4 ms·

I tried to use gnupg but can't wrap my head around the web of trust. My main concern of WoT: What my signature of an other guy's public key actually means? My t

by leni536 11y ago

I tried to use gnupg but can't wrap my head around the web of trust. My main concern of WoT: What my signature of an other guy's public key actually means? My takeaway is that there is an implicit statement that you sign, but I don't really know what it is. According to the gnupg privacy handbook[1] this statement is roughly "I trust that this guy can properly sign other stuff" which is kind of recursive, but I like it. But when you validate if a message is really written buy a guy named John Doe then the trust path doesn't actually verify this. The trust path verifies that this guy who claims to be John Doe is good at signing other guy's keys. I don't care about that at this point. Of course people don't actually think of the statement written in the privacy handbook, they implicitly sign the statement "I trust that this guy can properly trust other stuff and I know that this guy's name is what he currently has as an ID.". There are several problems with this in practice: - Now you are signing two statements with one signature and you can't separate the two. Now using anonymous public keys becomes tricky as you lose one half of your statement. - Signing the id happens at the wrong place. Malory can revoke her identity than push "Barack Obama" as her new id, now she can send messages in the name of the president. Of course in practice it's hard, because you can't delete revoked ids from key servers. But at this point you trust the key servers. I thought that key servers are not trusted part of PGP. - gnupg guys advocate key signing parties: you gather at one place, bring your ID then sign each other's keys. The problem with this that you only verify half of your statement (id). The other half is tricky to verify (Can this guy properly protect his priv key? Will this guy just randomly sign everything he sees?), I think it makes more sense to trust a friend who you already know well. Of course there are trust levels and I think you should only use marginal trust at these parties, however I don't know what's the practice. - There are keys that are not tied to people, they are typically tied to software packages. Now what does it mean when someone signs such a key? Take putty as an example. Its master key is signed by several people. Each signature could mean that "this is the putty project's master key that is used to sign the binaries themselves" which can be verified by the given guy knowing the developer and that he is trustworthy (at this point PGP is misused though, the guy should have signed the developer's key instead and only the developer should sign the binary signing key, but it would make trust paths longer). It could also mean that "I trust that PuTTY is a great software and doesn't do anything nasty behind your back" which requires an entirely different verification. In the end the trust path a way too simplified projection of these statements and most likely you can't actually verify the statement that you care about. [1] https://www.gnupg.org/gph/en/manual.html#AEN282 https://www.gnupg.org/gph/en/manual.html#AEN282

viraptor 11y ago
I don't think pgp ever can provide validation that some person owns some email address. You're signing the uid/address on a key which people prove they control. You can ask them to send you a signed message from that address to prove it, but if they owned someone's key, they likely have access to the email too. Even if they don't emails are still very easy to spoof. Regarding changing the uid, your scenario cannot happen (if I understand it correctly): you sign uids, not the keys themselves. That means you can sign specific uids. If they delete it and add another uid, it's not signed anymore. (also you can revoke signatures if someone starts misbehaving)
- leni536 11y ago
  I really don't mean the email address but the real name. People normally verify real names when they sign someone else's key anyway. Of course there is the problem that real names are often not unique. Email address spoofing is too easy, I don't think that "owning" an email address is reasonably verifiable. I wasn't aware that people sign each others uid. What happens if someone's name legally changes? Does he/she have to rebuild his/her WoT? Of course you can send out an email from your old id that you name is changing.
  - mikekchar 11y ago
    "Signing a key" really means signing the binding of a uid to a public/private key pair. I had to look at the Open PGP spec to figure that out ;-) The question is, how to do verify that a particular person is exclusive owner of a uid? Because the uid is just a piece of text, there is no general way that will work every time. It depends on what the uid is. Someone could put their Passport number in the uid and you could check the passport to verify that they own it. Of course most people use an email address as a uid. There are some key exchange protocols that will give you a pretty good idea that someone controls an email address (although they may not be exclusive owner). Basically you email them with some information and then they email you back with an encrypted version of that information. While they can spoof sending the email, they can't easily receive the original information to encrypt it. Generally speaking, online, email uids are what is most useful. You need to know that the person who sent the message has access to the email address in the uid. But if you are actually concerned about the identity of the person, passport numbers, etc are better uids. A key can actually have many uids. You can add new ones at any time. But if you do, you need to get people to sign the new uids (because while they may trust that you control one uid, they still need to verify that you actually control the other uid). How you decide that the uid is owned by the owner of the key is up to you and you are free to sign or not sign any key. The web of trust comes where someone else has signed the uid on a key. There is a kind of second order level of trust with that signature. If my buddy Fred has signed the uid, and I am absolutely sure that Fred will never sign a uid without making sure that it is owned by the owner of the key, then I will probably trust it. But if my buddy Carl signs it, I might think "Carl is not diligent enough to check it out", so I might not trust it as much. How you assign trust of third parties to sign appropriately is up to you (and you do it for each of the third party keys that may have signed something). I hope that helps!

by leni536 11y ago

viraptor 11y ago

I don't think pgp ever can provide validation that some person owns some email address. You're signing the uid/address on a key which people prove they control. You can ask them to send you a signed message from that address to prove it, but if they owned someone's key, they likely have access to the email too. Even if they don't emails are still very easy to spoof. Regarding changing the uid, your scenario cannot happen (if I understand it correctly): you sign uids, not the keys themselves. That means you can sign specific uids. If they delete it and add another uid, it's not signed anymore. (also you can revoke signatures if someone starts misbehaving)

leni536 11y ago
I really don't mean the email address but the real name. People normally verify real names when they sign someone else's key anyway. Of course there is the problem that real names are often not unique. Email address spoofing is too easy, I don't think that "owning" an email address is reasonably verifiable. I wasn't aware that people sign each others uid. What happens if someone's name legally changes? Does he/she have to rebuild his/her WoT? Of course you can send out an email from your old id that you name is changing.
- mikekchar 11y ago
  "Signing a key" really means signing the binding of a uid to a public/private key pair. I had to look at the Open PGP spec to figure that out ;-) The question is, how to do verify that a particular person is exclusive owner of a uid? Because the uid is just a piece of text, there is no general way that will work every time. It depends on what the uid is. Someone could put their Passport number in the uid and you could check the passport to verify that they own it. Of course most people use an email address as a uid. There are some key exchange protocols that will give you a pretty good idea that someone controls an email address (although they may not be exclusive owner). Basically you email them with some information and then they email you back with an encrypted version of that information. While they can spoof sending the email, they can't easily receive the original information to encrypt it. Generally speaking, online, email uids are what is most useful. You need to know that the person who sent the message has access to the email address in the uid. But if you are actually concerned about the identity of the person, passport numbers, etc are better uids. A key can actually have many uids. You can add new ones at any time. But if you do, you need to get people to sign the new uids (because while they may trust that you control one uid, they still need to verify that you actually control the other uid). How you decide that the uid is owned by the owner of the key is up to you and you are free to sign or not sign any key. The web of trust comes where someone else has signed the uid on a key. There is a kind of second order level of trust with that signature. If my buddy Fred has signed the uid, and I am absolutely sure that Fred will never sign a uid without making sure that it is owned by the owner of the key, then I will probably trust it. But if my buddy Carl signs it, I might think "Carl is not diligent enough to check it out", so I might not trust it as much. How you assign trust of third parties to sign appropriately is up to you (and you do it for each of the third party keys that may have signed something). I hope that helps!