-----BEGIN PGP SIGNED MESSAGE----- Carl Ellison <cme@clark.net> wrote: Ed Carp wrote:

Subject: Re: crypto for porno users To: khijol!clark.net!cme@uunet.uu.net (Carl Ellison) Date: Thu, 23 Nov 1995 15:57:17 -0600 (CST) Cc: khijol!got.net!edge@uunet.uu.net, khijol!toad.com!cypherpunks@uunet.uu.n et

totally different from this "web of trust" I keep hearing about - and that i s *it*. Do you trust me any more now than before I started signing my posting s?

Actually, in my view, signed postings are the first step. With those (and the right S/W (not there yet)), I get to know that a bunch of postings came from the same person. I even know who they came from: the person who is capable of signing with key 0xXXXXXXXX. I hate to point this out, but that isn't true. Anyone can create a key with any chosen keyid and attach the same publicly known name to it. (see, eg., the key I signed this with, given below). The only unforgeable things about a particular key are: 1. The key itself (you know, the product of the primes), 2. The key fingerprint (unless MD5 is compromised) and 3. The web of trust leading to that key. So, in practice, you actually have to look at the key fingerprint of the key used to sign a message, if you want to be sure of the uniqueness of that key. Or you have to only trust keys that come well-introduced. Back to the Web of Trust. Since the only way I have of getting to know the person is through those postings, I get to know that person and through that knowledge I decide whether or not to trust. I've been trying to think of the possible ramifications of spoofing people's names and keyids on a large scale. And a large scale is certainly possible -- it only took me about an hour to create this key. I was originally intending to use this key as part of a real project, to gain attention to the project, but the more I thought about it the more I worried about the implications. This "coming out" invalidates any chance of that happening. There are two bad things I can think of. Suppose I want to somehow attack Fred. I can create a key with the same ascii text associated with it very easily. With only a little more effort, I can also duplicate the keyid. PGP adds new keys at the front of the keyring, so if I start distributing this new key widely, it will appear in keyrings before the "real" Fred's. Whenever this happens automatically, there is some possibility that the wrong key will be used for some operations. PGP doesn't help much, because it is hard to specify the key unambiguously in this case. PGP uses more than just the visible part of the keyID. So at least it will choose the right key to verify signatures, right? Maybe not. I can apply the same spoofing technique to the whole internal keyID, and generated a key that even PGP can't tell is the wrong one. I think that when PGP tried to check the signature on a message from the "real" Fred that it would notice that it had applied the wrong key, but I'm not absolutely sure on this point. Anyway, an inattentive or somewhat automated user will merely notice that the document signature fails to check out, essentially slurring the "real" Fred's reputation. Any other possible attacks? Greg. Greg Rose INTERNET: greg_rose@sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMLkSAqaauZzerb7vAQFpbgP+KpPj1SH746nmJca3VmEGU13t/enQL5GT FmCGHqnqI757GRNOiHMXnNe8mMdwMn67UgxU/3a7R/UU7rspGH3P/IrmDH0NnDHG z5QuhQcutgswz7ncNeuUxi6BRHP12SM/aNnLqCmT308zd1sL1BNL/CUgPdxNBnFT kCe5dS0FVaI= =mopc -----END PGP SIGNATURE----- -----BEGIN PGP MESSAGE----- Version: 2.6.2i lQHgAzBrI8cAAAEEANQqR/iaxVP8FZ5CKqI2hcYFFyWAsnNmsZsPi+nOehI1nMyi PBzX1PPBh8pCAS+0mrUqKKUp2ArCS6n6Ph/R2VjHsqq8HFKOT14Md3C6/M15SKDV ODcgKvfZf7gs6KEhPqcCS1P8OpGQWRczE1nTxYAw65bBRpDg7KaauZzerb7vAAUR Adj6LAUodVxLA/4dxjQlaNqaJp5ElB0amAQ81/9Zah4Zf1j8CLVw08g5Kz4oK3hJ dx61pjBJ2fag1/UUM6y9gIT5yL0ErK+KQ1sPdvZPe5p5JEhCV2tlqlT+d1iPdEiN x7t986et7Zb91T+UsEyLLaTxQMKk4obDb2IvJvKgcvNm+wRW5rGNXitpRQIAGmTd ypkNQIwWq07d+QNaFUYgTl8ZQfX078a6VMPl2DQni6uLmvUvgI3VHW8oTcpyqu5j mJt0FTkeGMA0lKQa5AIA//fzyVUXGJEKkXIBkfCJ/F1V4dMsfZ/3z73RiNtKl46p lMTztn/cCEUoE+GwonQhkJUnAXbBYtFifisyVf92ngH/u7YxY+z4T2SrhsYj+oGc Ox/T2VlugUYPowQr3070OoHrrd7icwXNU69nHkle7/jnFjMTvDSZrPYZiXFa0yhV 0apCtBBQcmltZSBSaWIgTG92ZXJziQCVAwUQMLkLB6aauZzerb7vAQEHyAQApGgP xyUR71jntGeir3yJpcBAEVkmqXLYZPb83dzVlWh7HHQmTiyE/rrcJT7NZRZGA8X7 TTPMZnITDETdwFVIkznvY8v7DWGXD8SD0LNlE61lzhmhNvsfUmQ/q4YHrCERb31P 56TPaveSwYlkPanOYLLJ7m47KICP0z3jzNgwqRo= =DLC7 -----END PGP MESSAGE-----