lkml.org 
[lkml]   [2011]   [Oct]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: kernel.org status: establishing a PGP web of trust
    From
    Date
    On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:

    > > Wouldn't the fact that I attend the keysigning party and claim that I was
    > > the owner of key B4D3D7B0, and then subsequently signing your key with
    > > that same key, prove that I actually controlled key B4D3D7B0?
    >
    > I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
    > signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
    > reads Alice's mail and signs something "in Alice's name". Alice loses.

    You got that 180 degrees out of phase. Jon said he wanted a keysigning party
    where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
    signing something random. My claim is that if I can take Jon's key and sign it
    with B4D3D7B0, that's already proving I control the key, and another signing
    of something else doesn't prove anything regarding my control of the key.

    Now mind you, it *does* have its uses - for example, "sign the random string
    I just e-mailed you" will verify that I have control of the e-mail address that the
    key claims to be attached to. But that's different from proving I have control
    of the actual key.

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2011-10-07 18:33    [W:3.569 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site