Re: June 18th SF C'punks meeting: export controls on trial
... There will also be a regular 2nd-Saturday c'punks meeting this month (I think it's at PGP, Inc.)
Hi all; I haven't seen the agenda yet, but if there is time & interest, I would be willing to organize a PGP key-signing party. Signify interest by mailing your key -- or a pointer to it -- to me by Friday. Come to the c'punks meeting with photo ID and your PGP fingerprint. It would also be way cool if we could get some of the folks at PGP Inc. to join in. More info on key-signing parties will be at www.best.com/~falconer/keyparty.html by tommorrow. -ed falk
["cypherpunks-announce@toad.com" deleted as that is really not a list for discussions.] At 4:23 PM -0700 6/11/97, Ed Falk wrote:
Hi all; I haven't seen the agenda yet, but if there is time & interest, I would be willing to organize a PGP key-signing party.
Signify interest by mailing your key -- or a pointer to it -- to me by Friday. Come to the c'punks meeting with photo ID and your PGP fingerprint.
"Sigh." Why do people persist in thinking that a photo ID is useful for PGP keysignings? I view a keysigning as saying that the person I know as "Lucky Green" is asking me to sign the key he presents as his key, not whether Missouri issued him a driver's license in that name, nor whether the company he worked for in Munich issued him a photo ID under than name. This is what the "web of trust" is all about. It is _not_ about True Names as proved by photo IDs. (However, for those lacking photo IDs sufficient for Ed's purposes, I'm asking Eric Hughes (not his True Name) if I can borrow his badge laminator. I'll set it up outside the keysigning room. Bring a photo of some sort and I'll make you a Yoyodyne Corporation employee badge.) --Tim May (not his True Name) There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
Tim May <tcmay@got.net> writes:
(However, for those lacking photo IDs sufficient for Ed's purposes, I'm asking Eric Hughes (not his True Name) if I can borrow his badge laminator.
Is that the long-haired guy I had a dinner with once? How time flies. - Timmy May --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps
Tim May said:
"Sigh." Why do people persist in thinking that a photo ID is useful for PGP keysignings? Because _these_ people _are_ binding true names to keys. That's what _this_ is about.
These people are saying "I know of sufficient proof that this person is who they say they are". You can do this with a person you know without the aid of photo id, even if the "true name" isn't in the key. Alternatively, (as is the case here) you can verify the identify of unknown people with sufficient photo id. And so each person becomes their own Verisign... That sounds a lot like the web of trust... each person assigns a certain amount of trust to others... If I believe that Joe makes absolutely certain that any key he signs is valid then I assign him a high trust. If Joe chooses to sign somebody's key because he saw five forms of ID and did a credit check, spiffy. If Joe signs a key because it happens to be his brother, even better. But the point is that I trust Joe. How people choose to verify other's identity is somewhat irreverent. More important, I think, is the question of who to trust. So Tim, if you think that photo ID is a poor method of verifying someone's identity, doesn't sign a key on that alone. Also make sure that the people you assign trust to have the same ideas about photo id. For others who don't share your thoughts on this matter, they can feel free to trust photo ID. And still others can trust them (thus trusting photo ID by proxy)... But that's what the web of trust is about. Each person can trust different things (and people)... I think that's what makes the web of trust so flexible. Each person is free to choose who and what they trust. Josh -----------------------------Joshua E. Hill----------------------------- | You never find a lost article until you replace it. | ------------------------jehill@w6bhz.calpoly.edu------------------------
At 8:31 AM -0700 6/12/97, Bill Frantz wrote:
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key. You are saying that the secret key holder is (one of the) person(s) who has access to that account, and not some man in the middle in the middle. If you ask to see Lucky Green's, or Futplex's, or Black Unicorn's picture ID, you will either see a forgery or an ID issued by an organization not interested in birth certificates.
