en	[[!meta date="Mon, 16 Mar 2015 12:34:56 +0000"]]

en	[[!pagetemplate template="news.tmpl"]]

en	[[!meta title="Transition to a new OpenPGP signing key"]]
zh-tw	[[!meta title="轉換到新的 OpenPGP 簽名密鑰"]]

en	[[!tag announce]]

en	Tails is transitioning to a new OpenPGP signing key.
zh-tw	Tails 正在轉換到一個新的 OpenPGP 簽名密鑰。

en	The signing key is the key that we use to:
zh-tw	這個簽名密鑰是我們使用的密鑰：

en	Sign our official ISO images.
zh-tw	簽署我們正式的 ISO 映像檔。

en	Certify the other [[OpenPGP keys|doc/about/openpgp_keys]] used by the project.
zh-tw	驗證另一個專案所用的 [[OpenPGP 密鑰|doc/about/openpgp_keys]]。

en	<div class="note">

en	The previous signing key is safe and, to the best of our knowledge, it has not been compromised.
zh-tw	之前的宓鑰依然安全，而據我們所知， 它並沒有遭到破壞。

en	We are doing this change to improve our security practices when manipulating such a critical piece of data.
zh-tw	我們推動這項改變是為了改善我們的安全實踐，尤其當 操作這些重要的資料。

en	</div>

en	<div class="tip">

en	The old key can still be used to verify Tails 1.3 ISO images. The new key will be used to sign ISO images starting from Tails 1.3.1.
zh-tw	舊的密鑰仍可用來驗證 Tails 1.3 的映像檔。 新的簽名密鑰則是用來簽署 Tails 1.3.1 之後的映像檔。

en	Import and verify the new signing key
zh-tw	滙入並驗證新的簽名密鑰

en	Click on the following button to download and import the new signing key:
zh-tw	點擊下方的按鈕以下載和滙入新的簽名密鑰：

en	new Tails signing key
zh-tw	新的 Tails 簽名密鑰

en	The new signing key is itself signed by the old signing key. So you can transitively trust this new key if you had trusted the old signing key.
zh-tw	這個新簽名密鑰本身也被舊密鑰簽名，所以如果你已信仕任過舊的簽名密鑰則可以轉換信任這個新密鑰。

en	To verify that the new key is correctly signed by the old key, you can execute the following command:
zh-tw	要驗證這個新密鑰是否正確地由舊密鑰所簽名，你可以執行以下指令：

en	gpg --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F

en	The output should include a signature of the new key by the old key such as:
zh-tw	輸出應包括由舊密鑰對新密鑰的簽名：

en	sig! 0x1202821CBE2CD9C1 2015-01-19 Tails developers (signing key) <tails@boum.org>

en	In this output, the status of the verification is indicated by a flag directly following the "`sig`" tag. A "`!`" indicates that the signature has been successfully verified.
zh-tw	在此輸出結果中，查驗的狀態是直接由旗誌接續著"`sig`" tag. A "`!`"來顯示其簽署已成功地認證。

en	Security policy for the new signing key
zh-tw	新簽名密鑰的安全政策

en	Here is the full description of the new signing key:
zh-tw	這裏有關於新簽名密鑰的完整描述：

en	<pre> pub 4096R/0xDBB802B258ACD84F 2015-01-18 [expires: 2017-01-11] Key fingerprint = A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F uid [ unknown] Tails developers (offline long-term identity key) <tails@boum.org> uid [ unknown] Tails developers <tails@boum.org> sub 4096R/0x98FEC6BC752A3DB6 2015-01-18 [expires: 2017-01-11] sub 4096R/0x3C83DCB52F699C56 2015-01-18 [expires: 2017-01-11] </pre>

en	You can see that it has:
zh-tw	你可以看到它有：

en	A primary key (marked as `pub`) with ID `0xDBB802B258ACD84F`. This primary key:
zh-tw	主要密鑰(marked as `pub`) ID `0xDBB802B258ACD84F`. 這個主要密鑰：

en	Is not owned in a usable format by any single individual. It is split cryptographically using gfshare.
zh-tw	並不被任何單一個人以可用格式持有，使用了 [gfshare](http://www.digital-scurf.org/software/libgfshare) 來進行密碼學分割。

en	Is only used offline, in an air-gapped Tails.
zh-tw	只用於離線，在一個完全不接觸網路的 Tails 環境。

en	Expires in less than one year. We will extend its validity as many times as we find reasonable.
zh-tw	不到一年到期，我們會展延它的有效性只要覺得有足夠理由。

en	Two subkeys (marked as `sub`) with IDs `0x98FEC6BC752A3DB6` and `0x3C83DCB52F699C56` which are stored on OpenPGP smartcards and owned by our release managers. Smartcards ensure that the cryptographic operations are done on the smartcard itself and that the secret cryptographic material is not directly available to the operating system using it.
zh-tw	二支 subkeys (marked as `sub`) 其 IDs `0x98FEC6BC752A3DB6` 和 `0x3C83DCB52F699C56` 儲存在 OpenPGP 智能卡並由我們的發佈管理肙所保管。Smartcards 確保其密碼操作完成在其自身上而祕密的密碼學材料並不會直接讓作業系統來使用它。

en	Web-of-Trust with the Debian keyring

en	This new signing key has already been signed by various Debian developers, namely:
zh-tw	這支新的簽名密鑰已由不同的 Debian 開發人員所簽署過，如：

en	gregor herrmann <gregoa@debian.org>, with key `0xBB3A68018649AA06`

en	Holger Levsen <holger@debian.org>, with key `0x091AB856069AAA1C`

en	Stefano Zacchiroli <zack@debian.org>, with key `0x9C31503C6D866396`

en	So you can use the technique described in our documentation to further verify the Tails signing key against the Debian keyring using any of those three keys.
zh-tw	因此你可以利用這三支密鑰中的任何一個，參考我們文件中所描述的技巧，進一步地[[驗證 Tails 簽名密鑰對照 Debian 密鑰圈|install/expert/usb#verify-key]] 。