Migrating keys

[Neil Williams]

On Wednesday 26 Nov 2003 7:40 am, Adrian 'Dagurashibanipal' von Bidder wrote:
> On Tuesday 25 November 2003 20:49, Neil Williams wrote:
> > On Monday 24 Nov 2003 10:49 pm, Jens Kubieziel wrote:
> >
> > I've thought about that before and I've put a page on the DCLUG website
> > that outlines what I hope is a decent method. Now's as good a time as any
> > to ask if others think it'll work!
> > http://www.dclug.org.uk/linux_doc/gnupgsign.html#transfer
>
> [...]
>
> It's not watertight. If I have both your secret key and your email account,
> I can do all of this, and have in the end a trusted key to your name where
> you don't have the secret key.  Granted, I'll need coninued access to your
> mail account, but in some circumstances this may be easy.

As I suspected, it's usable in a situation where both parties still have 
non-email communication on an ongoing basis? This could be used to confirm or 
replace one of the steps - preventing someone attacking the email address 
from knowing the entire process.

> I think it's important to think again about what David said: a signature on
> a key is a public statement. It's not just that you (as the recipient of
> such a 'sign my new key' request) believe that nothing bad is going on, but
> you are publicly asserting that the key is genuine, and others rely on
> this. Possibly to do things with expensive real-world consequences if you
> are wrong (sending passwords, ...)

Agreed. I'll rephrase certain sections and add extra advice - although I can't 
do much immediately.

I could also phrase it so that it leans towards doing at least part of the 
process at a LUG meeting - after all, that allows for full keysigning 
procedures that anyone would be happy to follow.

-- 

Neil Williams
=============
http://www.codehelp.co.uk/
http://www.dclug.org.uk/
http://www.isbn.org.uk/
http://sourceforge.net/projects/isbnsearch/

http://www.biglumber.com/x/web?qs=0x8801094A28BCB3E3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: signature
Url : /pipermail/attachments/20031126/54580d34/attachment.bin