[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5182AF44.5060506@debian.org>
Date: Thu, 02 May 2013 19:24:04 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: OpenPGP certifications are identity assertions
[was: Re: upstream source code authenticity checking]
On 02/05/13 17:42, Daniel Kahn Gillmor wrote:
> most OpenPGP signatures in the current web of trust are *not*
> trust signatures, and trust packets aren't emitted or transferred
> publicly (they're private indicators used for local keyring
> storage).
Some PGP publications try to avoid mentioning "trust" altogether: they
talk about "[user ID] validity" and "ownertrust".
"User ID validity" is when you sign something with semantics similar
to "I am reasonably confident that the key 4096R/4DE8FF2A63C7CC90
belongs to Simon McVittie whose address is smcv@...ian.org". That's
what happens in keysigning.
"Ownertrust" is when you configure gpg with things like "if Simon says
a user ID is valid, assume that it is" (full ownertrust), or "if Simon
and two others with partial ownertrust all agree that a user ID is
valid, assume that it is" (partial ownertrust).
Both of those are orthogonal to whether you can trust that I haven't
deliberately included malicious code in a software package signed by
my key, whether you can trust that I haven't accidentally included
dangerously insecure code in that package, or whether I even have the
authority to be saying "this is a release" on behalf of the project
from which it purports to be a release.
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
