Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of nslater@tumbolia.org
 designates 209.85.215.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAAL6JQi7cO0xsRoOvYfhUJ9ty763n3JytVSy494O9oD+DdWtPA@mail.gmail.com>
References: 
 <CAAL6JQhRFA5b6a+OgwRwvGwaxuvt1iUEZCo6w2deE_6gt4D8oQ@mail.gmail.com>
	<CAN-3CB+g0QSbho5J2a1eRLau2J=P=1RWt6mxDnDTP9NfTi9OUQ@mail.gmail.com>
	<CAAL6JQi7cO0xsRoOvYfhUJ9ty763n3JytVSy494O9oD+DdWtPA@mail.gmail.com>
Date: Tue, 3 Apr 2012 22:19:18 +0100
Message-ID: 
 <CA+Y+445jmDcM_Zq6JixSde2mAzsx13nXvcpFsne6fr9oNd_LuQ@mail.gmail.com>
Subject: Re: On Key Signing (was Re: [VOTE] Apache CouchDB 1.2.0 release,
 fifth round)
From: Noah Slater <nslater@tumbolia.org>
To: dev@couchdb.apache.org
Content-Type: multipart/alternative; boundary=e89a8f23450913b78004bcccdcd6

--e89a8f23450913b78004bcccdcd6
Content-Type: text/plain; charset=ISO-8859-1

Randall,

You are free to use whatever system you want to use in determining what
keys to sign. All I am doing is pointing out what is common, and what is
commonly frowned upon. A standard baseline is that you have a) met the
person, 2) seen a photo ID, and d) verified cryptographically that
they control the private key. The last step is usually done through
exchanging signatures after the key party.

On Sat, Mar 31, 2012 at 6:23 AM, Randall Leeds <randall.leeds@gmail.com>wrote:

> On Fri, Mar 30, 2012 at 17:23, Jason Smith <jhs@iriscouch.com> wrote:
> > You are not confirming that somebody is who he says he is. You are
> > simply confirming that he bears the key that he says he has. The
> > latter is a much simpler problem.
>
> That's precisely my point. I have a giant stack of evidence that says
> Noah bears this key.
>
> Also related to my anecdote about signing parties I've experienced,
> wherein nobody asks me to prove that I own the private key, I'll note
> it's sort of unnecessary. Signing *their* keys and publishing that
> demonstrates that I own the private keys corresponding to my identity
> of my signature. But for that first signature with an unconnected
> other, it seems like the "right" thing has nothing to do with driver's
> licenses or photo ID, but everything to do with exchanging a signed
> message over a secure channel, which is slightly more than "hey, the
> fingerprints on our screens match", which just says that you're
> talking about the same key (whose owner may or may not be present).
>

--e89a8f23450913b78004bcccdcd6--