Why CAs or public keysigning?

[Kyle Hasselbacher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Jun 18, 2003 at 05:08:34PM +0200, Peter L. Smilde wrote:

>The problem I stated was not: "Do I trust the signers of a key". For
>this problem I assume I DO TRUST the CA or at least some of the keyparty
>signers. So I believe they have checked the ID of the person carefully.
>
>My problem is different: even WHEN I trust that they have checked a
>person, I cannot be sure that they checked the person I want to
>communicate with. This problem occurs as soon as duplicate names are
>possible.

Do I understand this correctly?  The situation you're talking about is:

- - I want to communicate with Peter Smilde (e.g.)
- - I get a key that says "Peter Smilde" on it.
- - It's signed by someone I trust (e.g., a CA)
- - The key belongs to a REAL Peter Smilde who is NOT the one I intend.
- - The problem is...
  - I send this stranger private info meant for the intended Peter Smilde.
  - A message meant for the intended Peter Smilde fails to get there.

It's hard to imagine the "false" Peter Smilde doing something malicious at
this point, but maybe I'm playing the Pollyanna here.  If I don't know my
intended recipient personally, I can't see that my communication would be
important enough to worry about this attack.  If I DO know the recipient
personally, this is easy to defend against (send an initial message
confirming the identity; ask something like "how did we meet?").

Also, it's hard to imagine this attack being deliberate.  I could imagine
someone making a fake ID for the purpose of getting a trusted signature on
a key, but that's not the situation we're talking about (different person
who REALLY DOES have the same name), or is it?
- -- 
Kyle Hasselbacher | "One Architecture, One OS" also translates as
kyle@toehold.com  | "One Egg, One Basket".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+8Jbz10sofiqUxIQRAqMrAKDUT/czI9mv5H9t8zeQoMPj8S4mtACgwviF
hiDhCaDIw7F3cAH3Tpgd4z4=
=5fAc
-----END PGP SIGNATURE-----