Corporate public key?

[CL Gilbert]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Neil Williams wrote:
| On Tuesday 08 Jul 2003 6:13 pm, malsyned@dennisx.cif.rochester.edu wrote:
|
|>On Tue, 8 Jul 2003, Daniel Carrera wrote:
|
|
|>An ING corporate key has added power when the WoT is taken into
|>consideration.  If ING's signing policy states that an ING signature on a
|>key means that the individual is an authorized agent of ING, you can be
|>sure that when you receive a communication from anyone who's key bears
|>ING's signature, that person is authorized to act on behalf of ING.
|
|
| I've imported public keys with some 700 signatures, but for WoT to
work at the
| customer end, wouldn't every customer (including potential customers
who may
| be turned down for loans, credit etc.) have to sign the corporate ING
key?
| That could be a few thousand. A key in my public ring only activates
the WoT
| if there is a path from my key to the target key (of a short-ish
length). The
| path cannot begin until I've signed the ING key or a key that has also
signed
| the ING key. Is it practical to put in the policy that customers only
sign
| the ING key as non-exportable? Or must ING maintain the key and delete
| customer exportable signatures?
|
|

You shouldnt have to sign the key, it serves no purpose.  Just mark it
as trusted and you wont get the warnings.  but after all they are just
warnings.

The key holder should have no problem scraping off junk signatures.  I
hope this is how the WoT works.  They really dont hurt anything, but
that would be a nasty performance hole/exploit to harm the overall
system and create confusion.  easily one could make a key excessively
large and unwieldly.

|
|>Perhaps their UID would contain their corporate title:
|>
|>uid  John Smith (Vice President of Security) <jsmith@ing.com>
|>sig    ING Corporation <ing@ing.com>
|>
|>So now, when John Smith tells you he works for ING and that your loan was
|>approved, you know it's true.
|
|
| The UID details are not exactly hard to forge, the security should
really be
| left to the fingerprint and signatures. If the email is signed (or
preferably
| signed and encrypted). then the contents of the email, including the
address
| and contact details of the person at ING, can be verified with the
signature
| - bad signature and the customer must ask for confirmation from a central
| support address at ING.
|
|
|>This use of the WoT along with a corporate signature means that very few
|>people (perhaps just a guy in IT and a guy in HR) need access to
|>ING's main private key in order to sign new employee's keys and revoke
|>signatures on former employees when they leave the company.
|>I'm a CS undergrad and an expert in nothing, but to me this seems like a
|>good and workable idea.
|>
|>--Dennis Lambe
|
|
| Just how practical ING will see it, we can only wait.
|


- --
Thank you,


CL Gilbert
Free Java interface to Freechess.org
http://www.rigidsoftware.com/Chess/chess.html
"Then said I, Wisdom [is] better than strength: nevertheless the poor
man's wisdom [is] despised, and his words are not heard." Ecclesiastes 9:16

GnuPG Key Fingerprint:
82A6 8893 C2A1 F64E A9AD  19AE 55B2 4CD7 80D2 0A2D
GNU Privacy Guard http://www.gnupg.org
Pretty Good Privacy (PGP) http://web.mit.edu/network/pgp.html, windows
users should try that.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/CyQRVbJM14DSCi0RArVUAKCroPNTXqHnpDc/3VyASUbm9pLoigCfRJeB
ziIL73jEhdqzmq0uxQ9r50I=
=j7Vv
-----END PGP SIGNATURE-----