Keysigning challenge policies/procedures

[David Shaw]

On Fri, Jul 07, 2006 at 11:19:47AM +0200, Marcus Frings wrote:
> * Todd Zullinger <tmz at pobox.com> wrote:
> 
> > What I don't see in any of the links is more information about sending
> > an email challenge before signing a key.  (My apologies if I'm
> > overlooking it on your page or any of the others.)
> 
> Before I used a protocol to signing keys where I sent out random strings
> as challenge response but it's not worth. There is no enhanced security
> and only more work for "signer" and "signee". If you send the signed UIDs
> encrypted to each mail address separately it has the same effect in
> security because if the mail address bounces or the person behind the
> address doesn't have the private key your signed UIDs won't become
> publicly available.

I've been away on vacation and only picked up this thread now.  This
statement is not correct.  Back in the PGP 2.x days, this might have
been true, but with OpenPGP, there is no particular requirement that
the ability to sign and the ability to decrypt are connected.  You can
have a shared key with separate capabilities.

Sending an signed key via encrypted mail does not ensure anything
about the key owner.

David