Robot CA at toehold.com

[Jason Harris]

--i9LlY+UWpKt15+FH
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable


[multi-reply]

On Sun, Dec 08, 2002 at 08:26:06PM +0100, Michael Nahrath wrote:
> Jason Harris <jharris@widomaker.com> schrieb am 2002-12-08 19:12 Uhr:
>=20
> > I (0xD39DA0E3) signed Kyle's personal (0x2A94C484) and robot (0xC521097=
E)
> > keys with 0x11/persona signatures because I established that the keys
> > were linked to their specified email/web addresses.
>=20
> Personally I find this insufficient, at least as long as
> <http://keyserver.kjsl.com:11371/pks/lookup?op=3Dvindex&fingerprint=3Don&=
search=3D
> 0x2A94C484> does not display that this was just meant as a "weak signatur=
e"

Notice the 0x11 on the line with my signature - that is the sigclass.

> and GPG inherits trust on these signatures as it does for all others.

> Do you intend to give a "sig!1" to everybody who ever answered to an
> encrypted e-mail you sent to them? They all prooved that their e-mail
> address is valid.

Not at all; I only do so when I have a good reason.

> > If anyone wants to see keyanalyze reports without PGP CA keys being
> > included, the first step is identifying them.  So far, I know about
> > Thawte Freemail (0x5AC41CB9, 0xDE46F54F, 0x6BE9A169, 0x066E6D90,
[snip]

> ct magazine and DFN-PCA have strong policies about this (at least for tho=
se
> I have read them).=20
> If one begins to treat them like any homegrown e-mail validation service,=
 it
> may ruin all the good they have done to build up the strong web of trust =
we
> have now.

Right.  I wasn't passing judgement on any PGP CA.


On Sun, Dec 08, 2002 at 09:39:36PM +0100, Michael Nahrath wrote:
> Kyle Hasselbacher <kyle-list-gpguser@toehold.com> schrieb am 2002-12-08
> 20:24 Uhr:
>=20
> It is hard because those connections _have_ to be strong. Rather have a l=
ot
> of people unconnected (which simply expresses the truth) than lowering the
> meaning of signatures.
>=20
> Weak connections are SPAM to the web of trust.

Please keep in mind that keyanalyze doesn't cryptographically verify
any signatures, such is the domain of GPG.

> 'persona'-signatures might be a solutions but we don't have the adequate
> software to treat 'weak signatures' yet.
>=20
> What you need is a validating keyserver!
>=20
> Current keyserver take and store each key they get, without any tests.
>=20
> Imagine a new generation net of keyservers that don't incorporate keys to
> their database before they have proove that at least the e-mail address
> belongs to the key owner!

Nice idea, but now you're placing too much emphasis on email addresses.
How do you allow for anonymity (and changing email addresses)?

> No signatures are given by the robot for this e-mail verification.
> Geting listed on such a keyserver is proof enough.
>=20
> Check out what happens if you want to upload your key to biglumber.com for
> an example (they don't have expiration yet)!

This helps make sure that people are contactable via email (for
keysignings) and control the keys being listed, which is most
helpful for this type of application.

--=20
Jason Harris          | NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
jharris@widomaker.com | web:  http://jharris.cjb.net/

--i9LlY+UWpKt15+FH
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE988V8SypIl9OdoOMRAm4yAKCKc2UNU5O3LjfwkjHD8tn+U+eZ6QCgp59L
Nq9v8gIyX8LPogpM+HeEPxM=
=bGyC
-----END PGP SIGNATURE-----

--i9LlY+UWpKt15+FH--