4 ms·
Does it? For a key to be considered valid it must be either ultimately trusted, signed by ultimately trusted key or one fully trusted valid key or 3 marginally
by Boulth 8y ago
Does it?
For a key to be considered valid it must be either ultimately trusted, signed by ultimately trusted key or one fully trusted valid key or 3 marginally trusted valid keys.
It seems to me there are only two properties to track and quite easy calculation to do (fizz buzz level).
- jandrese 8y agoThat's already three conditions, and those spider up to the conditions above. It's like ACLs. On the surface they seem so easy, but in practice they're a nightmare to manage because you have to track so many dependencies to figure out a simple yes/no question.
- Boulth 8y agoThere is one assigned property (trust) one relations table (signing key, signed key) and one computed property (validity, the output) and one condition. I'd be very happy to see a simpler solution to the problem of decentralized authenticity. Some projects do rely on Web of Trust, for example Linux kernel (https://www.kernel.org/signature.html#kernel-org-web-of-trust https://www.kernel.org/signature.html#kernel-org-web-of-trus...) or Arch Linux (https://www.archlinux.org/master-keys/ https://www.archlinux.org/master-keys/).