True Names and Webs of Trust

Just a comment on this business of whether we need certification of the
True Names of people we deal with:

I've dealt with "in person" maybe 60 to 100 of the people on this list (at
one time or another). In no cases--not a single one--have I made elaborate
checks to confirm that people are who they claim to be. A few driver's
licenses have been flashed at meetings, but I didn't look closely. Maybe a
passport was even displayed, but, again, I didn't look. And documents are
readily forged.

This has relevance to the thread Michael Froomkin raised, as well. To wit,
none of the people I've met has been "certified." And yet it doesn't bother
me.

As Bill Stewart correctly claimed is my view, the "key is the identity."
Or, more accurately, a _persistent personna_ is what matters.

Thus, I don't need to "verify" that "Eric Hughes" is "really" Eric Hughes,
and is not actually Fritz Doppelganger, assigned to Berkeley by the BND. I
really don't care about the so-called "reality."

(Sorry for all of the "quotes," but all of these terms are heavily laden
with connotations which bear deconstructing.)

My experiences are the norm, I think. Identity credentials are rarely
checked, and most people don't care too much. (An important point is that
in a cash economy, identity is almost irrelevant. It's only in non-cash, or
"account-based," economy that True Names are demanded. Lots of interesting
issues to discuss here, which I won't now.)

The "web of trust" model is really the normal way people go about their
business. I knew someone once introduced to me as "Hugh Daniel," and he
eventually introduced me to someone calling himself "Eric Hughes," and so
on. Introducers, webs of trust, etc. What their "real names" are makes
little difference. (Besides, their Real Names were written on flat stones
on the 3rd day after their births and placed in a safe place known only to
the Great Bird.)

I never use the web of trust model in PGP. I get so few PGP messages that
it's enough that people I know give me their keys. So I concede that the
web of trust model in the PGP world may or may not scale well. (In the
sense of tens of thousands of folks establishing a "web of trust.") But the
_basic_ idea of self-arranged transfers of keys and local networks of
friends is right on.

This is why I don't worry too much about the need for
government-authenticated keys and True Names.

--Tim May

---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

 tcmay> As Bill Stewart correctly claimed is my view, the "key is the
 tcmay> identity."  Or, more accurately, a _persistent personna_ is
 tcmay> what matters.

These discussions are missing the entire point of the Web of Trust.

Key signatures exist for one reason and one reason only: To thwart
man-in-the-middle attacks.  Whether your "persistent persona" is a
True Name (tm) or a pseudonym is irrelevant.

Suppose a sysadmin on your site installed a filter on your mail and
news that translated everything between your real public key and one
of her choosing.  Such a transformation could be done automatically
quite easily.  How long before you would notice?  Depending on how
careful you are, it could take quite a while.

Key signatures avoid this attack.  What a key signature *means* is
that the signer is personally vouching that no such attack has taken
place.  Each signer has his own level of paranoia, and you need some
knowledge of that paranoia level to evaluate the worth of a signature.

Requiring a True Name backed by state-appoved photo ID is a pretty
high level of paranoia.  (It would take a lot of effort to monitor
this exchange, edit it to arrange a meeting between us, show up with
photo ID for "Tim May", and continue editing every time one of us
mentioned our personal meeting...)

Pseudonyms *do* pose a problem here.  The problem is not whether
someone tries to use a name that "really" belongs to someone else.
Who cares?  The problem is making sure that your conversation with the
entity at the other end of the wire is secure.

This is what the Web of Trust provides.  If I take the time to have a
long conversation with a pseudonym (so that I "get to know him"), then
I arrange a personal or telephone meeting, and the person I talk to is
totally consistent with the person I know electronically, then I can
feel safe signing his key.  ("The entity calling itself 'Patrick J.
LoPresti' asserts that the entity it knows as 'John Doe' uses this
public key.") Of course, I need to know him pretty well before I can
do this, lest the man-in-the-middle deceive us.  The beauty of the Web
of Trust is that once I have done this, everyone else who trusts me
can use the pseudo's key with confidence and without going through the
same trouble.

