Re: kernel.org status: establishing a PGP web of trust

Valdis.Kletnieks
2011-10-07T16:31:13Z

[-- Attachment #1: Type: text/plain, Size: 1149 bytes --]

On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:

> > Wouldn't the fact that I attend the keysigning party and claim that I was
> > the owner of key B4D3D7B0, and then subsequently signing your key with
> > that same key, prove that I actually controlled key B4D3D7B0?
>
> I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
> signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
> reads Alice's mail and signs something "in Alice's name". Alice loses.

You got that 180 degrees out of phase. Jon said he wanted a keysigning party
where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
signing something random. My claim is that if I can take Jon's key and sign it
with B4D3D7B0, that's already proving I control the key, and another signing
of something else doesn't prove anything regarding my control of the key.

Now mind you, it *does* have its uses - for example, "sign the random string
I just e-mailed you" will verify that I have control of the e-mail address that the
key claims to be attached to. But that's different from proving I have control
of the actual key.

[-- Attachment #2: Type: application/pgp-signature, Size: 227 bytes --]