Last update: March 17, 2019. This website uses cookies. By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. More information

 Actions

Download the Whonix Signing Key


Introduction[edit]

Since all Whonix releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.

This page is strongly related to the Placing Trust in Whonix page.

Download the Key[edit]

Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed. This will fix eventual gpg: WARNING: unsafe ownership warnings.

Have GnuPG initialize your user data folder. 

gpg --fingerprint

Set warning free permissions. 

chmod --recursive og-rwx ~/.gnupg

1. Download Patrick Schleizer's (adrelanos') OpenPGP key. [1]
patrick.asc

2. Store the key as ~/patrick.asc.

3. Check fingerprints/owners without importing anything. 

gpg --keyid-format long --with-fingerprint patrick.asc

4. Verify the output.

The output should be identical to the following. 

pub  4096R/8D66066A2EEACCDA 2014-01-16 Patrick Schleizer <adrelanos@riseup.net>
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
sub  4096R/3B1E6942CE998547 2014-01-16 [expires: 2021-04-17]
sub  4096R/10FDAC53119B3FD6 2014-01-16 [expires: 2021-04-17]
sub  4096R/CB8D50BB77BB3C48 2014-01-16 [expires: 2021-04-17]

5. Import the key. 

gpg --import patrick.asc

The output should confirm the key was imported. 

gpg: key 2EEACCDA: public key "Patrick Schleizer <adrelanos@riseup.net>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

If the Whonix signing key was already imported in the past, the output should confirm the key is unchanged. 

gpg: key 2EEACCDA: "Patrick Schleizer <adrelanos@riseup.net>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

If the following message appears at the end of the output. 

gpg: no ultimately trusted keys found

Analyze the other messages as usual. This extra message does not relate to the Whonix signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images.

6. Advanced users can check Web of Trust further below for better security.

7. Complete the Whonix verification steps.

If verifying Whonix images, navigate to the relevant verification page below to finish the process:

Advanced Users[edit]

Web of Trust[edit]

A few people have signed Patrick Schleizer's (adrelanos') OpenPGP key in The OpenPGP Web of Trust.

Jan Dittberner [2] (Debian Developer) [3] signed Patrick's key. So did intrigeri (Tails developer, Debian Developer); Peter Palfrader (Debian Developer); Richard King; and Michael Carbone (accessnow.org).

Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt-get, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key.

Update the package lists. 

sudo apt-get update

Install the Debian keyring. 

sudo apt-get install debian-keyring

Extract a signer's key from the Debian keyring and import it into your own keyring. Here is an example using Jan's key. 

gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD | gpg --import

Optionally try to establish a better trust path to the signer by checking signatures on the signer's key.

Check signatures on Patrick's key. 

gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

The output of the above command should show signatures on Patrick's key, which should include the signer's signature.

Further Reading[edit]

See Also[edit]

License[edit]

Whonix Trusting Whonix Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Trusting Whonix Signing Key wiki page Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it
under certain conditions; see the wiki source code for details.

Footnotes[edit]

  1. ↑ 
    curl --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
  2. ↑ http://www.dittberner.info/de/content/jan-dittberner
  3. ↑ https://qa.debian.org/developer.php?login=Jan+Dittberner

No user support in comments. See Support.

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.


Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Random News:

Join us in testing our new AppArmor profiles for improved security! (forum discussion)

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix is a trademark. Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix itself. (Why?)

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.

Retrieved from "https://www.whonix.org/w/index.php?title=Whonix_Signing_Key&oldid=41197"