I am fairly often accused of being arrogant, of being a "know it all." I have never claimed to be an expert on PGP, and I certainly am not. I use the MacPGP version which became available in '92, and will eventually star t working with PGP 5.x (which I have, and have installed, but not spent much time with). I generated a 1024-bit key in '92, right after PGP 2.0 appeared, and participated in a key signing, etc., shortly thereafter. It happened that my ISP at that time had just changed from Portal to Netcom. (Now it's "got.net", a fairly typical local provider of non-shell ISP services.) I can't understand (hint: someone please explain) why I get so many requests to send the "tcmay@got.net" key, as opposed to the "tcmay@netcom.com" key so widely available. I thought the key signings were about the Person Widely Known as "Tim May" being associated with the key signed, not some temporary e-mail address. My binding was between the key, and "me." Those who wanted to send messages to "me" could assume that only "I" could read it. The address "tcmay@netcom.com" vs. "tcmay@got.net" is not central. Any concern that "tcmay@got.net" is somehow not the keyholder of that '92 key is a nonissue. If the keyserver databases focus on such ephemera as the current ISP account, then they are focussing on the wrong things. Am I missing something central? --Tim May, whose e-mail deliverer has changed a few times, but whose key remains constant. Which is more important? There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
Tim May wrote:
I can't understand (hint: someone please explain) why I get so many requests to send the "tcmay@got.net" key, as opposed to the "tcmay@netcom.com" key so widely available. I thought the key signings were about the Person Widely Known as "Tim May" being associated with the key signed, not some temporary e-mail address.
You get so many requests to send the "tcmay@got.net" key because certain pgp-aware email programs can encrypt mail using the recipient address, if it is in the sender's keyring. Therefore, it is more convenient if the addressee's email address is in the user id field. - Igor.
-----BEGIN PGP SIGNED MESSAGE----- In <v03102800afc652637f93@[207.167.93.63]>, on 06/12/97 at 06:47 PM, Tim May <tcmay@got.net> said:
At 8:31 AM -0700 6/12/97, Bill Frantz wrote:
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key. You are saying that the secret key holder is (one of the) person(s) who has access to that account, and not some man in the middle in the middle. If you ask to see Lucky Green's, or Futplex's, or Black Unicorn's picture ID, you will either see a forgery or an ID issued by an organization not interested in birth certificates.
I am fairly often accused of being arrogant, of being a "know it all." I have never claimed to be an expert on PGP, and I certainly am not. I use the MacPGP version which became available in '92, and will eventually star t working with PGP 5.x (which I have, and have installed, but not spent much time with).
I generated a 1024-bit key in '92, right after PGP 2.0 appeared, and participated in a key signing, etc., shortly thereafter. It happened that my ISP at that time had just changed from Portal to Netcom. (Now it's "got.net", a fairly typical local provider of non-shell ISP services.)
I can't understand (hint: someone please explain) why I get so many requests to send the "tcmay@got.net" key, as opposed to the "tcmay@netcom.com" key so widely available. I thought the key signings were about the Person Widely Known as "Tim May" being associated with the key signed, not some temporary e-mail address.
My binding was between the key, and "me." Those who wanted to send messages to "me" could assume that only "I" could read it. The address "tcmay@netcom.com" vs. "tcmay@got.net" is not central. Any concern that "tcmay@got.net" is somehow not the keyholder of that '92 key is a nonissue.
If the keyserver databases focus on such ephemera as the current ISP account, then they are focussing on the wrong things.
Am I missing something central?
