lkml.org 
[lkml]   [2011]   [Oct]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: kernel.org status: establishing a PGP web of trust
    From
    Date
    On Fri, 07 Oct 2011 12:59:30 EDT, Arnaud Lacombe said:

    > How so ? The public key BOb has is mathematically tied to the private
    > key Alice has. If Bob sends Alice a mail, and then, she send a reply
    > signed with her key, which is tied to the mail address used by Bob.
    > Then, Bob successfully verifies the signature. This proves Alice has
    > control over the key tied and the mail address, don't it ?

    As I said - yes, that *DOES* prove control over key and email address.

    The point is that signing something random does not prove anything about
    control of the *KEY ONLY* that isn't also proved by using the key to sign
    another key.

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2011-10-07 20:25    [W:4.181 / U:0.572 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site