Robot CA at toehold.com

[greg@turnstep.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


David Shaw wrote:
> This is not necessarily true - I wrote a robot which has the same

Sorry - I am not sure which part of my quote is "not necessarily true"?

> I think we want the same thing, but are going about it differently.  I
> want robots and scripts kept out of the web of trust... but if they do
> leak in there, I don't want them excluded from the various web mapping
> programs.  By that point, the damage is done and they are for better
> or for worse part of the web.  Of course, it could be argued that this
> would encourage people to sign robot keys, so perhaps it is indeed
> better to leave them out.  I don't like that as the mappers will then
> show a different web of trust than the real world will.

I do not agree with this: once they are added to the WoT (and they will be, 
all it takes is one misguided/malicious person) we should minimize the damage 
by allowing an option to exclude those keys. Or at the least putting a strong 
warning next to the key if it appears in a path. Bonus points for any program 
that checks if there is an alternate path that does not involve the robot, and 
adds the robot keys as a "path of last resort."


As pointed out earlier, we are mixing the concepts of a CA (and in this example 
without much "authority") and the WoT. Even worse than adding pseudo-CAs to the 
web of trust is adding automated pseudo-CAs. Worse still is automated pseudo-CAs 
that are attached 24-7 to the Internet.


Richard Laager wrote:

> If signing subkeys could be used for key signatures, the robot would
> only need the secret portion of a subkey. If that machine was
> compromised, that subkey could be revoked, and another subkey could
> be used. Also, this would allow for the signing subkey to expire
> without having to expire the main robot key. This provides the
> advantage that those trusting the robot key don't need to worry about
> finding and trusting a new robot key.

Partly, but a robot that has been compromised once is not going to be 
trusted very much. All things signed by the compromised would be useless, 
and future subkeys would not be trusted for fear of another compromise. 
Better to get a new robot at this point!

> Adding this capability would surely break compatibility with other
> OpenPGP applications, right?

Doesn't everything seem to at this point? :)

Greg Sabino Mullane greg@turnstep.com
PGP Key: 0x14964AC8 200212101353

-----BEGIN PGP SIGNATURE-----
Comment: http://www.turnstep.com/pgp.html

iD8DBQE99jh9vJuQZxSWSsgRAs2RAJ95zkSgyb6ZA7KVfCfABMJz+RKDDACdGekt
hMMJ8srrXESHw7oasGEGIpE=
=srnX
-----END PGP SIGNATURE-----