Well yes, :) There are different levels of trust and authentication in the web of trust. Many (most?) people using PGP will never physically meet and authenticate keys. Their security model does not require this. Instead what PGP is used for is a verification method that I am talking to the same person at tcmay@got.net in my correspondance even though I do not know who he is physically. So over a period of time of exchanging PGP signed messages I can authentincate that all of these messages are all comming from tcmay@got.net who claims to be Tim May. I know that this is not much but at least I know it's not Dimitri or someone else forging the messages from that account (though I don't know if all this time tcmay@got.net has really been one of Dimitri's accounts and that Tim May is really dead). I also use PGP to sign all my distributed source code & binaries for my programs. I also sign all my posts. My sharware customers can verify that the software if from me and unmodified and can also verify any public post regarding the software. Depending on how concerned on this they may be satisfied that seeing the code signed with the same key that I use for my mailing list and in all my public post as enough authentication that the code is valid (though there is nothing preventing them from taking stronger methods of authentication upto and including flying down to FL and meeting me in person). You also have PGP add-on software that does lookups of keys by e-mail address. This is a convient feature if one is working with large keyrings. You do run into the problem of e-mail addresses changing and having multiple keys with the same address. In my software I make use of a default file where a key can be assinged to an e-mail address regardless of what is in the userid. YMMV with other software, from my own testing I have found that most will either take the first key found with duplicats or complain of "no key found" with address changes. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6C/hY9Co1n+aLhhAQGDzgQAr85CR5eIFZCFaM/pTGnt5c14x0HUYJJD Muk7xEyR23cIZP9lrWyq+3IsIfk10sR+rLl2Ip05mwSFOasd1FRyuAIVv6vM6Ovm 3m3nSBfHwP0hQtwwrnCCFlOxScBuWjiSn8Pu/r2yhd6A1+vU8D+JeWe9VuPsDRv7 IRMeLadpvC8= =1Fl1 -----END PGP SIGNATURE-----
On Thu, 12 Jun 1997, Tim May wrote:
I can't understand (hint: someone please explain) why I get so many requests to send the "tcmay@got.net" key, as opposed to the "tcmay@netcom.com" key so widely available. I thought the key signings were about the Person Widely Known as "Tim May" being associated with the key signed, not some temporary e-mail address.
Have you set up another userid on the key and resubmit it to the key servers and avoid the confusion.
My binding was between the key, and "me." Those who wanted to send messages to "me" could assume that only "I" could read it. The address "tcmay@netcom.com" vs. "tcmay@got.net" is not central. Any concern that "tcmay@got.net" is somehow not the keyholder of that '92 key is a nonissue.
Most people out there only know you via your e-mail address. How do they know if "tcmay@netcom.com" is the same as "tcmay@got.net" and not "mallet@nsa.gov"? When looking for someone's key, most people look by e-mail address. (It is the only "unique" id other than key id or fingerprint that people have to go on.)
If the keyserver databases focus on such ephemera as the current ISP account, then they are focussing on the wrong things.
What do you want keyservers to go on? You have to have some way of obtaing the keys for an individual. It could be some other Tim May out there. (Name collision is pretty common, especially since everyone and his extended family are getting on the net.)
Am I missing something central?
--Tim May, whose e-mail deliverer has changed a few times, but whose key remains constant. Which is more important?
Uh... Making the key reflect you address so people can find it... Or as was said in Dr. Strangelove "It is not a deterent if you keep it a secret!". alano@teleport.com | "Those who are without history are doomed to retype it."
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key. You are saying that the secret key holder is (one of the) person(s) who has access to that account, and not some man in the middle in the middle. If you ask to see Lucky Green's, or Futplex's, or Black Unicorn's picture ID, you will either see a forgery or an ID issued by an organization not interested in birth certificates. ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz@netcom.com | from hostile governments. | Los Gatos, CA 95032, USA
Bill Frantz said:
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key.
I think that you are signing the data, but not quite the description area. I think you are signing the key. Something like the statement "I believe that anything signed by this key came from the person known as 'X'". This could be an e-mail address, pseudonym a DNA sequence, or whatever... The key (and hopefully the binding between the key and the person in meat space) is what remains constant... not necessarily what the person chooses to go by. Josh -----------------------------Joshua E. Hill----------------------------- | Quantized Revision of Murphy's Law: | | Everything goes wrong all at once. | --------------------------jehill@w6bhz.calpoly.edu----------------------
At 6:47 PM -0700 6/12/97, Tim May wrote:
At 8:31 AM -0700 6/12/97, Bill Frantz wrote:
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key. You are saying that the secret key holder is (one of the) person(s) who has access to that account, and not some man in the middle in the middle. If you ask to see Lucky Green's, or Futplex's, or Black Unicorn's picture ID, you will either see a forgery or an ID issued by an organization not interested in birth certificates.
My binding was between the key, and "me." Those who wanted to send messages to "me" could assume that only "I" could read it. The address "tcmay@netcom.com" vs. "tcmay@got.net" is not central. Any concern that "tcmay@got.net" is somehow not the keyholder of that '92 key is a nonissue.
