Key signing without a fingerprint?
Wed Jan 30 21:37:01 2002
-----BEGIN PGP SIGNED MESSAGE-----
On Wednesday 30 January 2002 13:28, Huels, Ralf SCORE wrote:
> yesterday I met with a guy who had forgotten to bring his key
> fingerprint and we considered the following protocol:
> - I gave him my fingerprint and we exchanged photo ID
> - We agreed an a shared secret - a pass phrase
> - He will send his fingerprint and the shared secret in one message,
> encrypted to my key.
> He gets all the information he needs through the physical printout
> of my fingerprint and I can rely on the pass phrase in the encrypted
> message, assuming that he will guard the shared secret closely.
> He may optionally sign the message as well but as proof of his
> identity lies solely in the shared secret, the signature would not
> give me any additional information.
> Would you consider this sufficient security for signing a key?
Yes and no.
Yes, because this protocol indeed guarantees that it's him who sent you
the fingerprint as long as nobody can spy your shared secret.
No, because you should still check if he really controls the email
addresses he claims to control before you sign his user ids.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
-----END PGP SIGNATURE-----