2
$\begingroup$

I am new to PGP/GPG and I am somewhat confused by the idea of the Web of Trust (WoT). Isn't signing a public key with its private key enough to prove the ownership of it? if it is so, why don't key servers just do that before storing the keys instead of relying on users to trust each other?

$\endgroup$
2
  • $\begingroup$ Btw, the idea of the WoT is dead: gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f $\endgroup$
    – dirdi
    Dec 22, 2019 at 13:22
  • $\begingroup$ @dirdi It isn't dead, it just doesn't scale well. And your link to information about the key server attacks is irrelevant, especially since there are more ways to distribute keys. $\endgroup$
    – forest
    Dec 24, 2019 at 4:34

1 Answer 1

1
$\begingroup$

In short, it is not about proving that you have any key, it is proving that this key is bound to a specific entity. The identity of the person submitting the key must be established.

The server doesn't know which keys to trust. It can sign any key, but what would be the point of that? The idea is that users can verify by other means that the key is trusted and belongs to the person submitting the request. Verification over the phone (using the key fingerprint) or even receiving expected messages at a particular time could do that. Otherwise an adversary can inject a public key belonging to their own key pair, using your identity information.

If you start just signing keys - without making sure that you can trust that the key belongs to a person - then you're actually poisoning the server. It is important to keep that in mind and give your friends / colleagues a call if you suspect anything is wrong. Certainly do verify that keys belong to the right entity when they have not yet been sufficiently verified by others.

$\endgroup$
1
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – Maarten Bodewes
    Dec 12, 2019 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.