Timeline for Is PGP secure against a rogue keyserver?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 23, 2013 at 13:32 | comment | added | AJ Henderson | @Chaos_99 - that is correct, though you could also use a secure primary channel as well if you have one available, though that is also really just moving back the root of trust. (For example, say I had a cryptographically secured line between me and Bob, then I could trust the key sent over it without further verification, but at some point I had to get a trusted secret for that connection.) But you are conceptually correct that at some point, it still comes down to establishing trust the old fashioned way (to whatever level of security is necessary for your purpose.) | |
| Aug 23, 2013 at 13:29 | vote | accept | Chaos_99 | ||
| Aug 23, 2013 at 13:28 | comment | added | Chaos_99 | You are right. But as you have rightly stated, I NEED to get Bob's certificate via a secure channel, or otherwise I couldn't verify that Charlie's certificate was indeed signed by Bob. So to correct myself: I need to obtain every certificate through a secure side channel that I want use as first link in the chain of trust. | |
| Aug 23, 2013 at 13:19 | history | edited | AJ Henderson | CC BY-SA 3.0 |
added 201 characters in body
|
| Aug 23, 2013 at 13:17 | comment | added | AJ Henderson | As far as the behavior of GnuPG, I do not know if it does this or not, but it wouldn't be hard to do manually. Just sign something and then use the public key to verify the signature. | |
| Aug 23, 2013 at 13:12 | comment | added | AJ Henderson | @Chaos_99 - the entire point of a web of trust is that you DON'T have to explicitly obtain and trust every public key (or more accurately every certificate, as the certificate includes the signatures where as the public key is just the key itself). If I get Bob's certificate through a secure channel and I trust Bob to verify people, then Bob can get Charlie's certificate through a secure channel, sign it and now I can trust Charlie's certificate even though I got it through an insecure channel, because I know that Bob verified it already. The same goes for trusting CAs. | |
| Aug 23, 2013 at 9:55 | comment | added | Chaos_99 | Reading you answer over and over I realize it's almost all there. You're just missing the last consequence, which is that you are not only able to, but MUST acquire (or verify) any public key you want to put trust on via a secure side channel, as otherwise you can't be sure that you put that trust on the right key (as you can't validate their signatures without having trusted keys first). Add this and I accept your answer as right. | |
| Aug 23, 2013 at 9:30 | comment | added | Chaos_99 | Is the validation of your public key as you describe it done automatically by GnuPG at any time? | |
| Aug 21, 2013 at 13:33 | history | answered | AJ Henderson | CC BY-SA 3.0 |