-----BEGIN PGP SIGNED MESSAGE----- warlord@mit.edu (Derek Atkins) writes:

...

A signature on your PGP public key is a personal guarantee from the person who signed it that she has first-hand knowledge that the key's userid accurately names the person who physically possesses the key (i.e., the signature validates the binding between userid and person).

Actually, this is not true. A signature on a key is a personal guarantee from the signer that binds the user-id to the _KEY_, not necessarily a person.

That's part of it, but the more important binding created by a signature is the binding between the userid and the real person. Without that binding, the binding between the key and the userid is useless. This is why photo-identification (i.e., a passport) a required part of keysigning (unless the signer personally knows the key's owner). Sure signatures bind the userid to the key, but what good is that to third parties if they can't be sure that the userid accurately names the person who possesses that key?

For example, in the case of a real person, you can send me a message to "warlord@MIT.EDU" and later meet me in person, and I can verify that I received the message by responding in some appropriate manner.

When I meet you in person to hand you my key fingerprint, won't you require me to identify myself in order that you can be sure the name in the userid of my key is also the name of the person you are meeting? If you do, then you will have just validated the binding between userid and real person.

But you cannot perform this check for a pseudonymous identity, because there is no secure way to prove that that key really belongs to some identity.

Which is exactly why I can never sign the key of a pseudonymous entity. Because the entity is unwilling to prove to me that there is a single real person who possesses the private half of his key.

It is possible to set up a server that compares userID to mailID in some secure manner. For example, there were some way to get a secure mail from a user to a server, and the server could verify the mail address, and then validate the mail address to pgp keyID.

As an aside, I've written a Kerberos PGP Keysigner -- it uses kerberos authentication to validate a user and compares the kerberos identity to the userID on the key, and if certain qualifications are met between these two names, the server will sign the key. The assurance this key is making is that the owner of this key could authenticate as this user to me via kerberos.

I don't like the idea of an automaton possessing or signing PGP keys. People sign other people's keys because only people have the need to trust other people. Automatons don't need to trust and they are not the direct targets of trust. This is the objection I had to Phil's signing of the Betsi public key. As an automaton, Betsi is only as trustable as its human authors and adminstrators. Yet Phil doesn't know who those people may be in five or ten years. Yes, people change over time too, but not as quickly or as radically as an automaton can. It's too easy to subvert an automaton for me to ever sign an automaton's PGP key. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLpKqgXeXQmAScOodAQHN0gP+K7TTE488k+fJQdyL4laxFOJa8LYeoo09 F+RzXyLv2FMKPfNDPhbMglHToRf5lgmtskELe3+rB2Ra2xbdOGFKUxNHkkgdCLXt ld149yBMmZBawHw5Qj482UpVt12+hmYxgt0bBnsTRqf4r6lMjdmU2OwiZ7KaY5/V /EKkTrotvAw= =G4X/ -----END PGP SIGNATURE----- -- Fran Litterio franl@centerline.com (617-498-3255) CenterLine Software http://draco.centerline.com:8080/~franl/ Cambridge, MA, USA 02138-1110 PGP public key id: 1270EA1D

-----BEGIN PGP SIGNED MESSAGE----- nelson@crynwr.com (Russell Nelson) writes:

From: franl@centerline.com (Fran Litterio)

That's part of it, but the more important binding created by a signature is the binding between the userid and the real person. Without that binding, the binding between the key and the userid is useless.

Nonsense. You're assuming that the real person wishes to carry their reputation over onto their key/userid combination. Perhaps they wish to establish a separate reputation for it? And once they've established that reputation, they wish to change keys? Might you not sign such a new key?

I would not sign a pseydonymous entity's key based soley on the reputation of the entity. How do I defend against a man-in-the-middle attack -- how do I know I'm not signing the middle-man's key instead of the entity's key? With a real person, my defense is to use a tamperproof out-of-band channel to verify the key fingerprint: a phone call (for a friend whose voice I recognize) or a personal meeting with passports (for someone I don't know very well). How do I do that with a pseudonymous entity? I'd really like to know if it's possible to do. I'm all in favor of pseudonymous entities building reputations, but I think that the price of pseudonymity is the inability to be part of a PGP-like Web of Trust. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLpLtrneXQmAScOodAQGvRwP+Jj8aR/Qmbd9EdPmCzBw6AGj0fvXhdgal MXN0HYsqiFPcqZf2GeeE764DpZrCAa54RheXsFa9sjkfJSzN2MfqV4HOiI/X3TvP qZjt0Bzc8FX5e88CPTE7ajISbPWhhHyGYcbf5IY6u/a55jmSiwSUTuEysFb37QIT 2SCgNSW6uNs= =ejKn -----END PGP SIGNATURE----- -- Fran Litterio franl@centerline.com (617-498-3255) CenterLine Software http://draco.centerline.com:8080/~franl/ Cambridge, MA, USA 02138-1110 PGP public key id: 1270EA1D