Zimmermann clearly understood all of this, but I don't think he
documented it properly.  In my opinion, everyone should always think
in terms of man-in-the-middle attacks when signing a public key.
Mandating "True Names" is just an overconservative approach suitable
for people who don't fully understand the issue.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface

iQCVAwUBMDntwHr7ES8bepftAQFyyAQAnFtDh4UxHOtFoykCFVyK4s0CXqXhku+k
T8n/881R0F1lL+qKMlkxCd0qRmYXueeYGCO6oXAMWgVjVBQ4PluAdw7Ad4b9GxDA
FzkuN5oasKbyKyyCRguRq7DszKWW0nyjGbsToq0udtX0fsY33ZtU3btbsjawBFgI
Kk7TEeHBT+8=
=pndj
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

> Key signatures exist for one reason and one reason only: To thwart
> man-in-the-middle attacks.  Whether your "persistent persona" is a
> True Name (tm) or a pseudonym is irrelevant.

<snip>

> Zimmermann clearly understood all of this, but I don't think he
> documented it properly.  In my opinion, everyone should always think
> in terms of man-in-the-middle attacks when signing a public key.
> Mandating "True Names" is just an overconservative approach suitable
> for people who don't fully understand the issue.


My point exactly.  My post "Stop Fixating on True Names" was an attempt to
clarify things to said people.


Look at it this way:  leaving aside the fact that a Man-In-The-Middle has to
do a little more fast footwork than a normal old eavesdropper does, public
key cryptography does not actually give you *any* advantage over symmetric-key
cryptography except for this one fact:


You can ask George what Alice's public key is, but you can't ask him what
her-and-your shared (symmetric) secret key is!


- From this perspective, the Web of Trust is the soul of public-key
cryptography.  From the other perspective ("Never ever sign a key which you
got off of a bulletin board!" warns "pgpdoc1.txt") it is a cute anachronism.


By the way, you mentioned "people who don't fully understand the issue"--
a brief survey of e-mail and posts I have seen on this subject indicates to
me that even knowledgeable people like the cypherpunks are about evenly split
on whether they appreciate this concept or not.


[note:  I've been cc:'ing messages to c'punks accidentally after I upgraded
to mh.  My apologies.  At least they weren't completely without
relevance...]


Bryce
Announcement: I have had technical difficulties.  If you sent me e-mail
between Aug 5 and Aug 20 and didn't receive a response, please re-send.
signatures follow:


                                 +                                           
    public key on keyservers     /.       island Life in a chaos sea         
    or via finger 0x617c6db9     /             bryce.wilcox@colorado.edu     
                                 ---*                                     

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed with Bryce's Auto-PGP v1.0beta

iQCVAwUBMDpBPfWZSllhfG25AQFvuAP/a6vSu4OgkDAXTRWif46/chb1+Owo2TBx
YEWSzp4PRYTL1ZwrC1eOtx37miGUzvsGooXOEPfEpC4oW3f0Jg6BHanXabhegJyb
t09m8IlaeD38IKATnzcC7VeeU0sWuWUea1vFJw28oZv0VOgGSeeFcYE4DA/oOtRD
oqTFfG+GM7w=
=LFIz
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

 >> Zimmermann clearly understood all of this, but I don't think he
 >> documented it properly.  In my opinion, everyone should always
 >> think in terms of man-in-the-middle attacks when signing a public
 >> key.  Mandating "True Names" is just an overconservative approach
 >> suitable for people who don't fully understand the issue.

 wilcoxb> My point exactly.  My post "Stop Fixating on True Names" was
 wilcoxb> an attempt to clarify things to said people.

Then you didn't clarify very well; to wit:

 wilcoxb> Okay now does anyone want to do any of the above two things
 wilcoxb> to me?  If not then *don't* *worry* about whether my public
 wilcoxb> key is signed by anyone or not.  It makes zero difference to
 wilcoxb> you until such a time as one of the above motivations
 wilcoxb> acquires.

 wilcoxb> Zimmermann et al. were/are naive to emphasize the Web of
 wilcoxb> Trust as a means of introducing strangers.

The first paragraph clarifies nothing because it is dead wrong; the
second because it is arrogant, offensive, and dead wrong.

 wilcoxb> From this perspective, the Web of Trust is the soul of
 wilcoxb> public-key cryptography.  From the other perspective ("Never
 wilcoxb> ever sign a key which you got off of a bulletin board!"
 wilcoxb> warns "pgpdoc1.txt") it is a cute anachronism.

The Web of Trust is a means of thwarting active attacks;
nothing more, nothing less.  "Perspective" has nothing to do with it.

Given that active attacks are hard to explain and understand fully,
the PGP docs are correct to advocate a conservative approach to
signing keys.  Novices *should* be taught to take the Web of Trust
seriously.  (Yes, I am retracting my own statements quoted above; the
more I think about it, the more I think it is very hard to teach a
novice the details of active attacks.)

Moreover, I suspect that active attacks are more likely today than
when those docs were written, which makes their advice precisely the
opposite of an "anachronism".

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface

iQCVAwUBMDpleHr7ES8bepftAQE0KgQAoAg5QeXwbtZzKMliNH63f3Ewvxz1g8gR
vlTPwZ8YRWANxFFbhN03DMo6HQI78f/8VnbvOB8osZz/aLQgmyuw6Q201vfHbbtu
gKpfLBPLu/Cl2JEk6FK58IYyvrTPZ7XKfp80LoRIby/pSU2uL7K2+7vfjGWGvjvY
V9s9mJUCGN8=
=OBD5
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

patl> Zimmermann clearly understood all of this, but I don't think he
patl> documented it properly.  In my opinion, everyone should always
patl> think in terms of man-in-the-middle attacks when signing a public
patl> key.  Mandating "True Names" is just an overconservative approach
patl> suitable for people who don't fully understand the issue.

wilcoxb> My point exactly.  My post "Stop Fixating on True Names" was
wilcoxb> an attempt to clarify things to said people.

patl> Then you didn't clarify very well; to wit:

wilcoxb> Okay now does anyone want to do any of the above two things
wilcoxb> to me?  If not then *don't* *worry* about whether my public
wilcoxb> key is signed by anyone or not.  It makes zero difference to
wilcoxb> you until such a time as one of the above motivations
wilcoxb> acquires.


You are quite right that this paragraph was unclear.  I meant "don't worry
about whether my public key is signed where signing means certifying the
mapping between my key and my physical identity.", not "don't worry about 
whether my public key is signed where signing means certifying the mapping
between my key and a perceived identity of mine.".


It is unfortunate that a PGP key-signature has such ambiguous semantics, but
again it is my fault for being unclear above.


wilcoxb> Zimmermann et al. were/are naive to emphasize the Web of
wilcoxb> Trust as a means of introducing strangers.

patl> The first paragraph clarifies nothing because it is dead wrong; the
patl> second because it is arrogant, offensive, and dead wrong.


Pshaw.  I think it's funny when people gasp in horror if you say something
disrespectful of Saint Phil.


Here, I'll say it again:  Zimmermann was naive to emphasize the Web of
Trust as only legitimate for public key<->Real-Life-identity mappings.  In
the future such mappings will be rare, while the Web of Trust will be used
extensively for public key<->virtual-identity mappings.


(The alert observer will notice that I changed some things between the first
and second invocations of the Disrespectful Assertion.  This is because when
I wrote the first version I was still confused about the ambiguity between
"Web of Trust as set of key<->Real-Life-identity mappings" and "Web of Trust 
as set of key<->identity mappings".)


patl> Given that active attacks are hard to explain and understand fully,

I'll say!  I'm having a very hard time understanding all of this clearly.

patl> the PGP docs are correct to advocate a conservative approach to
patl> signing keys.  Novices *should* be taught to take the Web of Trust
patl> seriously.  (Yes, I am retracting my own statements quoted above; the
patl> more I think about it, the more I think it is very hard to teach a
patl> novice the details of active attacks.)


Be that as it may, I still think that Zimmermann assumed that
key<->real-life-identity mappings would be the primary purpose for the Web 
of Trust when he wrote "pgpdoc1.txt".  And I think he was wrong about that.
It is not "arrogant" or "offensive" to say that someone was wrong when you
believe that to be the case.


patl> Moreover, I suspect that active attacks are more likely today than
patl> when those docs were written, which makes their advice precisely the
patl> opposite of an "anachronism".