My answer was a pure SPKI answer. As a first approximation, in SPKI your identity is your key. Meatspace doesn't enter into it at all. This avoids the naming problem of meatspace (i.e. Which John Smith). Much of the problem with PGP key signing is there is no complete agreement on what it means. I chose to have it mean that there verification of the binding between the data associated with the key and the key. If you have a version of the key with no signatures, then you can change the data field and re-sign with the associated secret key. Since the data field has changed, you properly need to have others re-verify the validity of the binding. ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz@netcom.com | from hostile governments. | Los Gatos, CA 95032, USA
-----BEGIN PGP SIGNED MESSAGE----- In <v0300786dafc68637a08c@[207.94.249.152]>, on 06/12/97 at 10:14 PM, Bill Frantz <frantz@netcom.com> said:
At 6:47 PM -0700 6/12/97, Tim May wrote:
At 8:31 AM -0700 6/12/97, Bill Frantz wrote:
IMHO - What you are really signing is the binding between the data associated with the key (usually an email address) and the key. You are saying that the secret key holder is (one of the) person(s) who has access to that account, and not some man in the middle in the middle. If you ask to see Lucky Green's, or Futplex's, or Black Unicorn's picture ID, you will either see a forgery or an ID issued by an organization not interested in birth certificates.
My binding was between the key, and "me." Those who wanted to send messages to "me" could assume that only "I" could read it. The address "tcmay@netcom.com" vs. "tcmay@got.net" is not central. Any concern that "tcmay@got.net" is somehow not the keyholder of that '92 key is a nonissue.
My answer was a pure SPKI answer. As a first approximation, in SPKI your identity is your key. Meatspace doesn't enter into it at all. This avoids the naming problem of meatspace (i.e. Which John Smith).
Much of the problem with PGP key signing is there is no complete agreement on what it means. I chose to have it mean that there verification of the binding between the data associated with the key and the key.
If you have a version of the key with no signatures, then you can change the data field and re-sign with the associated secret key. Since the data field has changed, you properly need to have others re-verify the validity of the binding.
I don't think that any changes that he would make to his key would need re-verification provided that he signed those changes. Take the following scenario: John Doe creates a key and signs it: pub 2048/FFFFFFFF 01/01/90 John Doe sig John Doe (0xFFFFFFFF) Now 3 other people verify that the key does belong to John Doe and sign the key: pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) Now John adds an aka to his key and signs it. pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) aka John Doe john.doe@who-is-it.com sig John Doe (0xFFFFFFFF) Since John Doe is the only one who could sign the key with the new aka one can assume that the aka is as valid as the original userid. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6Debo9Co1n+aLhhAQEOHwP/X5d2qrBCLP/z/zFkf1XDcPJ/ztkwNQ2W qbFUo+S/ZY9vPCXezs6dCZZfSW3WrRnpmOXQjrSK9qcps6Eafhqs4G96v3bCCzVL /wjFV+SZigTMyGqBMv9yscYM8o2KnZSvv2ajsIJLbxgoeLAnNvWXIrB2ls21ydSe k/rXTVnwK/E= =wXYL -----END PGP SIGNATURE-----
At 10:33 PM -0700 6/12/97, William H. Geiger III wrote:
In <v0300786dafc68637a08c@[207.94.249.152]>, on 06/12/97 at 10:14 PM, Bill Frantz <frantz@netcom.com> said:
If you have a version of the key with no signatures, then you can change the data field and re-sign with the associated secret key. Since the data field has changed, you properly need to have others re-verify the validity of the binding.
I don't think that any changes that he would make to his key would need re-verification provided that he signed those changes. Take the following scenario:
John Doe creates a key and signs it:
pub 2048/FFFFFFFF 01/01/90 John Doe sig John Doe (0xFFFFFFFF)
Now 3 other people verify that the key does belong to John Doe and sign the key:
pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC)
Now John adds an aka to his key and signs it.
pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) aka John Doe john.doe@who-is-it.com sig John Doe (0xFFFFFFFF)
Since John Doe is the only one who could sign the key with the new aka one can assume that the aka is as valid as the original userid.
