Why CAs or public keysigning?

[Peter L. Smilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

What is the worth of signatures from public keysigning-parties or CAs in
face of non-unique names? Especially when only names are checked and
(usually) not (or only superficially) the email-adress.

When I am in direct contact with a person (case 1), then I usually know
he is the person I want to communicate with (so it is not really
necessary to check his identity). In this case I can ask him for the
fingerprint of his key to be sure that I use no fake key of some other
person. So far OK. In this case, I don't need any other signatures.

I only need signatures, when I am not able to check the key fingerprint
personally. When I know that a trustworthy friend of mine has checked
the fingerprint and signed the key (case 2), then finding his signature
on the key makes it very likely, that it is no fake key. Although it is
even better to ask my friend, if the key really belongs to the person I
want to communicate with, because he might have signed a key of a person
with the same name. So far still OK.

It is still OK, when a key has a lot of signatures of people I know to
be friends, collegues, relatives of my communication partner or just
persons I know (an unusal case though) to have been at the same
keysigning-party (case 3). Then I don't have to ask them if he is the
right person, because it is quite unlikely, that another person with the
same name has the same acquitanceship.

But what, when I (or my trustworthy friends) don't have direct contact
with a person and his key has only been signed by CAs or by persons he
only has met on a public keysigning-party (case 4)? That means that his
key has been signed by persons, that I cannot ask personally if the
person they checked really is the person I expect him to be (like case
2) and I cannot recognise any relationship to him (like case 3). Then I
only know (to the extend as anybody can check IDs and to the extend as I
trust the signer), that the person who owns the key really has the name
in the UID. But how do I know that the key belongs to the person I want
to communicate with, in face of the fact that many names are not quite
unique? Often I cannot even be sure that the email-adress of the person
is the one of the person I want to communicate with, because (as I don't
have direct contact with him, as in case 1) I often get adresses from
the Internet, so it might be the adress of some attacker. Secondly the
email adress in the UID is usually not very well checked by signers, so
it might belong to another person than I (and the signer) expect.

The WoT clearly is not responsible for unique identification of persons.
But when I want to communicate securely with a person, I need this
unique identification. In case 1, 2 and 3 this identification is given
with varying quality. In case 3 even with help of the WoT. But in case 4
this unique identification is missing, and I can only solve this by
direct contact with the key owner. But then I could much more easily ask
him for his fingerprint myself, so I don't need the signatures of CAs or
"public keysigners" anymore...

Can anybody give me a good argument for CAs and public keysigning parties?

- --

Peter L. Smilde
Budenheim, Germany
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE+8EnBFCtQzrDkv5kRAipcAKCOcCGqW7AJLYhREaHVwVHt5d/7PwCfYy6N
rnqYHI9h+Vx6ZUvMrcxmAcs=
=fqJG
-----END PGP SIGNATURE-----