4

Sometimes I am asked to sign pseudonymous UIDs or see PGP keys which belong to organizations rather than single persons. These, by nature, do not contain the name of a real life person; hence there is no obvious way of verifying such identities. (One method I was offered was proving ownership of a domain related to the UID by making a signed document available on that domain, but I couldn't decide if this was enough.)

There are, however, reasons to include such keys (at least those of organizations) in the web of trust, for example a software release signing key should rather have some signatures on it. What would be a decent way of validating such identities (or: under which conditions could such an ID be declared as "verified")?

Improve this question
1
  • Well, at least human name changes (if they can be changed at all in the jurisdiction), have an inherent rate limitation, even if you just change some of the official documentations, bills or bank accounts. Domains (and companies) can change owners within hours, and might be taken over for long periods of time - like if you have control for the domain that another domain uses for its DNS servers, so I would not like to sign those for unknown people. It can help to clarify up front, perhaps by publishing your Certificate Practice Statement beforehand.
    – chexum
    Dec 25, 2015 at 14:25

1 Answer 1

Reset to default
1

First of all: what to sign or not to sign is completely up to you. There are no fixed rules on how to verify IDs, nor whether to sign nick names or not. From RFC 4880, Signature Types:

[...] Please note that the vagueness of these meanings is not a flaw, but a feature of the system. Because OpenPGP places final authority for validity upon the receiver of a signature, it may be that one signer's casual act might be more rigorous than some other authority's positive act. [...]

From experience, the usual expectation is probably to only sign verified real names. Can you reason signing pseudonyms, what is the semantics of such a certification? A pseudonym is a self-assigned identity, which cannot really be verified. There might well be use cases; consider a group of people only knowing each other under their pseudonyms, which do not want to reveal their real identity, like a group resisting governmental oppression.

In the end, it's up to you to decide what to sign or not to sign. It might be reasonable to provide a certification policy explaining how you sign other's keys. This will enable others to understand how you verify identities and what you sign, so they can take use of your certifications when searching for trust paths (given they trust you/your key).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .