Re: kernel.org status: establishing a PGP web of trust

Valdis.Kletnieks
2011-10-07T18:23:46Z

[-- Attachment #1: Type: text/plain, Size: 636 bytes --]

On Fri, 07 Oct 2011 12:59:30 EDT, Arnaud Lacombe said:

> How so ? The public key BOb has is mathematically tied to the private
> key Alice has. If Bob sends Alice a mail, and then, she send a reply
> signed with her key, which is tied to the mail address used by Bob.
> Then, Bob successfully verifies the signature. This proves Alice has
> control over the key tied and the mail address, don't it ?

As I said - yes, that *DOES* prove control over key and email address.

The point is that signing something random does not prove anything about
control of the *KEY ONLY* that isn't also proved by using the key to sign
another key.

[-- Attachment #2: Type: application/pgp-signature, Size: 227 bytes --]