Thread View: sci.crypt
3 messages
3 total messages
Started by Nonsenso
Wed, 09 Sep 1992 04:56
Re: PGP *2.0* available
Author: Nonsenso
Date: Wed, 09 Sep 1992 04:56
Date: Wed, 09 Sep 1992 04:56
11 lines
890 bytes
890 bytes
-> What the PGP docs should say is that you don't need to keep your -> public key _confidential_. It DOES say so. The manually explicitely states that you should share your public key with as many people/systems as possible. What you _should_ keep confidential is your private key. There could have been a problem with pgp 1.0 when keys could not be certified. That way it'd be easy for anyone to forge a key on your user-ID and sit in the middle of communications. PGP 2.0 features this key-certification and is thus a lot stronger regarding to key-security than the 1.0 version.
Re: PGP *2.0* available
Author: Terry Ritter
Date: Thu, 10 Sep 1992 21:13
Date: Thu, 10 Sep 1992 21:13
18 lines
1026 bytes
1026 bytes
In <716015512.F00005@utopia.hacktic.nl> Nonsenso@utopia.hacktic.nl (Nonsenso) writes: >There could have been a problem with pgp 1.0 when keys could not be >certified. That way it'd be easy for anyone to forge a key on your user-ID >and sit in the middle of communications. PGP 2.0 features this >key-certification and is thus a lot stronger regarding to key-security >than the 1.0 version. Really? So how do we "certify" a key without already having a previously-certified key from the other end? How does the first guy certify his key to others so they can certify their keys to him? --- Terry Ritter ritter@cactus.org
Re: PGP *2.0* available
Author: Perry E. Metzger
Date: Fri, 11 Sep 1992 17:03
Date: Fri, 11 Sep 1992 17:03
30 lines
1571 bytes
1571 bytes
ritter@cactus.org (Terry Ritter) writes: > > In <716015512.F00005@utopia.hacktic.nl> Nonsenso@utopia.hacktic.nl > (Nonsenso) writes: > >>There could have been a problem with pgp 1.0 when keys could not be >>certified. That way it'd be easy for anyone to forge a key on your user-ID >>and sit in the middle of communications. PGP 2.0 features this >>key-certification and is thus a lot stronger regarding to key-security >>than the 1.0 version. > > Really? So how do we "certify" a key without already having a > previously-certified key from the other end? > > How does the first guy certify his key to others so they can certify > their keys to him? You and your friend Alice get together and sign each others keys in person. Later, Bob sends you a key of his, signed by Alice. Since you know Alice's key to be valid, you suspect that Bob's is. This way, a small number of people you trust can validate a large number of other people who you can't meet in person. I'd just read the manual. Most questions are answered. -- Perry Metzger pmetzger@shearson.com -- Just say "NO!" to death and taxes. Extropian and Proud.
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads