3

This is a question about usage of Web of Trust.

Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which belong to OpenPGP activists (so I'm reasonably sure that now my key belongs to the "strong set" in the worldwide web of trust). So, I've published my key to hkp://keys.gnupg.net and fetched all of the attendees' keys into my local keyring.

At the same time, there are web-sites like http://pgp.cs.uu.nl/, which seem to automate "path finding in the web of trust" — that is, given my key fingerprint and some target key, it queries the key servers and shows all signature paths from my key to the target.

At the same time, its usage requires a big deal of human intervention. If/when I receive a signed message and wish to to verify the signature, I need to:

  • go to that site (the PGP pathfinder);
  • find the signature paths;
  • import all participating keys to my local keyring;
  • verify all these keys and signatures locally, so that I'm protected against rogue keyservers and/or pathfinders.

Another complication is that OpenPGP employs its own specific "trust model", which says that a signature path must fulfill some conditions (depth, trust levels, owner trust and so on) in order to be considered.

This is correct and good practice, but sometimes I want just to check the mere presence of signature paths, without imposing any restrictions on it (which is already better than nothing).

Again, I say that having a trust path is best, but in absence of that, having a signature path is at least somewhat better than having nothing.

Why there isn't a tool (perhaps integrated into GnuPG) which will do that work for me?

Improve this question
1
  • I built a tool to locate keys in the WOT "Strong Set" (search-pgp-wot) and a tool to search your local keychain for any keys signed by an arbitrary key (gpg-keys-signed-by.pl). Unfortunately the first tool relies on the PGP Pathfinder which is now dead.
    – Jonathan Cross
    Oct 31 at 19:39

1 Answer 1

Reset to default
1

Missing Semantics

There are different problems with finding such signature paths. One is the semantics of such a path, signatures of other keys should never be taken into account without the trust into that user considered. Of course, there might be use of such a path anyway, I use the PGP patfinder you mentioned from time to time to derive trust paths, fetching the appropriate keys and issuing trust as I see fit.

Technical Reasons

There's also a technical reason this is not implemented in GnuPG: finding those paths requires knowledge on all keys. GnuPG is not really able to handle those millions of keys. and both fetching and keeping them current will require quite some effort. The PGP pathfinder uses a daily key server dump and performs some preparation work (mostly extracts the underlying network, to speed up queries) to tackle this. This dump is multiple gigabytes in size!

Running Your Own Signature Path Finder

wotsap is a project providing similar analysis, and made the sources available, given you find a current source for the .wot files (providing the network data). Alternatively, you can calculate them from a key server dump on your own using the tools provided by wotsap.

Improve this answer
2
  • In fact, by the "tool" I've meant some form of an API provided by the keyservers and used by GnuPG / some other local tool to make such queries. However, I will take this as "not implemented because nobody thinks this is useful".
    – intelfx
    Dec 21, 2015 at 9:38
  • You should be able to provide one with the tools available within some hours. ;) But yes, it seems nobody cares.
    – Jens Erat
    Dec 21, 2015 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .