Subject: Re: recover private key

[Avi]

---------- Forwarded message ----------

> From: "Robert J. Hansen" <rjh at sixdemonbag.org>
> To: Faramir <faramir.cl at gmail.com>
> Date: Tue, 13 Jan 2009 08:45:32 -0500
> Subject: Re: recover private key
> (This email is for jakse, although I'm responding to Faramir's email.)
>
> [snip]
>
> Usually when people sign mailing list posts they are doing one of three
> things:
>
>        1.  Testing their system to make sure everything works
>        2.  Making a small public show of support for our right
>            to use strong cryptography
>        3.  Grossly misunderstanding the utility of their
>            signature
>
> #1 and #2 are both great ideas and I'm all in favor of it.  It's okay to
>  sign your messages if you're doing so to make sure that you understand
> how it's done.  Someday you'll need signatures, and when that day comes
> the practice will pay off.  Likewise, showing public support for email
> cryptography is a Good Thing and should be encouraged.
>
> Unfortunately, #3 is true much more often than it's not.
>
> Probably the biggest myth about signatures is they provide either
> repudiability by proxy.  Even very intelligent and experienced users
> fall victim to it.  A lot of people will say, "I sign everything so that
> if later on someone tampers with my messages I can prove I didn't write
> it."
>
> Unfortunately, digital signatures don't provide this capability.
>
> Imagine that I'm back in grad school teaching a class and I give a
> student a poor grade.  The student decides to get revenge on me by
> posting to notorious white supremacist message boards in my name, then
> conveniently blows the whistle on "my" activities.  I get hauled into
> the Dean's office where I get told I'm being suspended pending the
> investigation.
>
> "But I didn't write those!" I say.  "I sign absolutely everything!  Were
> those messages signed?  They were either missing a signature or had a
> bad signature, right?  Clearly, obviously, I didn't write them!"
>
> "Ah," the Dean answers, "but you're a smart guy, Rob, and you're smart
> enough to have deliberately omitted a signature, or put a bad one, on
> incriminating messages you wanted to later repudiate.  The lack of your
> signature, or the presence of a bad one, doesn't prove anything about
> whether you wrote it.  Sorry.  We'll have the investigation wrapped up
> by next semester."


-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160


Far be it from me to argue with Rob, who likely has forgotten
more about cryptography than I will ever learn, let alone know
now, but while signing messages cannot prove that an unsigned
message is false, it can prove that signed messages are true.
For example, given the possibility of a piece of an e-mail being
quoted out of context, signing my messages allows me to
demonstrate the totality of what I did write at the time I wrote
it, so I have a recourse to show the entire post and its
context. The same would apply for text documents, etc.

- --Avi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32) - GPGshell v3.71

iEYEAREDAAYFAkltA74ACgkQy6A/Rnheoimb/gCfah/4X5sOuxhymqmuWrOtEQoy
4kcAn2iefpmuWtnHPW/lKSWpq43Tm6vH
=5J12
-----END PGP SIGNATURE-----


en:User:Avraham

pub 1024D/785EA229 3/6/2007 Avi (Wikipedia-related) <aviwiki at gmail.com>
   Primary key fingerprint:  D233 20E7 0697 C3BC 4445 7D45 CBA0 3F46 785E
A229
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20090113/6304fecb/attachment.htm>