linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15324.1318004954@turing-police.cc.vt.edu>
Date:	Fri, 07 Oct 2011 12:29:14 -0400
From:	Valdis.Kletnieks@...edu
To:	Krzysztof Halasa <khc@...waw.pl>
Cc:	Jon Masters <jonathan@...masters.org>,
	Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said:

> > Wouldn't the fact that I attend the keysigning party and claim that I was
> > the owner of key B4D3D7B0, and then subsequently signing your key with
> > that same key, prove that I actually controlled key B4D3D7B0?
> 
> I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets
> signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0)
> reads Alice's mail and signs something "in Alice's name". Alice loses.

You got that 180 degrees out of phase.  Jon said he wanted a keysigning party
where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by
signing something random. My claim is that if I can take Jon's key and sign it
with B4D3D7B0, that's already proving I control the key, and another signing
of something else doesn't prove anything regarding my control of the key.

Now mind you, it *does* have its uses - for example, "sign the random string
I just e-mailed you" will verify that I have control of the e-mail address that the
key claims to be attached to.  But that's different from proving I have control
of the actual key.

Content of type "application/pgp-signature" skipped