🚀 go-pugleaf

ritter@cactus.org (Terry Ritter) writes:
>
> In <716015512.F00005@utopia.hacktic.nl> Nonsenso@utopia.hacktic.nl
> (Nonsenso) writes:
>
>>There could have been a problem with pgp 1.0 when keys could not be
>>certified. That way it'd be easy for anyone to forge a key on your user-ID
>>and sit in the middle of communications. PGP 2.0 features this
>>key-certification and is thus a lot stronger regarding to key-security
>>than the 1.0 version.
>
> Really?  So how do we "certify" a key without already having a
> previously-certified key from the other end?
>
> How does the first guy certify his key to others so they can certify
> their keys to him?

You and your friend Alice get together and sign each others keys in
person. Later, Bob sends you a key of his, signed by Alice. Since you
know Alice's key to be valid, you suspect that Bob's is. This way, a
small number of people you trust can validate a large number of other
people who you can't meet in person.

I'd just read the manual. Most questions are answered.

--
Perry Metzger		pmetzger@shearson.com
--
		  Just say "NO!" to death and taxes.
			 Extropian and Proud.