signing a robot's key - was: Re: Global Directory signatures

[Atom 'Smasher']

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, 30 Dec 2004, Jeff Fisher wrote:

> It's signing keys left and right, which started this whole discussion. 
> Is there any doubt that this particular key is anything but what it 
> purportes to be?  If so, where are the real signatures from the real key 
> that is supposed to be fullfilling this role?
>
> For most of us, we're assuming that there is not an adversary with 
> infinite resources out to get us.  If there were, I would not trust any 
> signatures except my own, or those of personally trusted associates. 
> (And probably not gnupg itself or this computer, but there it is...)
===============================

i (or anyone) can generate a key that's identified as "PGP Global 
Directory Verification Key" and sign any number of keys with it. one can 
even get a list of keys that have exchanged signatures with the real key 
and sign all of them. that doesn't make it the real thing, but it sure 
would cause a lot of confusion.

if i sign your key, and you sign bob's key, that doesn't mean that i 
should go and sign bob's key (unless i first verify it with bob). sure, i 
can trace a path from me to bob, but that's very different than signing 
bob's key because of that path.

signing a key is a statement that one has checked and verified that the 
key really belongs to the person or group identified by the key. unless 
that verification is actually done, the only statement being made is that 
someone is issuing bad signatures.


- -- 
         ...atom

  _________________________________________
  PGP key - http://atom.smasher.org/pgp.txt
  762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
  -------------------------------------------------

 	"Politics is the art of preventing people from taking part
 	 in affairs which properly concern them."
 		-- Paul Valery

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
Comment: What is this gibberish?
Comment: http://atom.smasher.org/links/#digital_signatures

iQEcBAEBCAAGBQJB1HnVAAoJEAx/d+cTpVciDm8H/j7ANhOKH4cbi0i8v9K73+iq
+ps/mCVnuW7YLNgCMlf9FPtwlmroTxrlbdHe4aOEZpl+Kq/DnyoslBwbX3qztVjg
9v/TXww1WlEA69208u9EJVU97wMe7EdAIg+X2UxQspJt+sB2Tp3+k7SOQ1FD5z1O
mzoFCsGox5KpICospbSpG4DBlm/DzVG9iyvfjrs4gt53PM+eZzSw5DWfyPILuKxz
PZbYhJYhiCn9Jc1spWriuJKdCxfhre7gIuEn5DwPv5PtUjxuMQSi6+wMOCKZLjK/
sTaPEf89M04nxDvEuFIHUMIQ3iGRSoSj1tI32O0P0MrU+BqlvsM1guhwFiuslvw=
=97mN
-----END PGP SIGNATURE-----