Messages in this thread | | | Subject | Re: kernel.org status: establishing a PGP web of trust | From | Valdis.Kletnieks@vt ... | Date | Fri, 07 Oct 2011 12:29:14 -0400 |
| |
On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:
> > Wouldn't the fact that I attend the keysigning party and claim that I was > > the owner of key B4D3D7B0, and then subsequently signing your key with > > that same key, prove that I actually controlled key B4D3D7B0? > > I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets > signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0) > reads Alice's mail and signs something "in Alice's name". Alice loses.
You got that 180 degrees out of phase. Jon said he wanted a keysigning party where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by signing something random. My claim is that if I can take Jon's key and sign it with B4D3D7B0, that's already proving I control the key, and another signing of something else doesn't prove anything regarding my control of the key.
Now mind you, it *does* have its uses - for example, "sign the random string I just e-mailed you" will verify that I have control of the e-mail address that the key claims to be attached to. But that's different from proving I have control of the actual key.
[unhandled content-type:application/pgp-signature] | |