-----BEGIN PGP SIGNED MESSAGE----- To: franl@centerline.com (Fran Litterio) cc: cypherpunks@toad.com Subject: Re: Nom de guerre public key In-reply-to: Your message of "05 Oct 1994 13:31:42 GMT." <FRANL.94Oct5093142@draco.centerline.com> - --------

key's owner). Sure signatures bind the userid to the key, but what good is that to third parties if they can't be sure that the userid accurately names the person who possesses that key?

What is in a name? A name is just a convenience with which one can identify some object/entity/etc. "Pr0duct Cypher" is as much a valid name as "Derek Atkins". The fact that some entity can produce some United States Government paperwork that says that the US Govt believes that this person "exists" is irrelevant in this discussion. The fact that I can certify that "This Public key belongs to the identity Pr0duct Cypher" is _all_ that a key signature says.

When I meet you in person to hand you my key fingerprint, won't you require me to identify myself in order that you can be sure the name in the userid of my key is also the name of the person you are meeting? If you do, then you will have just validated the binding between userid and real person.

This is a humanly-applied set of restrictions. I have in the past signed keys for people whom I haven't met in person; my personal requirements for signing keys do require out-of-band authentication, however. Yet PGP does not impose this restriction. I could create an identity (call him Mr. X), and Mr. X could start to sign keys based upon continuous communication. For example, Mr. X could encrypt a message to some other pseudosym, and ask them to sign the message that was encrypted to them and send it back. Since only the owner of the key can both read it and sign it, and since Mr. X only sent this to a single person (and included some identification string), Mr. X could know, with marginal doubt, that this key belongs to this identity -- even without ever meeting this person and without ever needing to talk to a real person.

entity. Because the entity is unwilling to prove to me that there is a single real person who possesses the private half of his key.

This is fine -- you don't have to sign pseudonymous keys. That is your perogative. That doesn't mean that there aren't cases where signing a pseudonym's key is the right thing to do.

I don't like the idea of an automaton possessing or signing PGP keys. People sign other people's keys because only people have the need to trust other people. Automatons don't need to trust and they are not the direct targets of trust.

So what you are saying is that you don't see any reason for a server to be able to authenticate itself or for someone to be able to send a message to a server? You don't believe that there could be a PGP-telnet? If this is what you believe, then you have a very short-sighted view of the world. A server needs to trust that a person is allowed to log into it, or that a client is allowed to use the service it provides. As such, it is vital that the server be able to authenticate to the client as much as the client needs to authenticate to the server. This requires that the server itself maintain a key.

This is the objection I had to Phil's signing of the Betsi public key. As an automaton, Betsi is only as trustable as its human authors and adminstrators. Yet Phil doesn't know who those people may be in five or ten years. Yes, people change over time too, but not as quickly or as radically as an automaton can. It's too easy to subvert an automaton for me to ever sign an automaton's PGP key.

This is the point I am trying to make. When I sign a key, I do not say ANYTHING about how that key will be used -- I am only saying that I know that that key is what it claims to be. I know that this key belongs to this user, this name, this email-address, this server. I don't know that if I sign your key you will then use it to send threatening email to president@whitehouse.gov. And personally, I don't care -- that shouldn't be a consideration in my signing your key. Phil signed the Betsi key because to his knowledge that key really belonged to the Betsi server. Just like I will sign the MIT PGP Keysigner key because I will know that it belongs to that identity. As to how much trust I put in these keys to sign other keys is a determination that I make orthogonal to the question of signing the key. I happened to write the keysigner software, so I know what it will do -- but that is me -- you don't have to trust it if you don't want to. I think the problem here is that you are combining a number of orthogonal decisions into a single one. These decisions are: 1) trust in userID to sign a key 2) trust in that key to sign others 3) trust in the usage of that key. These are distinct for a reason, and should be kept that way. If you want to lump them together, that is your perogative, but that is not something that can be, or should, be enforced. - -derek -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBuAwUBLpNg7zh0K1zBsGrxAQGETQLECyKXVFNnai1otoSH3IMungYtXqR+y4gj LFyIa0iIhMgTMYI0tCFs4RmG3pwO83qCoaLRbGdJ5IpjbepqbUHKDwFm0AB7Z43I x2s2A+HjqTtEu5XaNV1qGvg= =4urS -----END PGP SIGNATURE-----