Why CAs or public keysigning?

[Peter L. Smilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Just to avoid awnsers to problems I didn't state:

1: Again: I am not questioning trust in signatures! There ARE enough
people and CAs I trust (although even some very well known GnuPG-persons
and CAs explicitly state in their policy that they don't check
email-adresses carefully). My problem is that even when they have done
their work perfectly, I cannot check if the person they checked is the
same person I want to communicate with.

2: Many awnsers say: "When you really want need security, then you
usually know your communication partner personally or you ask him for
his fingerprint." That's right. But then I don't need the signature of
the CA or the "public keysigner" anymore (this is case 1 of my original
posting). In this case I have a much stronger "link" or "path" than via
CA or "public signer". The same is the case when some signatures of
friends and collegues of mine are on the key: I can ask them who the
person is they gave their signature (case 2 of my original posting). A
stronger link/path is also available when I see signatures of people I
know to be friends or collegues of the key owner (case 3). As soon as
such signatures are available my problem is solved. But my problem is,
when ONLY signatures of CAs and people I don't know are available (which
is quite usual and which is the actual subject of my posting!!), then I
only know they signed some person with that name; I don't know which one
of all the persons with that name they signed. And when this really
cannot be solved, then signatures of CAs and "public keysigners" are
"only" good to reduce the number of possible attackers to those with the
same name (see below); I am not sure if that is enough to do all the
trouble with CA-registration or keysigning parties.

3: As Joseph Bruni stated: "The odds of you knowing someone who knows
someone you know (three steps) are surprisingly high (at least in the
US). I believe at last check the odds were around 1:100." That's right:
We live in a so-called "Small World"-network, where the mean number of
"hops" from one person to another is found out to be about 6.5, which is
nicely approved by the mean "hop-count" of the strongly connected set of
the WoT. But this means that with about the same magnitude of likelyhood
you will find a ANOTHER person with the same name "signed by anybody who
signed anybody that was signed by me".

4: At the moment only few people are using OpenPGP, so to most people
you cannot send encrypted emails and secondly many of the few users know
each other, so the identity is quite certain (e.g. the only Peter Smilde
using OpenPGP :)). But in the context of secrecy of letter, one should
encrypt all email; just not to make any really secret email attract
attention, because it is one of very few email that is actually
encrypted. In this context it should become more important to have a
possibility to connect the identity of a person to his key by the
potential user of the public key (which is no problem for the signer,
who check ID-card against UID).


- --

Peter L. Smilde
Budenheim, Germany
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE+8ZT6FCtQzrDkv5kRAjE+AJ9hksgMZZW++r7ELDo+1Al+ieuP7ACgxZuy
q6uRrGUOmpjZh4Xl9Jku5ak=
=sLy9
-----END PGP SIGNATURE-----