
 
 \dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/master-2015.asc}{\s{Master Key}}
 


@@ -60,6 +65,14 @@ key IDs listed below.
 \cw{2048R/9DFE2648B43434E4}). Fingerprint:
 \cw{0054\_DDAA\_8ADA\_15D2\_768A\_\_6DE7\_9DFE\_2648\_B434\_34E4}
 
 \cw{2048R/9DFE2648B43434E4}). Fingerprint:
 \cw{0054\_DDAA\_8ADA\_15D2\_768A\_\_6DE7\_9DFE\_2648\_B434\_34E4}
 

+\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/contact-2016.asc}{\s{Secure Contact Key}}
+
+\dd RSA, 2048-bit. Main key ID: \cw{2048R/8A0AF00B} (long version:
+\cw{2048R/C4FCAAD08A0AF00B}). Encryption subkey ID:
+\cw{2048R/50C2CF5C} (long version: \cw{2048R/9EB39CC150C2CF5C}).
+Fingerprint:
+\cw{8A26\_250E\_763F\_E359\_75F3\_\_118F\_C4FC\_AAD0\_8A0A\_F00B}
+

 \dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/snapshot-2015.asc}{\s{Snapshot Key}}
 
 \dd RSA, 2048-bit. Key ID: \cw{2048R/D15F7E8A} (long version:
 \dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/snapshot-2015.asc}{\s{Snapshot Key}}
 
 \dd RSA, 2048-bit. Key ID: \cw{2048R/D15F7E8A} (long version:


@@ -115,6 +128,12 @@ The Releases private key is kept encrypted on the developers' own
 local machines. So an attacker wanting to steal it would have to also
 steal the passphrase.
 
 local machines. So an attacker wanting to steal it would have to also
 steal the passphrase.
 

+\S{pgpkeys-contact} The Secure Contact Key
+
+The Secure Contact Key is stored with a similar level of security to
+the Release Key: it is stored with a passphrase, and no automated
+script has access to it.
+

 \S{pgpkeys-master} The Master Keys
 
 The Master Key signs almost nothing. Its purpose is to bind the other
 \S{pgpkeys-master} The Master Keys
 
 The Master Key signs almost nothing. Its purpose is to bind the other


@@ -137,11 +156,15 @@ once.
 
 \H{pgpkeys-rollover} Key rollover
 
 
 \H{pgpkeys-rollover} Key rollover
 

-Our current three keys were generated in September 2015. Prior to
-that, we had a much older set of keys generated in 2000. For each of
-the three key types above, we provided both an RSA key \e{and} a DSA
-key (because at the time we generated them, RSA was not in practice
-available to everyone, due to export restrictions).
+Our current keys were generated in September 2015, except for the
+Secure Contact Key which was generated in February 2016 (we didn't
+think of it until later).
+
+Prior to that, we had a much older set of keys generated in 2000. For
+each of the key types above (other than the Secure Contact Key), we
+provided both an RSA key \e{and} a DSA key (because at the time we
+generated them, RSA was not in practice available to everyone, due to
+export restrictions).

 
 The new Master Key is signed with both of the old ones, to show that
 it really is owned by the same people and not substituted by an
 
 The new Master Key is signed with both of the old ones, to show that
 it really is owned by the same people and not substituted by an


@@ -162,7 +185,7 @@ For completeness, those old keys are given here:
 \cw{1024R/9D5877BF1E34AC41}). Fingerprint:
 \cw{8F\_15\_97\_DA\_25\_30\_AB\_0D\_\_88\_D1\_92\_54\_11\_CF\_0C\_4C}
 
 \cw{1024R/9D5877BF1E34AC41}). Fingerprint:
 \cw{8F\_15\_97\_DA\_25\_30\_AB\_0D\_\_88\_D1\_92\_54\_11\_CF\_0C\_4C}
 

-\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/master-rsa.asc}{\s{Master Key} (original DSA)}
+\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/master-dsa.asc}{\s{Master Key} (original DSA)}

 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/6A93B34E} (long version:
 \cw{1024D/4F5E6DF56A93B34E}). Fingerprint:
 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/6A93B34E} (long version:
 \cw{1024D/4F5E6DF56A93B34E}). Fingerprint:


@@ -174,7 +197,7 @@ For completeness, those old keys are given here:
 \cw{1024R/EF39CCC0B41CAE29}). Fingerprint:
 \cw{AE\_65\_D3\_F7\_85\_D3\_18\_E0\_\_3B\_0C\_9B\_02\_FF\_3A\_81\_FE}
 
 \cw{1024R/EF39CCC0B41CAE29}). Fingerprint:
 \cw{AE\_65\_D3\_F7\_85\_D3\_18\_E0\_\_3B\_0C\_9B\_02\_FF\_3A\_81\_FE}
 

-\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/release-rsa.asc}{\s{Release Key} (original DSA)}
+\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/release-dsa.asc}{\s{Release Key} (original DSA)}

 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/08B0A90B} (long version:
 \cw{1024D/FECD6F3F08B0A90B}). Fingerprint:
 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/08B0A90B} (long version:
 \cw{1024D/FECD6F3F08B0A90B}). Fingerprint:


@@ -186,7 +209,7 @@ For completeness, those old keys are given here:
 \cw{1024R/FAAED21532B903A9}). Fingerprint:
 \cw{86\_8B\_1F\_79\_9C\_F4\_7F\_BD\_\_8B\_1B\_D7\_8E\_C6\_4E\_4C\_03}
 
 \cw{1024R/FAAED21532B903A9}). Fingerprint:
 \cw{86\_8B\_1F\_79\_9C\_F4\_7F\_BD\_\_8B\_1B\_D7\_8E\_C6\_4E\_4C\_03}
 

-\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/snapshot-rsa.asc}{\s{Snapshot Key} (original DSA)}
+\dt \W{http://www.chiark.greenend.org.uk/~sgtatham/putty/keys/snapshot-dsa.asc}{\s{Snapshot Key} (original DSA)}

 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/7D3E4A00} (long version:
 \cw{1024D/165E56F77D3E4A00}). Fingerprint:
 
 \dd DSA, 1024-bit. Key ID: \cw{1024D/7D3E4A00} (long version:
 \cw{1024D/165E56F77D3E4A00}). Fingerprint: