Fwd: Re: key question

[MFPA]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Grant


On Saturday 27 February 2010 at 9:54:56 PM, you wrote:



> It sounds like you're using the software to do the opposite thing that
> many people do.  I think digital signatures are utilized much more than
> encrypted communication.

I don't know; I have not seen any purported volumes ofeither



> And digital signatures are about authenticating to a real person,
> and not anonymity.

Even with a "persona" on a forum, the digital signature provides a
measure of reassurance that those posts bearing the same moniker
actually do come from the same person.



> If you don't want to publish your email for the anonymity/privacy
> reasons you've outlined, then you probably don't want to use your legal
> name either.  And it looks like you don't.  Which is fine for encrypting
> documents.  But it renders two key features of digital signatures
> meaningless.  Authentication and Non-repudiation go out the window.

I'm not convinced that non-repudiation does go out of the window much
more than for a key claiming to represent a person with a name backed
up by government-issued ID, unless you know more about the person.

Say an individual has a key saying he's John Smith. He's found a few
people he doesn't know, who have checked his passport or driving
licence and signed his key to attest to his identity. He stops using
his key, stops communicating with you and closes the email account. A
very common name; which John Smith was it? Is it much easier to track
a random John Smith than a random MFPA?



> How
> do I authenticate that an anonymous entity is really an anonymous
> entity?

I'm not anonymous: I'm MFPA. Various people who know me personally
could attest to that.

For all anybody reading this knows, I could have renounced my previous
identity and now have official ID declaring that I am MFPA.



> That doesn't make any sense.  How do I get into a dispute with
> an anonymous entity about whether he really agreed to do X?

I wasn't planning to get into a dispute. *If* I said I'll do it, I
will. OK (-;



> And
> although it does prove message integrity, that, in and of itself,
> doesn't mean much for an anonymous entity.

A message to a mailing list from somebody you do not know who calls
himself MFPA. A message to the same mailing list from somebody I do
not know who calls himself Grant Olsen. Both are signed and the
signature checks both indicate no tampering. In what way does one
digital signature mean less than the other?



> So a few examples to elaborate.  I'm going to use MFPA as the anonymous
> user who doesn't have a real ID for clarity sake.  It's better than
> "anonymous entity".  Just to be clear, I'm not really talking about you
> or making any personal attacks in the examples.  You're just the generic
> guy with the non-identifiable key.

Thanks, I think (-:



> Farfetched example.  An email from MFPA pops up on the list.  "My house
> burnt down.  Lost my key.  Lost my rev certificate.  Here's my new
> info."  Five minutes later, another email from MFPA.  "That dude
> generated a fake key.  Keep using the old one.  The new one is bad!"  A
> third email from MFPA.  "That last dude is lying.  Turns out he stole my
> laptop before burning my house down."  Who do we trust?  Which key do we
> use?  We have no way of knowing who the real MFPA is, because he was
> anonymous to begin with.

My posting style, turn of phrase, and opinions suddenly taking a
step-change could be a clue. Although, depending on how I suffered in
the fire, that could happen.


If I used the name John Smith, how would this example be different?
(BTW I'm NOT John Smith)



> How could I sign your key?  It sounds like you don't want anyone to sign
> it anyway, plenty of other people want to sign keys and build the web of
> trust.  I can't verify your key in any way.  You're anonymous.  There's
> no way to prove you're MFPA.  So I can't sign your key.

If you knew me personally, you could.

And as I already said, do you know MFPA's not my legal identity?
There used to be somebody in my town who had officially changed his
name to FREFF. (Never did understand why.)



> Lets assume among your circle of friends, who know each other personally
> in real life, you sign off on each others keys.  And I somehow know one
> of your friends, and we sign each others keys.  To me, it's a
> meaningless assertion for someone to claim that they've verified that
> you're the real MFPA.  That doesn't mean anything to me because you're
> anonymous to me.  It also doesn't mean anything if you've signed off on
> someone's key.  What does it mean to me that MFPA vouched for someone
> else's identity?  Another meaningless assertion.

If you replace each instance of "MFPA" in the above paragraph with
"John Smith," how does it alter the sense of your point?

If your friend, who you have known for decades, asked you to sign their
key, would you check their documents just in case their legal identity
differed from the name you had always known them by? Would you attest
only to their legal name, or to the name they are known by, or both?



> I'm not really using OpenPGP encryption at all.  I may never need to
> send an encrypted email.  None of my real-life friends, family,
> co-workers use it.  Not Cuban, Iranian, or in the Falun Gong.  I use it
> for two things, (1) to post on computer geek mailing lists, and (2) to
> verify software packages.  For (1), I guess I'm not too concerned about
> digital signatures.  The PGP Global Directory is good enough
> authentication for me.  For (2), I actually am.  It'd be nice to have
> the software packages signed by a validated key.  If people don't use
> personally identifying information, the web of trust breaks.  The only
> way for me to actually validate a key is to meet with the software
> packager personally.

Assume the path between your key and the software developer's included
your signature on my hypothetical friend's key, followed by their
signature on my key (MFPA), followed by my signature on somebody
else's key. That's a problem for you?



- --
Best regards

MFPA                    mailto:expires2010 at ymail.com

A bird in the hand makes it awfully hard to blow your nose
-----BEGIN PGP SIGNATURE-----

iQCVAwUBS4oEFKipC46tDG5pAQruxwP9GhcIQ82heOad+Z7lcaWi+jO88hnhXxav
vIqUO2+jI1FHMbUXsSklzvVCi2g1iXof55/Cxw1/9BeLFoqtN1/9EZtN/wtq+R6U
/o0Q1Gz88Wiup8XPKlIjrOEkV9nIywahLW99ZLHR4lBpkF+XJyy0GRLjBEW/rpRA
WQst7szsEfg=
=CVbx
-----END PGP SIGNATURE-----