<html><head></head><body><div class="gmail_quote">On December 5, 2018 8:53:20 AM AKST, Werner Koch <wk@gnupg.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On Wed, 5 Dec 2018 17:34, stefan.claas@posteo.de said:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Can you give more details about the security aspect?<br></blockquote><br>People believe that the keyservers magically return a matching key for a<br>mail address. There is no guarantee for this. In fact all people from<br>the strong had meanwhile expired faked key on the servers, which was not<br>easy to detect given that they were also signed by faked keys from the<br>strong set.<br><br>Thus if you have the capability to sniff mail you would upload a faked<br>key and hope that future senders pick up that faked key and encrypt to<br>it. You can now intercept that mail, read it, encrypt to the real key<br>and send on. Even if you can't mount such an active MitM you can<br>simply send on the newly encrypted mail with an additional line "sorry, I<br>encrypted to the wrong key".<br><br>Right the Web of Trust would stop this attack, but most people are not<br>part of the WoT. Simple methods for initial /key discovery/ are<br>required. Even autocrypt is better than keyservers and with the Web Key<br>Directory you can get an even better assurance that it is the correct<br>key.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">run their own key server and analyze the data. So what purpose should<br>your suggestion serve?<br></blockquote><br>The additional benefit is that this would take away the load from the<br>servers and allow that we can get back the large mesh of keyservers.<br>Without being able to search user-ids it does not anymore make sense to<br>use keyservers as search engines for magnet links to Bittorrent<br>distributed data.<br><br><br>Shalom-Salam,<br><br> Werner<br><br></pre></blockquote></div><br clear="all"><br>A keyserver is a convenience. Of course it's not magic. Right now I am using K-9 Mail and OpenKeychain on Android. When I received the above message from the list, K-9 Mail informed me that it was signed with a key with fingerprint "0xff80ae9d1dec358d", and referred me to the OpenKeychain app, which searched keyservers and found a matching public key, which I was allowed to import to verify the signature, which I did so successfully.<br><br>The fingerprints are some collision-resistant secure hashes, and in theory it is extraordinarily difficult to create another public key with the same fingerprint.<br><br>I have never met "Werner Koch" personally, but I am about as certain as I can be (under the present scheme of things) that that is the key fingerprint of the person from GnuPG.org who posts to the mailing list, and that there would be quite a bit of noise on the list in case of a mistaken identity.<br><br>There is a certain "reputation effect" with a public key which in theory obviates the need for in-person verification and secret handshakes.<br><br>The major difficulties and points of weakness to the whole scheme, in my opinion, are, (a) retaining possession of the private key, and (b) denying others illicit access to the private key.<br><br>Point (b) is a long-term, seemingly irremediable, problem. The long key lifetimes and the general lack of *Perfect Forward Secrecy* greatly aggravate the risk of a catastrophic total compromise of all data signed with or encrypted to the private key.<br><br>-- <br>A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.<br><br><a href="https://www.colmena.biz/~justina/justina.colmena.asc">https://www.colmena.biz/~justina/justina.colmena.asc</a></body></html>