Timeline for What's the purpose of a PGP transition statement?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 28, 2017 at 13:59 | vote | accept | CommunityBot | ||
| Jun 27, 2017 at 8:01 | comment | added | Ben | You're assuming that UIDs always contain information that is unique to a single individual, usually one controlling both the key(s) and email address. That isn't always true; it frequently is, but not always (e.g. security addresses for distros). So the transition process factors in that as well as differentiating a key transition from signing any other party's key. | |
| Jun 27, 2017 at 6:34 | comment | added | user151891 | "the dual signature tells recipients that both keys remain under the same person's control and that they do not believe the old key has been compromised at the time the transition statement was made" Does the transition key need to be signed by the new key? Surely the old key still being unrevoked/unexpired is enough to say the key hasn't been compromised? Transitioning can only occur when the old key is unrevoked/unexpired anyway, since otherwise an attacker with access to a revoked key can fraudulently sign a transition statement with the old key, and with a fraudulent new key. | |
| Jun 27, 2017 at 6:28 | comment | added | user151891 | "Which is not something they would do for any key you happened to sign that does not belong to you, regardless of UID conflicts (which may or may not always contain email addresses)." Though some UIDs don't contain email addresses, if two keys do have the same UID (incl email addr), and the old has signed the new, this should be sufficient proof for a person who has signed the old key to sign the new key. However, given signing a transition document is easy, and doing so covers cases in which UIDs don't match, requiring a transition statement seems like the better approach. Thanks! | |
| Jun 27, 2017 at 5:16 | review | First posts | |||
| Jun 27, 2017 at 6:03 | |||||
| Jun 27, 2017 at 5:13 | history | answered | Ben | CC BY-SA 3.0 |