ietf
[Top] [All Lists]

Re: authenticated email

2003-06-04 14:07:22
Alexandru asks:

So the level of trust depends on the number of signatures?

No, it depends on who signed the key.  If you trust the people who signed
the key, then by extension, you can trust the key (because presumably
trustworthy individuals would not sign a key if they were not certain that
the key was truly what it claimed to be).

Similarly, you should never sign a key unless you've received it directly
from the owner.  Signing a key that you happened to find somewhere is very
bad practice, because signing a key implies that you are CERTAIN that the
key belongs to whomever it claims to belong to.

Can I also ask other lots of people to sign the
key I create and then pretend I'm Harald?

Sure, but trustworthy individuals aren't going to sign your key unless they
are certain that you really are who you claim to be.  Untrustworthy
individuals might sign your key in any case, but nobody is likely to trust
those individuals as "introducers" of your key.

Otherwise, if certain of people who signed your
key are "special", or are highly trusted, can I
ask who are those people?

They are identified by their signatures.  Whether or not they are trusted is
up to you.

Ultimately, you have to start with a key that you receive directly at some
point.  This gives you a key that you can rely upon for signatures of other
keys.  The best policy is to reliably obtain the keys of several people whom
you'd trust as introducers for other keys, and then go from there.





<Prev in Thread] Current Thread [Next in Thread>