linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 07 Oct 2011 00:16:01 +0200
From:	Krzysztof Halasa <khc@...waw.pl>
To:	Valdis.Kletnieks@...edu
Cc:	Jon Masters <jonathan@...masters.org>,
	Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

> On Thu, 06 Oct 2011 11:58:22 EDT, Jon Masters said:
>> What I'd like to see is "keysigning" parties where folks with well
>> established (in use) keys turn up and *prove* they own the key by
>> signing some information the other attendees provide. That way they can
>> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
>> photo ID" (which means nothing in the case of a well established online
>> identify that is trusted already),

The person may be trusted but how do you know the message apparently
from that person is genuine?

Valdis.Kletnieks@...edu writes:

> Wouldn't the fact that I attend the keysigning party and claim that I was
> the owner of key B4D3D7B0, and then subsequently signing your key with
> that same key, prove that I actually controlled key B4D3D7B0?

I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
reads Alice's mail and signs something "in Alice's name". Alice loses.
There are many ways for Alice to lose if she wishes to. One of the
simpler ones is to send the private key straight to Chuck then erase it
from her computer.

It's Alice's problem to make sure other people sign her key instead of
some other number she has found on the floor. It's their responsibility
to verify Alice's identity, but they aren't responsible for her actions.
-- 
Krzysztof Halasa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/