[ home | intro | pgp tutorial | books | news | web of trust | signing keys | key servers ]
[ chat & USENET | ring | links | my keys | page sigs ]
Public Key AuthenticationThe subject of signing other peoples' keys is one that has many differing opinions, and yet some of the issues must be adressed. Please note that I will not cover all the aspects that Phil covers in his (excellent) documentation. You did read the documentation, right? Menu |
ParanoiaPart of the problem is that many people don't understand the paranoia (as they see it). There is a high ability of low skilled hackers to read your E-mail on a regular basis or even replace incoming E-mails with messages from themselves (that look authentic). It's just as easy for this malicious person to generate a PGP key with one of your associates' E-mail address on it (PGP can't and doesn't check if it's real). They could then sign messages to you and encourage you to encrypt messages to them (which might, in turn, be encrypted to the real PGP key and sent off to the right person, without them knowing). This could even be done by a business collegue or your snooping boss. This is where key signing (authentication) comes into play. For the secure sending of information using PGP, how can you be sure that the public keys you intend to use belong to who you think they belong to? There are many ways to check a PGP key, and for starters, you should always try to get a copy directly from the person, whether on paper (as a printed copy of the text version of the key -- to verify against the one they may have sent by E-mail), or on diskette. A fax from them (faxes are not secure either), or a verification of their key's fingerprint over the phone is also a good idea. If these aren't possible, then get a copy of their key by every method possible; by E-mail from them, by fingering them for it, from their WWW site, from a BBS that they call, from the keyservers, and any messages they have put it in. If you get the same key from each place, and this is good enough for you, then make sure some messages that this person sends (newsgroups, etc) that are signed with that key verify. |
Key signing ...Don't forget about key-signing though. When you sign someone's key, you let everyone know that you know that identity to belong to the person it claims to belong to. This helps build what's known as the web of trust. The web of trust is the term that Phil Zimmermann uses to describe PGP's key authentication techniques. Instead of using a centrally administered database of keys and who they belong to, PGP allows anyone to generate any number of keys. These keys you then give to all your PGP using associates and friends. You encourage them to sign them when they are certain they are from you. Now people who you can't get in personal contact with can trust your key because it's signed by someone who trusts your key. How do I know?In the old days when PGP was text-based (and still is on most Unix systems), these concepts were a little easier to follow because you had to do them yourself. Now, because of nice graphical interfaces, some of this is hidden from you. You may (in Windows), have to right-click on a key and look at its properties to see if it's signed by anyone, and in that case, by whom. In my case, I type in It then breaks down the validity and trust-levels for each of those keys: (Validity is whether it's signed by myself or someone I trust or someone they trust -- up to 3 levels, Trust is whether I trust them or not for the sake of the previous calculation).Type Bits KeyID Created Expires Algorithm Use pub 1024 0x4B875F7F 1998-04-09 ---------- DSS Sign & Encrypt sub 2048 0xADAA2DC2 1998-04-09 ---------- Diffie-Hellman uid Allen Crutchfield <[email protected]> sig! 0x4B875F7F 1998-04-09 Allen Crutchfield <[email protected]> sig! 0x89641F17 1998-04-10 Michael T. Babcock <[email protected]> pub 1024 0x536FFA63 1998-10-02 *REVOKED* DSS Sign & Encrypt sub 4096 0xA977DBD3 1998-10-02 Diffie-Hellman uid David F. Longe <[email protected]> sig! 0x536FFA63 1998-10-02 David F. Longe <[email protected]> pub 1024 0x8C86809A 1998-10-06 ---------- DSS Sign & Encrypt sub 4096 0x3C3C6FF3 1998-10-06 ---------- Diffie-Hellman uid David Longe <[email protected]> sig! 0x8C86809A 1998-10-06 David Longe <[email protected]> sec+ 1024 0x750C259F 1998-11-03 2000-11-02 DSS Sign & Encrypt sub 2468 0xB5F3894E 1998-11-04 2000-11-03 Diffie-Hellman uid Michael T. Babcock <[email protected]> SIG! 0x750C259F 1998-11-03 Michael T. Babcock <[email protected]> uid Michael T. Babcock <[email protected]> SIG! 0x750C259F 1998-11-17 Michael T. Babcock <[email protected]> pub 1280 0xFF663131 1998-06-16 ---------- RSA Sign & Encrypt uid Stephen Tyers <[email protected]> sig! 0xFF663131 1998-06-16 Stephen Tyers <[email protected]> pub 1280 0x36517395 1996-08-21 ---------- RSA Sign & Encrypt uid Wayne Lambert <[email protected]> sig! 0x36517395 1996-08-21 Wayne Lambert <[email protected]> sig! 0xFA4C5DB1 1996-08-23 Michael T. Babcock <[email protected]> KeyID Trust Validity User ID 0x4B875F7F marginal complete Allen Crutchfield <[email protected]> Allen Crutchfield <[email protected]> complete Michael T. Babcock <[email protected]> # 0x536FFA63 untrusted invalid David F. Longe <[email protected]> David F. Longe <[email protected]> 0x8C86809A untrusted invalid David Longe <[email protected]> David Longe <[email protected]> * 0x750C259F ultimate complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> 0x89641F17 complete complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> complete Michael T. Babcock <[email protected]> complete Mike Babcock <[email protected]> marginal Steve Coles <[email protected]> marginal Allen Crutchfield <[email protected]> complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> complete Michael T. Babcock <[email protected]> complete Mike Babcock <[email protected]> marginal Steve Coles <[email protected]> complete CyTech Computers <[email protected]> Michael T. Babcock <[email protected]> complete Michael T. Babcock <[email protected]> complete Mike Babcock <[email protected]> marginal Steve Coles <[email protected]> 0xFA4C5DB1 complete complete Michael T. Babcock <[email protected]> marginal Wayne Lambert <[email protected]> complete Mike Babcock <[email protected]> Michael T. Babcock <[email protected]> marginal J. Michael Lowe <[email protected]> marginal Ronny L. Waldrip <[email protected]> ultimate Michael T. Babcock <[email protected]> complete Mike Babcock Michael T. Babcock <[email protected]> marginal J. Michael Lowe <[email protected]> complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> marginal J. Michael Lowe <[email protected]> complete Michael T. Babcock <[email protected]> Michael T. Babcock <[email protected]> marginal J. Michael Lowe <[email protected]> complete Michael T. Babcock <[email protected]> complete Mike Babcock <[email protected]> Michael T. Babcock <[email protected]> marginal J. Michael Lowe <[email protected]> complete Thawte Freemail Member <[email protected]> complete Thawte Personal Freemail Issuing Key 1997.06.24 08:27 ultimate Michael T. Babcock <[email protected]> 0xFF663131 untrusted invalid Stephen Tyers <[email protected]> Stephen Tyers <[email protected]> 0x36517395 marginal complete Wayne Lambert <[email protected]> Wayne Lambert <[email protected]> complete Michael T. Babcock <[email protected]> |
[ home | intro | pgp tutorial | books | news | web of trust | signing keys | key servers ]
[ chat & USENET | ring | links | my keys | page sigs ]
This page is entirely Copyright © 1996 ... 1999 Michael T. Babcock
(except of course logos of various companies and book icons used by permission from Amazon).