linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 06 Oct 2011 15:50:59 -0400
From:	Valdis.Kletnieks@...edu
To:	Jon Masters <jonathan@...masters.org>
Cc:	Adrian Bunk <bunk@...sta.de>, "Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Thu, 06 Oct 2011 11:58:22 EDT, Jon Masters said:

> What I'd like to see is "keysigning" parties where folks with well
> established (in use) keys turn up and *prove* they own the key by
> signing some information the other attendees provide. That way they can
> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> photo ID" (which means nothing in the case of a well established online
> identify that is trusted already), but they can say "hey, I have access
> to this key, because I just signed that random message you gave me
> interactively". 

Wouldn't the fact that I attend the keysigning party and claim that I was
the owner of key B4D3D7B0, and then subsequently signing your key with
that same key, prove that I actually controlled key B4D3D7B0?

The other possibility is that I was an impostor *and* that the real owner of
key B4D3D7B0 was coincidentally going around that same day and signing keys for
everybody at the keysigning without doing proper verification.  Which you have
to admit is rather a long shot...

Content of type "application/pgp-signature" skipped