linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111006175219.GB23532@opensource.wolfsonmicro.com>
Date:	Thu, 6 Oct 2011 18:52:19 +0100
From:	Mark Brown <broonie@...nsource.wolfsonmicro.com>
To:	Krzysztof Halasa <khc@...waw.pl>
Cc:	Jon Masters <jonathan@...masters.org>, Valdis.Kletnieks@...edu,
	Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Thu, Oct 06, 2011 at 07:45:45PM +0200, Krzysztof Halasa wrote:
> Mark Brown <broonie@...nsource.wolfsonmicro.com> writes:

> > A common approach to this for at least the e-mail portion of the address
> > is to sign the ID with the address and then mail the signed key
> > encrypted to the address, deleting all local copies and requiring that
> > the recipient publish the signature.  This at least demonstrates that
> > the owner of the key can read mail at that address.

> The assumption here is the attacker can read (and write) victim's email.
> It's not about verifying email access or address.

Bear in mind that this is only done after a successful out of band
verification - it's purely about verifying the e-mail portion of the
identity which the person has already asserted that they control.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/