[47865] in Cypherpunks
Re: Who would sign Lucky Green's key?
daemon@ATHENA.MIT.EDU (Kevin L Prigge)
Wed Jan 24 12:42:12 1996
From: Kevin L Prigge <Kevin.L.Prigge-2@cis.umn.edu>
To: shamrock@netcom.com (Lucky Green)
Date: Wed, 24 Jan 1996 11:37:36 -0600 (CST)
Cc: cypherpunks@toad.com
In-Reply-To: <v02120d57ad2b890610eb@[192.0.2.1]> from "Lucky Green" at Jan 23, 96 11:24:42 pm
-----BEGIN PGP SIGNED MESSAGE-----
Lucky Green said:
>
> The latest discussion about key signing parties and related questions asked
> in private email got me thinking about signing keys for nyms. What would
> one have to know to sign a key for a nym? Would you sign my key? Why?
>
>
> -- Lucky Green <mailto:shamrock@netcom.com>
> PGP encrypted mail preferred.
My signing your key would indicate that I know that your key is
owned/controlled by you. With a nym it is different than with a
true name, because there is no physical way that you can convince
me that you are "Lucky Green", i.e. I doubt that you have any
identification that has your nym and a picture, for instance.
That being said, can I be satisfied that the person posting from
shamrock@netcom.com, calling themselves Lucky Green is in fact
the person that controls the key 0xB7F2BC05? When I finger the
account, I get the public key block for that nym, the same public
key that is on keyservers. I also have e-mail from that account to the
cypherpunks list signed with that key.
When I sign a key, I get the following question from PGP:
READ CAREFULLY: Based on your own direct first-hand knowledge, are
you absolutely certain that you are prepared to solemnly certify that
the above public key actually belongs to the user specified by the
above user ID (y/N)?
The answer to that question is yes, in a nym sense, at least for me.
By nym sense I mean that as far as the key is concerned, by
all the means available to certify a 'person' that only
exists in cyberspace I am satisfied that the key belongs to
the nym. In the case of nyms, direct first-hand knowledge for
me doesn't include physically meeting the key owner, as the
nym doesn't exist in the physical sense.
It's problematic, because a signature means different things
to different people. In a strict CA heirarchy the CA can require
that the key owner identify themselves in a uniform manner, i.e.
photo ID, fingerprints, etc. In a web of trust, where a key signature
is only as good as your trust of the signer, each signer has his or
her own method of determining identity. Thats why I don't trust
key signatures absolutely, they just indicate to me that at some
time the signer verified with some means that the key in question
belongs to the user. "Some means" is a vague phrase, one that I
wouldn't bet money on, but it raises my level of trust, especially
in cases where I know the signer. I don't think that a web of trust
will ever provide me 100% instant trust of a key based on a
signature, but it can raise my comfort level of the authenticity
of a key.
- --
Kevin L. Prigge |"Have you ever gotten tired of hearing those
UofM Central Computing | ridiculous AT&T commercials claiming credit
email: klp@tc.umn.edu | for things that don't even exist yet?
010010011101011001100010| You will." -Emmanuel Goldstein
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBMQZuXL/AoMO4c8FhAQGiEgP+NmR/Tl7QZ5AXnVDXgMC7PcYyd9FEClfm
wr1QYazf7uC0SqdvSpmIsHwCvQNjqmJ/i32q4G0053YYvItCRNihGnbDDQ2iw6vl
N6ruzDdNeNKfb9XIe6WIxnrGLRiXZg0a0eXy4tj2sLYopiNSbJIy5aYmnkhAPRj5
7p0z04qwYxE=
=ZQtp
-----END PGP SIGNATURE-----
