[tor-bugs] #15045 [Blog]: Stress importance of checking 63fee659 signature on new signing key

Fri Feb 27 00:08:00 UTC 2015

#15045: Stress importance of checking 63fee659 signature on new signing key
--------------------------------+---------------------
 Reporter:  martingale          |          Owner:
     Type:  defect              |         Status:  new
 Priority:  normal              |      Milestone:
Component:  Blog                |        Version:
 Keywords:  signing key switch  |  Actual Points:
Parent ID:                      |         Points:
--------------------------------+---------------------
 With the release of version 4.0.4 of the browser bundle, the signing key
 was changed to 0x4E2C6E8793298290. I think it is important to stress that
 if a user had already established a trust chain for Erinn's key
 0x416F061063FEE659, then the user should check that Erinn's key signed the
 new signing key.

 I suggest a message should be included in a blog post quickly telling this
 to users and perhaps giving the quick command `gpg --check-sigs
 0x4E2C6E8793298290`.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15045>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online