Re: kernel.org status: establishing a PGP web of trust
From: Valdis . Kletnieks
Date: Fri Oct 07 2011 - 12:31:13 EST
On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:
> > Wouldn't the fact that I attend the keysigning party and claim that I was
> > the owner of key B4D3D7B0, and then subsequently signing your key with
> > that same key, prove that I actually controlled key B4D3D7B0?
> I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
> signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
> reads Alice's mail and signs something "in Alice's name". Alice loses.
You got that 180 degrees out of phase. Jon said he wanted a keysigning party
where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
signing something random. My claim is that if I can take Jon's key and sign it
with B4D3D7B0, that's already proving I control the key, and another signing
of something else doesn't prove anything regarding my control of the key.
Now mind you, it *does* have its uses - for example, "sign the random string
I just e-mailed you" will verify that I have control of the e-mail address that the
key claims to be attached to. But that's different from proving I have control
of the actual key.
Description: PGP signature