Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they can verify its origin after they leave my site.

Unfortunately I get the error

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

I roughly understand what it means, although I am unsure of a method to give my server's public key while maintaining trust.

Do I have to "sign" the public key that is exported (and then supplied to the user) with the user to whom it was exported?

What are some simple methods to provide this trust?

I've read about keyservers and frankly that is not really an option for me, I am unsure of how I can get this to work.

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

Basically the problem is a matter of trust.

When you sign a file, someone needs to retrieve your public key to check the signature, but how can they be sure that this is really your signature?

GPG provide a way to do that called the Web of trust. For example, let's say you are Bob and want to discuss with Alice. You already know Ted, which is a friend of yours and you already exchanged key to discuss using GPG. You know that Ted knows Alice too. So you can ask him to give you Alice's public key and sign it. Thus when you read this key, you can check Ted's signature to be sure the key is valid.

Of course, you must have faith that Ted will behave correctly and not sign anything blindly.

So in your case, you cannot avoid this warning. The user has to be able to retrieve the key in a way he finds secure, so that he can mark this key as trusted. Unless you know other people who knows your client and can sign your key for the new client. Bu definitely, self signed key are useless (I can make false and sign with it).

share|improve this answer
    
I can supply the key through https (separate from each download, a link to) and then the public key cannot be falsified or tampered with to what SSL/TLS and its certificate authentication will allow/ensure. I will just write a note stating that it will warn, as I am sure they'll understand that it on the server is secure enough. –  Ken Bachmann Sep 5 '11 at 8:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.