Questions tagged [web-of-trust]
The web-of-trust tag has no usage guidance.
55
questions
5
votes
4
answers
204
views
How to understand which website is official for a project?
Let's say I want to download a golang.
How to understand which website is official for a project without referring to a some kind of authority like Wikipedia or a search engine rank?
Is there a ...
- 53
0
votes
0
answers
122
views
Cross signing practice for PGP package signing keys?
I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019).
PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
- 123
0
votes
0
answers
118
views
Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)
For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
- 998
1
vote
2
answers
139
views
How to assess a website's trustworthiness?
How do you assess the trustworthiness of a new website? Especially to download and then install software from.
Edit: My underlying concern is to:
Trust the website.
Trust the website to not inject ...
- 2,290
0
votes
2
answers
192
views
Public key authencity
I have a webapp that sends payloads to clients. I want to sign these payloads so the clients can verify they are from my application. I created a public/private key pair and now need to somehow ...
- 3
4
votes
1
answer
943
views
Validity, Owner Trust, Trust Signatures & Certification Level
Two questions on signatures.
I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
- 338
1
vote
1
answer
285
views
Web of trust and signature types? (sig1, sig2, etc)
I have read about The OpenPGP trust model but I don't see any mention of the specific signature types. Are all signature types (sig0 - sig3) treated the same by tools such as gpg or the PGP ...
- 1,680
1
vote
0
answers
89
views
How does PGP web of trust handle certificate expiration?
I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like.
What happens in two years? When my certificate ...
- 111
1
vote
0
answers
187
views
Root CA key generation compliant with WebTrust and HSM independent
I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to ...
- 1,119
0
votes
0
answers
144
views
What should I do next on my GPG key after my computer is seized by authority?
Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
- 111
2
votes
1
answer
117
views
Wrong pgp key was signed
Someone signed my PGP key, by accident (we have never met, but I know the person a little).
The wrong signature was uploaded to the SKS pool.
Is there anything we can do about it to improve the web ...
- 238
0
votes
1
answer
120
views
What happens if my private key gets stolen in the web of trust?
If I'm a trusted user in the web-of-trust but my private key gets stolen by Eve, how would other users find out that my key is compromised and thus cannot be trusted anymore? Is there a way for them ...
- 103
3
votes
1
answer
225
views
Why do people check the passport on key signing events?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
- 131
2
votes
1
answer
182
views
Is there a maximum for the number of certifications on a PGP public key
My question is about openPGP and the GnuPG implementation in particular.
The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
- 550
4
votes
1
answer
165
views
Is it responsible to sign an OpenPGP key without verifying person's identity?
I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my ...
- 243
4
votes
1
answer
755
views
Is an OpenPGP signature made before a key is revoked considered valid?
If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
- 243
5
votes
1
answer
1k
views
How should I choose a trust model in GnuPG?
GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use.
Ideally, I would like a trust model that accepts the trust I explicitly ...
0
votes
1
answer
312
views
Is gnupg's tsign compatible with S/MIME
GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
- 103
2
votes
1
answer
1k
views
PGP trust model
Given Alice has signed Bob's key, and Bob has signed Chloe's key, Alice would like to send Chloe a secure e-mail using Chloe's key but Alice cannot check Chloe's key physically. Instead Alice could ...
- 381
1
vote
1
answer
332
views
Why does a Revoked PGP Key show under my Valid Key?
TL;DR
As you can see, I revoked keyid 178AA2B7 recently.
pub 4096R/178AA2B7 2014-08-13
sig revok 178AA2B7 2014-08-13 __________ __________ [selfsig]
Fingerprint=321F 31A7 BB1B ...
- 113
0
votes
1
answer
1k
views
PGP legitimacy calculation
While studying PGP I started to doubt how to calculate the legitimacy/validity of a key. The problem comes when we set that key legitimacy is calculated as the weighted sum of the trust values.
What ...
- 103
3
votes
2
answers
161
views
Can PGP's Web of Trust be used to learn more about a person than just their identity?
Let's assume, that my PGP key has been signed by some number of people and vice-versa. Also, that the keys and signatures were published to the keyserver.
My understanding is that a random person ...
- 135
0
votes
1
answer
122
views
How to know if locally installed programs (like Re Image) are malware
Not sure where to ask this question but figured I'd ask it here, at least in a generic way. I installed a program called Re Image as I red it helps with system instability problems. However, I then ...
- 10.1k
13
votes
2
answers
5k
views
What is the meaning of GnuPG's --list-sigs output?
gpg --list-sigs gives me somethings like the following (I edited the output only to show the interesting/different rows):
pub 2048R/4ACE309C 2016-11-01
uid lala_test2 <lala2@...
