Why CAs or public keysigning?

[Wolfgang Bornath]

** Kyle Hasselbacher (Mittwoch, 18. Juni 2003 18:44)

> If I don't know my intended recipient personally, I can't see that my
> communication would be important enough to worry about this attack. 
> If I DO know the recipient personally, this is easy to defend against
> (send an initial message confirming the identity; ask something like
> "how did we meet?").
>
> Also, it's hard to imagine this attack being deliberate.  I could
> imagine someone making a fake ID for the purpose of getting a trusted
> signature on a key, but that's not the situation we're talking about
> (different person who REALLY DOES have the same name), or is it?

This is all true, also Peter's objections against third party trust.

But let's face the praxis:

1. What do I use keys for?

I use them for signing a message. This verifies that it was really I who 
wrote the message and the message was not changed after I sent it.

I use them to encrypt messages. This verifies the 2 points in the first 
chapter plus hides the contents from third party's eyes.

2. Who do I send signed messages to?

I send them to mailinglists, persons I don't know personally, any 
persons if I want to make sure named points in chapter 1.1.

For this a CA verification is enough because I sent those messages to 
mail addresses rather than real persons (although behind every mail 
address there sleeps a human being - almost).

If the recipient is in doubt he can always mail back for my fingerprint.
Or, as many users do, I put my ascii armored public key on my website 
where one can also find personal information about me (including 
photograph).

3. Who do I send encrypted messages to?

I send them to persons I either stayed in touch to for some time or 
persons I know in RL. In both cases there is already an established 
communication history which makes it easy to exchange fingerprints 
and/or public keys within signed messages or via phone or in RL.

I don't see any reason why I should send an encrypted message to any 
other person. At least I did not find any reason through my years of 
using the private/public key system (first pgp, then gnupg).


IMHO this discussion may be academical interesting but has only little 
relevance to real life.

wobo
-- 
Public GnuPG key available at http://www.wolf-b.de/misc