I understand that it is a system that "establishes the authenticity of the binding between public keys and their owners", but how does one join this web of trust? Do you have to physically meet one of the existing members, and they can get you in?
The PGP Web of Trust is a decentralized trust model in which individuals vouch for one an other's identities using public key cryptography. Some OpenPGP software, such as GnuPG, offer trust configuration options so that Alice who vouches for Bob's identity can verify Carol's identity if Alice trusts Bob's signature on Carol's public key. As of 2020, signatures generated by OpenPGP keys are used by the following organizations (mostly software development from what I can tell) to identify actions (usually version control software operations such as
git commit) by specific members.
- Debian - Used by developers to physically verify identity of new developers and automatically verify integrity of software upgrades.
- Bitcoin Core - Used to verify integrity of version control and software releases.
- Veracrypt, others. - Used to verify integrity of software releases.
As mentioned by SAI Peregrinus and this roadmap for Thunderbird 78, existing public key servers (centralized 3rd parties that receive and transmit public keys and signatures sent by anyone to anyone) were shown not to be scalable in 2019 (see SAI Peregrinus' links). However, key servers are not explicitly required by the Web of Trust concept since individuals may still share public keys in a more decentralized fashion (ex: in email attachments as mentioned by the Thunderbird roadmap).
That said, coordination websites for individuals interested in sharing public keys are available such as keybase.io (like Twitter) or biglumber.com (for physical meetups). Personally, I've met and generated several cross-signatures with people using the biglumber.com RSS feed while on vacation or by attending conferences such as the Southern California Linux Expo.
The general etiquette of signing keys is to verify eachothers' identities by either long relationship history or using government identity documents for people you've never met before. Then, you give each other a piece of paper with your PGP key's 40-character hexadecimal fingerprint on it and a note to yourself to remind you when you get back to your computer that you did in fact verify their identity. When you tell your computer to do the signing, make sure PGP software is properly configured to avoid using outdated algorithms. A PGP key generated by a fresh Debian 10.4 install with no custom configurations (tested just now in a virtual machine via
$ gpg --gen-key,
$ gpg --edit-key, and
gpg> showpref) uses
rsa3072 with preferences:
Cipher: AES256, AES192, AES, 3DES Digest: SHA512, SHA384, SHA256, SHA224, SHA1 Compression: ZLIB, BZIP2, ZIP, Uncompressed Features: MDC, Keyserver no-modify
The web of trust is no longer active. It was removed in GPG version 2.2.17.
The way it worked was that people would meet in person and sign each other's keys, then upload those keys and signatures to a network of "keyservers". Or maybe they'd just verify that email could be delivered to the other person. Or sign whatever they were asked to with no verification. In theory you could likely find some path of signatures back to a signature by someone you trust, thereby letting you establish a chain of authentication to believe that a key belonged to a given person, as long as everyone in the chain always actually did verification of all the keys they signed. In practice that was rarely done, people just trusted keys identity on first use.
Then in June 2016 the keyserver network was attacked in a way that fundamentally broke the whole thing. Anyone can add a signature attesting that a key in the keyserver is valid for the name it claims to be for. Anyone can add 150,000 such signatures. GPG breaks horribly whenever a key with more than about 150,000 signatures is used, or is anywhere in the chain of trust needed to verify another key. Someone signed a couple of popularly-used keys 150,000 times each, thus breaking GPG for everyone who was actually trying to use the Web of Trust.
So the Web of Trust was removed, the keyserver network is useless, and nobody really cares because no one really relied on it anyway.
And this is all without mentioning all the other massive vulnerabilities in the design and implementation of PGP/GPG, like its default to 1024-bit DSA keys with SHA-1 hashes (both broken), its common doomed attempts to encrypt email, lack of forward secrecy, use of RSA for encrypting, extremely complicated interface, long-lived identity keys, ease of creating colliding key fingerprints, etc, etc. It's a long, long list and not entirely on-topic to this answer.