- 339
1
vote
1
answer
761
views
How can I verify if a person is in my web of trust?
Lets say I trust person A (whose public key is in a key server) and I want to know if I can also trust person B (pub key is also in a key server).
How can I verify that I have a chain of trust ...
- 339
3
votes
1
answer
125
views
Verifing the first link in the apt-get verification chain
I'm asking myself the following question lately: How do you really know, that you've installed the package you ordered under debian/ubuntu with the use of APT?
I think I understood the basics of the ...
2
votes
1
answer
275
views
How to verify a signature against a 3rd-party keyring without any trust anchor?
Suppose there is a program and an OpenPGP signature on a website. A user downloads both signature and a program and needs to check if it is the same program the author meant to publish, not modified ...
- 912
4
votes
1
answer
189
views
Signing UIDs which do not belong to a RL person with full name
Sometimes I am asked to sign pseudonymous UIDs or see PGP keys which belong to organizations rather than single persons. These, by nature, do not contain the name of a real life person; hence there is ...
- 141
3
votes
1
answer
351
views
Automatically finding and fetching signature paths from own key to target
This is a question about usage of Web of Trust.
Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which ...
- 133
7
votes
1
answer
3k
views
Sign GnuPG master key with own X.509 certificate?
Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust?
To be more specific:
Can I use my X.509 certificate to sign my personal GnuPG master key?
Will ...
- 411
2
votes
1
answer
115
views
Using the middle name instead of first name for OpenPGP?
I'm just getting started with OpenPGP. I've generated a key, talking to (very few) friends involved with the technology. But I have a concern: I go by my middle name (with all emails, friends, etc.) ...
- 21
3
votes
2
answers
526
views
PGP Key Signing Robot DKIM Verified Emails
It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities.
The idea would be to ask people to send a key ...
- 419
1
vote
1
answer
169
views
How is the signing of an OpenPGP public key realized technically?
I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
- 113
2
votes
1
answer
227
views
Are PGP/GnuPG trust information transferred to key servers?
When signing a key X in the PGP Web of Trust model, I assign the key full validity. Other people who have my key in their key ring can regard X as valid as far as they fully trust me (owner trust).
...
- 535
12
votes
3
answers
671
views
Why don't PGP keyservers enforce double-opt-in?
One thing that I found out when starting using PGP:
When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be.
Since a PGP key contains ...
- 8,914
1
vote
1
answer
379
views
Web of Trust: What is "signatory trust"?
I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust.
What is an easily understandable definition of signatory trust? An ...
- 513
7
votes
1
answer
419
views
Help - Somebody stole my OpenPGP key ID, what can I do?
I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of them....
- 24.4k
3
votes
3
answers
306
views
Email Encryption
I'm hoping someone can point me in the right direction.
If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
- 131
2
votes
2
answers
2k
views
GPG Web-of-Trust Level [duplicate]
(and really sorry for my english)
I have a question about Web-of-Trust of GPG.
Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
- 121
6
votes
2
answers
454
views
Is an anonymity network like Tor viable on top of the GPG web of trust?
The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign ...
- 243
1
vote
1
answer
3k
views
What is the difference between "unknown" and "undefined" trust?
When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools):
1 = I don't know or won't say (undefined)
2 = I do NOT ...
- 6,775
22
votes
2
answers
17k
views
What is the difference between "full" and "ultimate" trust? [duplicate]
When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools):
1 = I don't know or won't say (undefined)
2 = I do NOT ...
- 6,775
8
votes
4
answers
2k
views
Is the PGP Web of Trust / Keyserver infrastructure permanently broken?
I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature"...
- 1,349
4
votes
1
answer
84
views
safely changing distribution, is there a strategy to get an distro iso image untampered?
I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system.
Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
- 1,442
17
votes
3
answers
3k
views
What are you saying when you sign a PGP key?
When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?
To explain what I mean, take the following two ...
- 6,775
6
votes
3
answers
1k
views
Why can't PGP/GPG Web-of-Trust be automated?
We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
- 61
7
votes
3
answers
2k
views
"Web of trust" for self-signed SSL certificates?
SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate.
...
- 1,349
38
votes
2
answers
5k
views
If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?
Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
- 1,349
0
votes
1
answer
932
views
What is "web of trust" in PGP and S-MIME? [duplicate]
I'm studying network and system security and I came across the phrase Web of Trust:
In cryptography, a web of trust is a concept used in PGP, GnuPG, and
other OpenPGP-compatible systems to ...
- 235
13
votes
3
answers
12k
views
What is the web of trust?
I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia:
In cryptography, a web of trust is a concept used in PGP, GnuPG, and
other OpenPGP-compatible ...
- 235