linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 7 Oct 2011 12:59:30 -0400
From:	Arnaud Lacombe <lacombar@...il.com>
To:	Valdis.Kletnieks@...edu
Cc:	Krzysztof Halasa <khc@...waw.pl>,
	Jon Masters <jonathan@...masters.org>,
	Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

Hi,

On Fri, Oct 7, 2011 at 12:29 PM,  <Valdis.Kletnieks@...edu> wrote:
> On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:
>
>> > Wouldn't the fact that I attend the keysigning party and claim that I was
>> > the owner of key B4D3D7B0, and then subsequently signing your key with
>> > that same key, prove that I actually controlled key B4D3D7B0?
>>
>> I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
>> signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
>> reads Alice's mail and signs something "in Alice's name". Alice loses.
>
> You got that 180 degrees out of phase.  Jon said he wanted a keysigning party
> where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
> signing something random. My claim is that if I can take Jon's key and sign it
> with B4D3D7B0, that's already proving I control the key, and another signing
> of something else doesn't prove anything regarding my control of the key.
>
> Now mind you, it *does* have its uses - for example, "sign the random string
> I just e-mailed you" will verify that I have control of the e-mail address that the
> key claims to be attached to.  But that's different from proving I have control
> of the actual key.
>
How so ? The public key BOb has is mathematically tied to the private
key Alice has. If Bob sends Alice a mail, and then, she send a reply
signed with her key, which is tied to the mail address used by Bob.
Then, Bob successfully verifies the signature. This proves Alice has
control over the key tied and the mail address, don't it ? Alice
cannot successfully sign the mail without both having control over the
key and the mail address.

 - Arnaud
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/