Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign someones public key?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

You should really only sign someone's key if you actually know them, and you trust that the key is theirs.

When you sign it, you are saying that you checked them out, that you know it's their key.

You then figure out "would I trust this person to be as thorough as me in evaluating the identity of other people?" You might have friends who are careful, or people who you are acquainted with and hold a position of responsibility so you think they might be trustworthy, or they might be a complete stranger, so you wouldn't trust them with a burned out match. That's when you assign the level of trust.

A web page begging you to sign it could be someone trying to build a sock puppet, false identity, or even stealing someone else's identity. Worse, they could be collecting the identities of people who are gullible enough to sign a random key with no validation process.

share|improve this answer
    
Thank you, this is the website that made me think about the question w3.org/People/Connolly/connolly-pgp-key –  kyle k Aug 9 '13 at 3:16
1  
Ah. He's not asking you to sign it sight unseen, on-line. If you contact him, you could arrange for a signing. Very different. –  John Deters Aug 10 '13 at 18:42
add comment

You need to verify their identity. Normally this would require them you to have them show you two forms of identity validation (for instance an ID card and a driver's license) and by making them show you a document which determines that they actually live at their listed address ( a bill for electricity or water for instance).

For instance CAcert is a community driven certificate authority. They sometimes do signing parties:

To create higher-trust certificates, users can participate in a web of trust system whereby users physically meet and verify each other's identities. CAcert maintains the number of assurance points for each account. Assurance points can be gained through various means, primarily by having one's identity physically verified by users classified as "Assurers". Having more assurance points allows users more privileges such as writing a name in the certificate and longer expiration times on certificates. A user with at least 100 assurance points is a Prospective Assurer, and may—after passing an Assurer Challenge[5]—verify other users; more assurance points allow the Assurer to assign more assurance points to others.

share|improve this answer
    
Are you saying that i have to meet with someone in person to sign a key. Where would i do that? –  kyle k Aug 9 '13 at 3:18
2  
at your local key-signing party –  Lucas Kauffman Aug 9 '13 at 3:49
    
Do they still take place? I haven't see any info about any in years, and even a decade ago they were obscure. –  domen Aug 9 '13 at 12:34
    
I'm sure they still do it at large conventions like CEBIT –  Lucas Kauffman Aug 9 '13 at 13:05
    
Yes, those still take place. E,g, every year there is a long line of people checking and signing keys at FOSDEM. And actually validating their ID rather than blindly accepting a lichtbildausweis. –  Hennes Aug 10 '13 at 17:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.