2

Given Alice has signed Bob's key, and Bob has signed Chloe's key, Alice would like to send Chloe a secure e-mail using Chloe's key but Alice cannot check Chloe's key physically. Instead Alice could rely on Bob's key to check Chloe's key validity. Now for Chloe's key to be validated by Alice, it should fulfill two conditions :

1- It has been signed by one fully trusted key, or it has been signed by three marginally trusted keys; 2- There is at most five hops between Alice and Chloe.

My question concerns condition 1 : Does Bob's key have to be the one to be fully trusted by Alice or does Chloe's key have to be the one to be fully trusted by Bob or both ?

P.S. I have based my understanding of PGP trust model on this link

Improve this question
1
  • I just want to point out that you as a user also can simply look at the key and it’s signatures and decide for the message at hand how far you trust it. That’s far more flexible than trying to formulate a threshold.
    – eckes
    Oct 26, 2017 at 5:46

1 Answer 1

Reset to default
1

Bob's key has to be the one fully trusted by Alice. By fully trusting Bob's key, Alice is saying that she'll trust whatever Bob trusts.

In the "Marginal Trust" idea, if Alice "marginally trusts" person "A", "B", and "C", and person A, B, and C trust Chloe's key, then you trust Chloe's key. This is because at least 3 people you marginally trust (person A, B, and C) trust Chloe's key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .