From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751287Ab1JHFGa (ORCPT ); Sat, 8 Oct 2011 01:06:30 -0400 Received: from edison.jonmasters.org ([173.255.233.168]:51141 "EHLO edison.jonmasters.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750730Ab1JHFG2 (ORCPT ); Sat, 8 Oct 2011 01:06:28 -0400 From: Jon Masters To: Valdis.Kletnieks@vt.edu Cc: Krzysztof Halasa , Adrian Bunk , "Frank Ch. Eigler" , "H. Peter Anvin" , "Rafael J. Wysocki" , Linux Kernel Mailing List , Greg KH In-Reply-To: <15324.1318004954@turing-police.cc.vt.edu> References: <4E8655CD.90107@zytor.com> <201110020304.28288.rjw@sisk.pl> <4E87B885.50005@zytor.com> <201110021354.57995.rjw@sisk.pl> <4E88A537.4010008@zytor.com> <20111003093239.GB25136@localhost.pp.htv.fi> <20111003180441.GD3072@localhost.pp.htv.fi> <34045.1317760188@turing-police.cc.vt.edu> <1317916702.19519.1.camel@constitution.bos.jonmasters.org> <14191.1317930659@turing-police.cc.vt.edu> <15324.1318004954@turing-police.cc.vt.edu> Content-Type: text/plain; charset="UTF-8" Organization: World Organi[sz]ation Of Broken Dreams Date: Sat, 08 Oct 2011 01:02:13 -0400 Message-ID: <1318050133.19519.184.camel@constitution.bos.jonmasters.org> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 (2.30.3-1.fc13) Content-Transfer-Encoding: 7bit X-SA-Exim-Connect-IP: 74.92.29.237 X-SA-Exim-Mail-From: jonathan@jonmasters.org Subject: Re: kernel.org status: establishing a PGP web of trust X-SA-Exim-Version: 4.2.1 (built Sun, 08 Nov 2009 07:31:22 +0000) X-SA-Exim-Scanned: Yes (on edison.jonmasters.org) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2011-10-07 at 12:29 -0400, Valdis.Kletnieks@vt.edu wrote: > On Fri, 07 Oct 2011 00:16:01 +0200, Krzysztof Halasa said: > > > > Wouldn't the fact that I attend the keysigning party and claim that I was > > > the owner of key B4D3D7B0, and then subsequently signing your key with > > > that same key, prove that I actually controlled key B4D3D7B0? > > > > I don't think it's needed. Alice claims ownership of key B4D3D7B0, gets > > signatures on B4D3D7B0 public key. Bob (who actually controls B4D3D7B0) > > reads Alice's mail and signs something "in Alice's name". Alice loses. > > You got that 180 degrees out of phase. Jon said he wanted a keysigning party > where I would prove that I own key B4D3D7B0 (which is, in fact, my key) by > signing something random. My claim is that if I can take Jon's key and sign it > with B4D3D7B0, that's already proving I control the key, and another signing > of something else doesn't prove anything regarding my control of the key. What I'm saying is that unless you sign something (random text, my actual key(s)) in my presence, I can't actually know it was you I was dealing with or someone else claiming to be you (or your identity). I see all these keysigning parties where people dutifully check IDs they don't really know how to recognize and am always struck by how the offline post-event nature effectively never proves the person you met in real life is the person whose key you just signed, just that some ID seemed to reasonably match the name on the fingerprint at the time. I bet it someone turned up at one of these events with a $100 fake ID made in China of the kind I hear about on the radio these days, a large majority of those present would happily sign a key claiming to match that ID after the event, even if the real owner was never there. Jon.