Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I'm studying network and system security and I came across the phrase Web of Trust:

In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centralized trust model of a public key infrastructure (PKI), which relies exclusively on a certificate authority (or a hierarchy of such). As with computer networks, there are many independent webs of trust, and any user (through their identity certificate) can be a part of, and a link between, multiple webs.

I want a clearer definition and some example if possible.

share|improve this question

migrated from crypto.stackexchange.com Jun 19 at 15:42

This question came from our site for software developers, mathematicians and others interested in cryptography.

marked as duplicate by schroeder, Xander, Mark, Rory Alsop Jun 19 at 21:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
What research have you done? We expect you to do some research before asking. There's lots of material on this subject in standard places (e.g., the Internet, Wikipedia, crypto textbooks). –  D.W. Jun 18 at 21:45
    
I agree with the critics of @D.W. Anyways I think this should be moved to Security SE (flagged it). –  DrLecter Jun 18 at 22:01
    
This is a cross post anyway - might as well close here. Amanuel - please do not cross post! –  Rory Alsop Jun 18 at 22:53

1 Answer 1

up vote 3 down vote accepted

You trust A and A tells you that K is the key of B. Therefore, you believe that K is the key of B. Of course, this can be extended to indirect chains. For example if you trust the judgement of A, you can specify that you also trust anyone that A trusts.

PGP users sometimes also have key signing events. The idea is that you show up and prove your credentials to other people at the event who will then sign your key. This now means that whoever trusts someone at the event that signed your key, can check the signature of your key made at the event and thus verify that the key they found online actually is your key.

These trust relationships form a network and this is your "Web of Trust".

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.