linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 05 Oct 2011 00:23:04 -0400
From:	Valdis.Kletnieks@...edu
To:	Adrian Bunk <bunk@...sta.de>
Cc:	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Wed, 05 Oct 2011 01:39:32 +0300, Adrian Bunk said:

> But the semantics of PGP key signing is that you certify that you 
> verified that a photo ID of that person matches the name on the key.

No. The semantics are that you've verified the person matches the key.
Photo ID's are *one way* of doing it.

http://www.gnupg.org/gph/en/manual.html 

The GNU Privacy Handbook says (under 'Importing a Public Key'):

"A key's fingerprint is verified with the key's owner. This may be done in
person or over the phone or through any other means as long as you can
guarantee that you are communicating with the key's true owner. If the
fingerprint you get is the same as the fingerprint the key's owner gets, then
you can be sure that you have a correct copy of the key."

Now, if you're doing a PGP keysigning, then yes, checking government-issued ID
is probably the only sane way to verify 50 or 100 people's identities in an
hour. But if you have other trustable channels of doing so, that's considerd OK
too.

Content of type "application/pgp-signature" skipped