Well, it is true that you have built up a reputation on the list. I am trying to do the same. Quite an interesting experience. It seems to me that we have an interesting dilemma here. If we are willing to sign a key based on an entity that we KNOW does not really exist, then what does a signature mean? You have been an active and productive participant on cypherpunks for quite some time now, so if that's what I'm saying by signing your key, then I would be willing to. Off line methods wouldn't work in this case because we aren't real. Something strange is going on in the word when nym's are signing each other's keys... I am going to register my public key as you suggested. If you send me a signed copy, I will add it to my keyring. Please send me your public key, and I will sign it for you. The world is becoming a more interesting place. Wonderer p.s. I believe something may be wrong with my pgp here at my oranization. I type: pgp -sat file -u wonderer +cleartext=on as someone on the list suggested, and this does not work. What command do you use to sign your messages? I will include a detached signature of this message below. -----BEGIN PGP MESSAGE----- Version: 2.3 iQBVAgUALM/wPh1kTJuroDD9AQEq5AH+Nxou8vx4F3JsDhSDvUpy6P0yvXz2Be/F Q32ZwM+AiBD/Sijb/XX3Z2jixDTWP/xs/lr2Iw1tmbK8RBWS4iZDLQ== =rjX8 -----END PGP MESSAGE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help@anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin@anon.penet.fi.
If we are willing to sign a key based on an entity that we KNOW does not really exist, then what does a signature mean?
The key is the identity, period. Let's get that straight up front. Signing a key does not change the identity. Signatures on keys are attestations that the key belongs to some person or email address. Signing a key attests that an identity has a name. I've developed a criterion for signing pseudonym keys. The only party (other than the holder) who can gain any certain knowledge that an e-mail address maps to the holder of a given key is the provider of the e-mail address. In other words, Julf's server should sign wonderer's key. The following applies to any system providing pseudonyms, i.e. mail addresses. The mail server should have a public key. The public key of a user would be encrypted with the server's public key and forwarded to the server. The server would accept as authentication of this public key the same authentication that it accepts for everything else. Once it has the key, it can sign it and return it to the individual, who can then publish it.
Something strange is going on in the word when nym's are signing each other's keys...
The one pseudonym is attesting that they reach the same individual each time they send mail to the other pseudonym encrypted with the public key claimed by that other pseudonym. This attestation is not as strong as person-to-person contact, but as long as the signer reasonably believes that mail delivery system functions as it claims to, i.e. no interposers, the signature does actually mean something. Eric
participants (2)
-
an41418＠anon.penet.fi -
hughes＠ah.com