3 ms·

Emailing somebody your public key sounds like a really bad idea. What about your friend's evil sysadmin who replaces the public key that you sent with another

Emailing somebody your public key sounds like a really bad idea. What about your friend's evil sysadmin who replaces the public key that you sent with another one, thereby enabling MITM? You might as well not use PGP in that case. Of course, once your friend has established that it was indeed your public key, it's all fine, but doing initial key exchange over unauthenticated channels sounds like a recipe for disaster.

ClintEhrlich 11y ago
I haven't fully figured out the solution (if I had, I'd be writing it), but I suspect it will ultimately involve the widespread availability of smartphones and laptops with the capacity to record and transmit video. For the time being, the human face and voice are a fairly robust medium for embedding data in a way that is resistant to MITM.
mitchtbaum 11y ago
> What about your friend's evil sysadmin who replaces the public key that you sent with another one, thereby enabling MITM? You could also send with it detached key signatures from mutually trusted friends. This would add weight to your claim that this key belongs to you. Then, your recipient can check that your message's contents (including your pubkey) are signed by a key that your receiver can adequately measure authenticity. Does that seem right? If a hostile MITM modifies your message and/or your key and signature, then these friend's signatures won't match. If they change these signatures as well, then those won't match the receiver's already trusted keys. [Aside: One other way I have played with was to rate another signed message by a friend (who sent me his pubkey as an email attachment) with a likelihood that he wrote it, and then I checked if that message's signature matched. As a qualitative heuristic test, it did increase my confidence in that key significantly, though I would have liked to have some trusted 3rd parties witness his possession of it.]

ClintEhrlich 11y ago

I haven't fully figured out the solution (if I had, I'd be writing it), but I suspect it will ultimately involve the widespread availability of smartphones and laptops with the capacity to record and transmit video. For the time being, the human face and voice are a fairly robust medium for embedding data in a way that is resistant to MITM.

mitchtbaum 11y ago

> What about your friend's evil sysadmin who replaces the public key that you sent with another one, thereby enabling MITM? You could also send with it detached key signatures from mutually trusted friends. This would add weight to your claim that this key belongs to you. Then, your recipient can check that your message's contents (including your pubkey) are signed by a key that your receiver can adequately measure authenticity. Does that seem right? If a hostile MITM modifies your message and/or your key and signature, then these friend's signatures won't match. If they change these signatures as well, then those won't match the receiver's already trusted keys. [Aside: One other way I have played with was to rate another signed message by a friend (who sent me his pubkey as an email attachment) with a likelihood that he wrote it, and then I checked if that message's signature matched. As a qualitative heuristic test, it did increase my confidence in that key significantly, though I would have liked to have some trusted 3rd parties witness his possession of it.]