I am new to PGP/GPG and I am somewhat confused by the idea of the Web of Trust (WoT). Isn't signing a public key with its private key enough to prove the ownership of it? if it is so, why don't key servers just do that before storing the keys instead of relying on users to trust each other?

  • $\begingroup$ Btw, the idea of the WoT is dead: gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f $\endgroup$ – dirdi Dec 22 '19 at 13:22
  • $\begingroup$ @dirdi It isn't dead, it just doesn't scale well. And your link to information about the key server attacks is irrelevant, especially since there are more ways to distribute keys. $\endgroup$ – forest Dec 24 '19 at 4:34

In short, it is not about proving that you have any key, it is proving that this key is bound to a specific entity. The identity of the person submitting the key must be established.

The server doesn't know which keys to trust. It can sign any key, but what would be the point of that? The idea is that users can verify by other means that the key is trusted and belongs to the person submitting the request. Verification over the phone (using the key fingerprint) or even receiving expected messages at a particular time could do that. Otherwise an adversary can inject a public key belonging to their own key pair, using your identity information.

If you start just signing keys - without making sure that you can trust that the key belongs to a person - then you're actually poisoning the server. It is important to keep that in mind and give your friends / colleagues a call if you suspect anything is wrong. Certainly do verify that keys belong to the right entity when they have not yet been sufficiently verified by others.

| improve this answer | |
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – Maarten Bodewes Dec 12 '19 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.