So if John Doe wants to be known as "president@whitehouse.gov" or "Tim May <tcmay@got.net>" all he has to do is change the field, and upload the changed key to the key servers, and all the signatures should remain good? ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz@netcom.com | from hostile governments. | Los Gatos, CA 95032, USA
-----BEGIN PGP SIGNED MESSAGE----- In <v03007874afc71e205651@[207.94.249.152]>, on 06/13/97 at 11:00 AM, Bill Frantz <frantz@netcom.com> said:
At 10:33 PM -0700 6/12/97, William H. Geiger III wrote:
In <v0300786dafc68637a08c@[207.94.249.152]>, on 06/12/97 at 10:14 PM, Bill Frantz <frantz@netcom.com> said:
If you have a version of the key with no signatures, then you can change the data field and re-sign with the associated secret key. Since the data field has changed, you properly need to have others re-verify the validity of the binding.
I don't think that any changes that he would make to his key would need re-verification provided that he signed those changes. Take the following scenario:
John Doe creates a key and signs it:
pub 2048/FFFFFFFF 01/01/90 John Doe sig John Doe (0xFFFFFFFF)
Now 3 other people verify that the key does belong to John Doe and sign the key:
pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC)
Now John adds an aka to his key and signs it.
pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) aka John Doe john.doe@who-is-it.com sig John Doe (0xFFFFFFFF)
Since John Doe is the only one who could sign the key with the new aka one can assume that the aka is as valid as the original userid.
So if John Doe wants to be known as "president@whitehouse.gov" or "Tim May <tcmay@got.net>" all he has to do is change the field, and upload the changed key to the key servers, and all the signatures should remain good?
Well remember that John Doe is only adding an AKA to his key not deleteing the old userid and replacing it with a new one. This is very important. pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) aka John Doe president@whitehouse.gov sig John Doe (0xFFFFFFFF) If he were to remove the old userid and replace it with a new one you would have: pub 2048/FFFFFFFF 01/01/90 John Doe president@whithouse.gov sig John Doe (0xFFFFFFFF) without any autheticating signatures. The first case all we have is a change of address while in the second we have a change of identity. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6FypY9Co1n+aLhhAQEa6QP9EqFGKkAddZMmNFt6hcU8VbIrcqN5toia vUXHsUjL+3BPhddyGc0qU2q8GqsBEvqklPYFGfT1nYAI8/v4J1Qd81gOLvxEvnrZ FUeFersILXJBQ1VYHhvhUoTKT3CyDg1PbrwYPIlyksEYbFSv+anxIywQGF58XXRh VtonV7HFyiU= =wy43 -----END PGP SIGNATURE-----
On Fri, 13 Jun 1997, Bill Frantz wrote:
pub 2048/FFFFFFFF 01/01/90 John Doe john.doe@anonymous.com sig John Doe (0xFFFFFFFF) sig Mary Jane (0xAAAAAAAA) sig Tom Thumb (0x11111111) sig Tiny Tim (0xCCCCCCCC) aka John Doe john.doe@who-is-it.com sig John Doe (0xFFFFFFFF)
Since John Doe is the only one who could sign the key with the new aka one can assume that the aka is as valid as the original userid.
So if John Doe wants to be known as "president@whitehouse.gov" or "Tim May <tcmay@got.net>" all he has to do is change the field, and upload the changed key to the key servers, and all the signatures should remain good?
Well, no, not really. See, the way PGP handles keys (at least the RSA keys) makes it very difficult to remove an id once it's hit a keyserver. Oh yeah, a signature also encompasses the key-id that you sign when you sign the key. So the signatures would fail if the key-id they referred to was drastically changed... ----------------------------------------------------------------------- Ryan Anderson - <Pug Majere> "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso@ece.eng.wayne.edu Ohio = VYI of the USA PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 -----------------------------------------------------------------------
participants (9)
-
Alan -
Bill Frantz -
dlv＠bwalk.dm.com -
Ed.Falk＠Eng.Sun.COM -
ichudov＠Algebra.COM -
Joshua E. Hill -
Ryan Anderson -
Tim May -
William H. Geiger III