comments on uid

[Eric H. Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Mar 18, 2012 at 06:13:32PM -0000, freejack at is-not-my.name wrote:
> > I should note that many people actually *don't* check if the e-mail
> > address belongs to the person whose UID they sign. If this were as
> > "simple" to prove as it is to prove you have a certain name by showing a
> > passport or something, it might be checked more often.
> 
> That doesn't sound right. If you can't verify the email shown on the key
> belongs to the user what have you accomplished? All you did was tie a key id
> to a person (maybe, not sure if you provably accomplished that) but not the
> email address. If the purpose of key signing is ultimately to relate
> something useful to a person then I think it's more useful to know a certain
> person owns a certain email adddress and what his key id is. YMMV.

Just to play devil's advocate there could be a single email address being used for a group of people.  You'd know the message was for you because you have the correct key to open the message while everyone else would be left with a random mess of characters.  Not sure why one would setup such a system, since email addresses are cheap now days, but none the less you could setup something similar.  Although this does make one wonder about hijacking someone's account which means that you'd always want to make sure that you change the authentication to your email accounts regularly lest someone do this to you.  It would, more than likely, be a very targetted attack.

> > But that's government regulated, unlike e-mail addresses. All you can
> > easily prove is that you have access to an e-mail account, which is
> > something completely different. Just to begin with: so does your e-mail
> > provider.
> 
> Not necessarily but even if they did, how do they have access to the key?
> I'm just saying 2 pieces of binding information sound better than one.
> 
> Wouldn't it be safer to ask the person who wants you to sign his key to mail
> you his key id and then you respond with some piece of information he has to
> bring when you sign his key, in additional to whatever else you do? 
> 
> > If you haven't given the key to anyone (the copy in your own keyring is
> > the only copy in existence), you can just add the new UID with adduid and
> > then delete the old one with deluid. A key needs at least one UID, 
> > so you first need to add a new one before you delete the last and only UID.
> 

So CAFF[0] does make key signing a bit more secure although it does not solve the problem completely.  When signing keys with CAFF, the program will create the signatures per UID and then email the specific UID signature to the address on that UID.  The message is encrypted which requires that the receiving party not only have access to the email address but also the key so they can import the signature.  Once they have imported the signature they can upload the updated key to a key server.  That means that if they are only attacking the email from a sending point of view then they wouldn't have access to the key signature.

[0] http://pgp-tools.alioth.debian.org/

- -- Eric

- --------------------------------------------------
Eric H Christensen        eric at christensenplace.us
"Sparks"                  sparks at fedoraproject.org
    .... . .-.. .-.. ---  .-- --- .-. .-.. -..
097C 82C3 52DF C64A 50C2  E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iQIcBAEBAgAGBQJPZiwrAAoJEIB2q94CS7PR7qUP/2jeeDEgaWOfH2tarJhPhQVu
UymrpLX1Jl/+PIS4KnUipV/0hsrc7m1TsuWzoOyVp88TSoVIwarQYdpuf9c1XNS5
JLhknEQK2vy9MZeCxPFil53TRMF/KUFD3L4oV8avITyaN5a38QMdrZ8Tx+hH8KAp
cBOdkfA0HmCYXTue+IuPrmGHk6AWXzCT7pXjr1yrcdToHr1d+ir3VQoE0TuMFrct
4k055+lCK+98MF/hDZgNpWlkJGcoefvIweywc1kt8gQViBiiBXSfiDwc4nLBrgCz
Ir8n2Qu4Ikw5r/kDmh0bi1Eykc3A+pRHTgAKSahP3jXPhbEAgKtVFW7+mID5qVJH
26u2Xh2qLidXh6g9lV8qrquuUa+z19NjYXm4xCBu9QcFVhJsuOUba3tMPGQZRzVA
gpqXxlPW1hvnzB5iSsXM917heh8QBeebCpmQoLcddXR4U5C7vj+2+KaoSdt9rWCj
+xx1BZnwyaHJ8TOKfkjF3uxJDvWeCvZjQYoS13R1a9oN0ARmxjAvmlxy5Y2wGrQd
tJU/q6bnMHddx4EPIZiHIUvbL3Wbp2/Beg3R6b4/oPVwt4DIMuw73g77UW/qkJGx
LwGDhcbgRA+WmQ00ml1Y5KUIsD8N/oKjZkK84G9KMlzLMQGVL6jK+kNs9jSh+hZn
bJDBZQqDrhoYsYpImUKy
=ol6+
-----END PGP SIGNATURE-----