Questions tagged [web-of-trust]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
26 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
0
votes
0answers
67 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
2
votes
1answer
54 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
0
votes
1answer
53 views

What happens if my private key gets stolen in the web of trust?

If I'm a trusted user in the web-of-trust but my private key gets stolen by Eve, how would other users find out that my key is compromised and thus cannot be trusted anymore? Is there a way for them ...
2
votes
1answer
84 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
1answer
76 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
2
votes
1answer
75 views

Is it responsible to sign an OpenPGP key without verifying person's identity?

I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my ...
4
votes
1answer
319 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
5
votes
1answer
584 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
0
votes
1answer
172 views

Is gnupg's tsign compatible with S/MIME

GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
2
votes
1answer
583 views

PGP trust model

Given Alice has signed Bob's key, and Bob has signed Chloe's key, Alice would like to send Chloe a secure e-mail using Chloe's key but Alice cannot check Chloe's key physically. Instead Alice could ...
1
vote
1answer
158 views

Why does a Revoked PGP Key show under my Valid Key?

TL;DR As you can see, I revoked keyid 178AA2B7 recently. pub 4096R/178AA2B7 2014-08-13 sig revok 178AA2B7 2014-08-13 __________ __________ [selfsig] Fingerprint=321F 31A7 BB1B ...
0
votes
1answer
367 views

PGP legitimacy calculation

While studying PGP I started to doubt how to calculate the legitimacy/validity of a key. The problem comes when we set that key legitimacy is calculated as the weighted sum of the trust values. What ...
4
votes
2answers
102 views

Can PGP's Web of Trust be used to learn more about a person than just their identity?

Let's assume, that my PGP key has been signed by some number of people and vice-versa. Also, that the keys and signatures were published to the keyserver. My understanding is that a random person ...
0
votes
1answer
76 views

How to know if locally installed programs (like Re Image) are malware

Not sure where to ask this question but figured I'd ask it here, at least in a generic way. I installed a program called Re Image as I red it helps with system instability problems. However, I then ...
10
votes
2answers
2k views

What is the meaning of GnuPG's --list-sigs output?

gpg --list-sigs gives me somethings like the following (I edited the output only to show the interesting/different rows): pub 2048R/4ACE309C 2016-11-01 uid lala_test2 <lala2@...
1
vote
1answer
346 views

How can I verify if a person is in my web of trust?

Lets say I trust person A (whose public key is in a key server) and I want to know if I can also trust person B (pub key is also in a key server). How can I verify that I have a chain of trust ...
1
vote
1answer
57 views

Verifing the first link in the apt-get verification chain

I'm asking myself the following question lately: How do you really know, that you've installed the package you ordered under debian/ubuntu with the use of APT? I think I understood the basics of the ...
2
votes
1answer
85 views

How to verify a signature against a 3rd-party keyring without any trust anchor?

Suppose there is a program and an OpenPGP signature on a website. A user downloads both signature and a program and needs to check if it is the same program the author meant to publish, not modified ...
4
votes
1answer
96 views

Signing UIDs which do not belong to a RL person with full name

Sometimes I am asked to sign pseudonymous UIDs or see PGP keys which belong to organizations rather than single persons. These, by nature, do not contain the name of a real life person; hence there is ...
2
votes
1answer
132 views

Automatically finding and fetching signature paths from own key to target

This is a question about usage of Web of Trust. Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which ...
5
votes
1answer
1k views

Sign GnuPG master key with own X.509 certificate?

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust? To be more specific: Can I use my X.509 certificate to sign my personal GnuPG master key? Will ...
2
votes
1answer
65 views

Using the middle name instead of first name for OpenPGP?

I'm just getting started with OpenPGP. I've generated a key, talking to (very few) friends involved with the technology. But I have a concern: I go by my middle name (with all emails, friends, etc.) ...
3
votes
2answers
271 views

PGP Key Signing Robot DKIM Verified Emails

It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities. The idea would be to ask people to send a key ...
1
vote
1answer
94 views

How is the signing of an OpenPGP public key realized technically?

I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
1
vote
1answer
125 views

Are PGP/GnuPG trust information transferred to key servers?

When signing a key X in the PGP Web of Trust model, I assign the key full validity. Other people who have my key in their key ring can regard X as valid as far as they fully trust me (owner trust). ...
10
votes
3answers
450 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
1
vote
1answer
195 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
7
votes
1answer
308 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of them....
3
votes
3answers
199 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
2
votes
2answers
1k views

GPG Web-of-Trust Level [duplicate]

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
5
votes
2answers
336 views

Is an anonymity network like Tor viable on top of the GPG web of trust?

The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign ...
1
vote
1answer
2k views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
12
votes
2answers
7k views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
6
votes
4answers
838 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature"...
4
votes
1answer
46 views

safely changing distribution, is there a strategy to get an distro iso image untampered?

I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system. Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
12
votes
3answers
2k views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
6
votes
3answers
713 views

Why can't PGP/GPG Web-of-Trust be automated?

We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
6
votes
3answers
1k views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
34
votes
2answers
4k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
6
votes
3answers
6k views

What is the web of trust?

I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible ...
0
votes
1answer
127 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
5
votes
1answer
889 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
2
votes
2answers
397 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does OpenPGP key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
5
votes
1answer
3k views

Is it typical to create both x509 and OpenPGP key pairs?

I'm looking into increasing my use of signed and encrypted "things" - LibreOffice Documents, Off-the-record chat, PDFs, emails, etc. I'm finding that some things only support x509 format-certificates, ...
2
votes
1answer
124 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...