Proof of possession when exchanging keys

[Phil Calvin]

That makes perfect sense. That's the approach I took on the most recent key I signed.

What attacks are mitigated by verifying control of the secret key, though? I am having a hard time grokking the benefit for someone whose ID you have verified to present and fingerprint a key which she does not control.

There is the possibility of an external party replacing the exchanged key with another, but doesn't the fingerprint adequately protect against that?

On Nov 15, 2013, at 11:02, "Thomas Harning Jr." <harningt at gmail.com> wrote:

> The general practice I follow is to verify fingerprint and ID separately then, in order to verify control of email address and private key, send the signed ID encrypted to the provided email address.
> 
> 
> 
> On Wed, Nov 13, 2013 at 11:49 AM, Phil Calvin <phil at philcalvin.com> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> I seem to recall reading somewhere that when exchanging keys in
>> person, you should not only have the person verify the key
>> fingerprint, but you should also present them with 1) an unpredictable
>> challenge document to sign or 2) verify that they can decrypt an
>> encrypted message using the key in question. This would ensure they
>> have access to the secret half of the keypair in question.
>> 
>> Is verifying proof of possession necessary or good practice, or is
>> checking fingerprints (and, when you don't know the person, photo ID
>> or similar) enough?
>> 
>> Phil
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.13 (Darwin)
>> 
>> iQIcBAEBAgAGBQJSg62LAAoJEDe3IfDa5pYf6jwP/ApNoDfMbn3RtF8m494BAOFj
>> 4S1EcJD+hn0nIhwABsZSpR3JsIFdK+5Sc4LDT2RnEmBhvo21Bn6l1W8GyCmbKqbA
>> GOSPNBdSWLmnyNMQfOQ4pzKIyexs0qM610BG81pZaIEiDPTpNJxkZt1Uu4/Xlfvo
>> mVnxf06tfp7h4ue04gznrKpAAKWPO7OG9XukCe93QxuOuP9L7B83jYQsg/wMBaFS
>> x3smYgHfM8wrm4tsenbmnq8rCAMrZunl9n/BERjITcjQSPD8vZY5Ko81YyW47Fel
>> qyiIVVJR6/xW0+LHLn3dx5Uyj3Da/vdfK43GKc5YDp76XdrMkk1Ts/KobfmgilGI
>> WuWZesFlKb5zij93rKCIiEoKxkDnX3QvfgertXeHxZwsnEdxJyEtoGHDgb3lV0Gl
>> jgaw/iWdJ9cJJIT8tIhvl6SMLV0Wa61OSjDk5XvfppFKU7WncqRn4UGjJKR1Q+9P
>> ik7q2eyG6TjqtW3FTLCO165q/QF2BvWGDvoHqcymaw3Q1SzKKZ/Kq5L7kAc9UGXZ
>> diZ3NOCZfPf608fqFF37zgZZlNVsbkThQcN4xhjqBoxeqch/0quvRXM/nWBnTXAk
>> HDHe2DW3vy+BJ7wT1JKyAPKr19LNKvNlKi5og/4/3+FfVFELisgphUY+kf0m2Ops
>> GzTfJIrwHTmwatg8rS4+
>> =4ll+
>> -----END PGP SIGNATURE-----
>> 
>> 
>> _______________________________________________
>> Gnupg-users mailing list
>> Gnupg-users at gnupg.org
>> http://lists.gnupg.org/mailman/listinfo/gnupg-users
> 
> 
> 
> -- 
> Thomas Harning Jr. (http://about.me/harningt)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20131115/7eff11ef/attachment.html>