I have a basic understanding of the "Web of Trust" used in PGP. I would like to know how the "Web of Trust" differs from the "Chain of Trust" that's used for SSL certificates?
Add a comment
|
2 Answers
The primary difference is that PGP does not trust a set of central authorities while SSL does. In SSL the certificate authorities do the required checks and then certify that the identity of the certificate holder is correct for the level of certification. We trust the CA's decisions and trust who they trust.
The different certificate types theoretically correspond to different levels of background checks. For a basic certificate this is as simple as verifying that the requester controls the domain. For an EV this requires significantly more checks (incorporation, place of business etc).
As I am learning PGP, my understanding is the Web of Trust uses votes of trust by peer group members at the same authority level, but using inconsistent verification methods. It is a vote of the people (users).
Chain of Trust uses certifications issued by trusted Certificate Authorities if all the required qualifications of a submitted request are strictly verified to meet different levels or categories of trust. It is a certificate of merit.
Certificate Authorities may have lower level or higher level authority, like government or corporate officials. The King verifies the Prince, the Prince verifies the Count, the Count verifies the Sheriff, etc., and the verification certificates are interlinked in sequence, ranked by authority level.
I have noticed there are now Certificate Authorities for PGP keys. I have a Proton Mail account. I signed up for an account, Proton Mail issued the keys for my account, and they now have a Certificate Authority that signs the keys as an endorsement of trust, using their special email address [email protected].
See Oct 2022 article https://proton.me/blog/why-we-created-protonca
In a similar manner, for my small business, I created special CA email addresses [email protected] and [email protected] to sign keys of employees. This creates a Ladder of Trust from higher authorities, such as the CEO or CISO or Security Officer, rather than a Web of Trust from peers, such as fellow employees or friends or acquaintances at the same trust level.
My business good standing and reputation can be verified for trustworthiness by inspecting the website history for duration, SOS business records, the local BBB directory listing, and a high rating from over 100 customer reviews on Google Maps.
My PGP public key is posted on the business website under Contact Us and on GitHub, both protected by strong passwords and two-factor authentication.