Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In this post on Cryptome it's noted that a person called Michael Vario is willy-nilly signing people's public key's and uploading those signatures. He is effectively forging a web of trust. I'm sure this kind of thing has been done before.

It occurred to me that if the public key servers could be asked to return public keys with only those signatures that are reciprocal we would perhaps have a more realistic picture of who trusts who. With this feature enabled Vario's signatures wouldn't appear in any of the keys that he's signed and his effort would be for naught.

Would this key server feature be useful?

Would we also need some additional options/messages in GnuPG to make it clear when you might be looking at an "unauthenticated" signature?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Would we also need some additional options/messages in GnuPG to make it clear when you might be looking at an "unauthenticated" signature?

Hopefully I'm not stating the obvious.

OpenPGP does not trust keys simply because lots of people have signed them. You must "set ownertrust" for the keys you have before they will be used in Web of Trust calculations.

This related answer has some good information about how the Web of Trust is calculated.

He is effectively forging a web of trust.

Nope.

If you haven't trusted Michael Vario's key, then you have nothing to worry about. It's just spam.

If somebody you know is verifying a key by any method other than Web or Trust or verifying the fingerprint with the owner, they are using PGP wrong. End of story.

It occurred to me that if the public key servers could be asked to return public keys with only those signatures that are reciprocal we would perhaps have a more realistic picture of who trusts who.

Perhaps this would be useful, but I personally see it as unnecessary. PGP is complex enough as it is :)

Sidenote: If you trust a key enough for the purposes you are using it for but you don't trust it enough to "put your name on", you can perform a "local signing" that will be considered for Web of Trust calculations that won't be exported to any keyservers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.