linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 08 Oct 2011 17:16:09 +0200
From:	Krzysztof Halasa <khc@...waw.pl>
To:	Valdis.Kletnieks@...edu
Cc:	Jon Masters <jonathan@...masters.org>,
	Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

Valdis.Kletnieks@...edu writes:

> You got that 180 degrees out of phase.  Jon said he wanted a keysigning party
> where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
> signing something random.

But this is not needed at all. While signing someone's public key, you
don't need to check if he has a corresponding private key. That's BTW
the same as with PKI certificate requests.

By signing one's public key you don't certify at all that you know
anything about the corresponding private key. You certify that the
person in question confirmed this public key belongs to him/her. You may
want to check the email part, but it's part of the identity check, not
the private key check.

The check if someone has access to the private key is important later,
when we can't see the person.

> My claim is that if I can take Jon's key and sign it
> with B4D3D7B0, that's already proving I control the key, and another signing
> of something else doesn't prove anything regarding my control of the
> key.

That may be disputable but what I wanted to say is it simply doesn't
matter.

> Now mind you, it *does* have its uses - for example, "sign the random string
> I just e-mailed you" will verify that I have control of the e-mail address that the
> key claims to be attached to.  But that's different from proving I have control
> of the actual key.

Definitely.
-- 
Krzysztof Halasa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/