Furthermore, Phil's advice to only sign keys which you have physically 
verified actually makes it easier for an attacker to get In-The-Middle-Of you 
and me.  This is because there is no Web of physically-verified keysigs 
between you and me.  If Phil had recommended treating public keys as being 
equivalent to net.personas, and verifying them as such, (or better yet, had 
provided a certificate mechanism to do so in *addition* to the current 
certificates) then there would be a Web of non-physically-verified keys 
between you and me, which would be much harder for an attacker to subvert.


Since you and I do not share any such Web, we are not any better off than if
we were using symmetric-key cryptography, as far as privacy goes!
(Authentication is of course another matter.)


Ah, the irony.  By insisting on maximally-strong links between each node in
the Web, you generate a much weaker Web than if you allowed weaker individual
links in greater quantity.


Thank you for your correspondance, Patrick and others.  I look forward to
more constructive interaction.


Bryce
signatures follow:


                                 +                                           
    public key on keyservers     /.       island Life in a chaos sea         
    or via finger 0x617c6db9     /             bryce.wilcox@colorado.edu     
                                 ---*                                     

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed with Bryce's Auto-PGP v1.0beta

iQCVAwUBMDq0kfWZSllhfG25AQERJAQAglcIqszrEeWmrbL1E/SxpdRK+3B8zKC9
g7H6fd6T6D8BnYv6u4wmlU+F8fyFT0V6cVa5BZ6Defmc6phvYD9wKyleuaYjRaOP
tVd8tITqpoIkmpK1+skCiV5CUl5eseKQJUlUa2LX4J8Lh9J6t9ZRm6p72ocJ88JL
hnOknxRHz/M=
=Pes4
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bryce" == Bryce Wilcox <wilcoxb@nagina.cs.colorado.edu> writes:
(in a PGP signed message)

[...]
Bryce> You are quite right that this paragraph was unclear. 
[...]

Bad signature, doesn't match file content :))) Bryce, why don't you
really PGP-sign a mail when you agree you were unclear ? :)))

  Sam
- --
"La cervelle des petits enfants, ca doit avoir comme un petit gout de noisette"
                                                       Charles Baudelaire

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface

iQCVAgUBMDr36IFdzKExeYBpAQH60gP/ZlbC6alikSBjCsWxf/g2mjDVRNvlcu3P
Y1ljl7t1mnkfOag0uGaZVAHzDkcLfq5VrwNPVBpZUJmm0hHcUxyyP63rX42EC0n5
ATA3fnmxsmPrMZsAHYjfzI/kPeCX0xO0Fn8XIAv55BzGPzm8w8hp31x4FwEWn7+O
Ip9R7jWTQ1o=
=skv6
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

> >>>>> "Bryce" == Bryce Wilcox <wilcoxb@nagina.cs.colorado.edu> writes:
> (in a PGP signed message)
> 
> [...]
> Bryce> You are quite right that this paragraph was unclear. 
> [...]
> 
> Bad signature, doesn't match file content :))) Bryce, why don't you
> really PGP-sign a mail when you agree you were unclear ? :)))


:-)


Good one.  The truth is that I was testing to see if anyone paid attention to
my sigs.   Thanks for your response!  I promise not to deliberately
invalidate any more clearsigs.


Regards,

Bryce

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed with Bryce's Auto-PGP v1.0beta

iQCVAwUBMDtVZPWZSllhfG25AQGfvQQAiBDxjYwPTukPfX5vjn8ZOMWmuzYznJax
25CDar/W8LgP3vKV8pNMUHfDUj8EN8JwvPnV/1Q++jgWcgZ8Bis0FLt59wznqm8I
Ke9hiFAWxn6KHuAiz5nvlsh0xOuTwoJ/rSaQHJZlulvG6ZK1SeK0rfmY/MNMrCrc
OLr7j1JVWHc=
=yBpE
-----END PGP SIGNATURE-----