establishing trust

>From khijol!erc@uunet.uu.net Thu Nov 23 16:21 EST 1995
>From: "Ed Carp [khijol SysAdmin]" <khijol!erc@uunet.uu.net>

..so..why the UUCP style address?

>Subject: Re: crypto for porno users
>To: khijol!clark.net!cme@uunet.uu.net (Carl Ellison)
>Date: Thu, 23 Nov 1995 15:57:17 -0600 (CST)
>Cc: khijol!got.net!edge@uunet.uu.net, khijol!toad.com!cypherpunks@uunet.uu.net
>

>totally different from this "web of trust" I keep hearing about - and that is
>*it*.  Do you trust me any more now than before I started signing my postings?

Actually, in my view, signed postings are the first step.  With those (and
the right S/W (not there yet)), I get to know that a bunch of postings came
from the same person.  I even know who they came from:  the person who
is capable of signing with key 0xXXXXXXXX.

Since the only way I have of getting to know the person is through those
postings, I get to know that person and through that knowledge I decide
whether or not to trust.

And, yes, I can be fooled.

 - Carl


 +--------------------------------------------------------------------------+
 |Carl M. Ellison    cme@acm.org    http://www.clark.net/pub/cme            |
 |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
 |  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
 +---------------------------------------------- Jean Ellison (aka Mother) -+

-----BEGIN PGP SIGNED MESSAGE-----

Carl Ellison <cme@clark.net> wrote:
  Ed Carp wrote:
  >Subject: Re: crypto for porno users
  >To: khijol!clark.net!cme@uunet.uu.net (Carl Ellison)
  >Date: Thu, 23 Nov 1995 15:57:17 -0600 (CST)
  >Cc: khijol!got.net!edge@uunet.uu.net, khijol!toad.com!cypherpunks@uunet.uu.n
 et
  >

  >totally different from this "web of trust" I keep hearing about - and that i
 s
  >*it*.  Do you trust me any more now than before I started signing my posting
 s?

  Actually, in my view, signed postings are the first step.  With those (and
  the right S/W (not there yet)), I get to know that a bunch of postings came
  from the same person.  I even know who they came from:  the person who
  is capable of signing with key 0xXXXXXXXX.

I hate to point this out, but that isn't true.
Anyone can create a key with any chosen keyid and
attach the same publicly known name to it. (see,
eg., the key I signed this with, given below).
The only unforgeable things about a particular
key are:

1. The key itself (you know, the product of the
primes),
2. The key fingerprint (unless MD5 is compromised)
and 
3. The web of trust leading to that key.

So, in practice, you actually have to look at the
key fingerprint of the key used to sign a message,
if you want to be sure of the uniqueness of that
key.

Or you have to only trust keys that come
well-introduced. Back to the Web of Trust.

  Since the only way I have of getting to know the person is through those
  postings, I get to know that person and through that knowledge I decide
  whether or not to trust.

I've been trying to think of the possible
ramifications of spoofing people's names and
keyids on a large scale. And a large scale is
certainly possible -- it only took me about an
hour to create this key. I was originally
intending to use this key as part of a real
project, to gain attention to the project, but the
more I thought about it the more I worried about
the implications. This "coming out" invalidates
any chance of that happening.

There are two bad things I can think of.
Suppose I want to somehow attack Fred. I can
create a key with the same ascii text associated
with it very easily. With only a little more
effort, I can also duplicate the keyid. PGP adds
new keys at the front of the keyring, so if I
start distributing this new key widely, it will
appear in keyrings before the "real" Fred's.
Whenever this happens automatically, there is some
possibility that the wrong key will be used for
some operations. PGP doesn't help much, because it
is hard to specify the key unambiguously in this
case.

PGP uses more than just the visible part of the
keyID. So at least it will choose the right key to
verify signatures, right? Maybe not. I can apply
the same spoofing technique to the whole internal
keyID, and generated a key that even PGP can't
tell is the wrong one. I think that when PGP tried
to check the signature on a message from the "real"
Fred that it would notice that it had applied the
wrong key, but I'm not absolutely sure on this
point. Anyway, an inattentive or somewhat
automated user will merely notice that the
document signature fails to check out, essentially
slurring the "real" Fred's reputation.

Any other possible attacks?

Greg.

Greg Rose               INTERNET: greg_rose@sydney.sterling.com  
Sterling Software       VOICE:  +61-2-9975 4777    FAX:  +61-2-9975 2921
28 Rodborough Rd.       http://www.sydney.sterling.com:8080/~ggr/
French's Forest         35 0A 79 7D 5E 21 8D 47  E3 53 75 66 AC FB D9 45
NSW 2086 Australia.     co-mod sci.crypt.research, USENIX Director.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMLkSAqaauZzerb7vAQFpbgP+KpPj1SH746nmJca3VmEGU13t/enQL5GT
FmCGHqnqI757GRNOiHMXnNe8mMdwMn67UgxU/3a7R/UU7rspGH3P/IrmDH0NnDHG
z5QuhQcutgswz7ncNeuUxi6BRHP12SM/aNnLqCmT308zd1sL1BNL/CUgPdxNBnFT
kCe5dS0FVaI=
=mopc
-----END PGP SIGNATURE-----

-----BEGIN PGP MESSAGE-----
Version: 2.6.2i

lQHgAzBrI8cAAAEEANQqR/iaxVP8FZ5CKqI2hcYFFyWAsnNmsZsPi+nOehI1nMyi
PBzX1PPBh8pCAS+0mrUqKKUp2ArCS6n6Ph/R2VjHsqq8HFKOT14Md3C6/M15SKDV
ODcgKvfZf7gs6KEhPqcCS1P8OpGQWRczE1nTxYAw65bBRpDg7KaauZzerb7vAAUR
Adj6LAUodVxLA/4dxjQlaNqaJp5ElB0amAQ81/9Zah4Zf1j8CLVw08g5Kz4oK3hJ
dx61pjBJ2fag1/UUM6y9gIT5yL0ErK+KQ1sPdvZPe5p5JEhCV2tlqlT+d1iPdEiN
x7t986et7Zb91T+UsEyLLaTxQMKk4obDb2IvJvKgcvNm+wRW5rGNXitpRQIAGmTd
ypkNQIwWq07d+QNaFUYgTl8ZQfX078a6VMPl2DQni6uLmvUvgI3VHW8oTcpyqu5j
mJt0FTkeGMA0lKQa5AIA//fzyVUXGJEKkXIBkfCJ/F1V4dMsfZ/3z73RiNtKl46p
lMTztn/cCEUoE+GwonQhkJUnAXbBYtFifisyVf92ngH/u7YxY+z4T2SrhsYj+oGc
Ox/T2VlugUYPowQr3070OoHrrd7icwXNU69nHkle7/jnFjMTvDSZrPYZiXFa0yhV
0apCtBBQcmltZSBSaWIgTG92ZXJziQCVAwUQMLkLB6aauZzerb7vAQEHyAQApGgP
xyUR71jntGeir3yJpcBAEVkmqXLYZPb83dzVlWh7HHQmTiyE/rrcJT7NZRZGA8X7
TTPMZnITDETdwFVIkznvY8v7DWGXD8SD0LNlE61lzhmhNvsfUmQ/q4YHrCERb31P
56TPaveSwYlkPanOYLLJ7m47KICP0z3jzNgwqRo=
=DLC7
-----END PGP MESSAGE-----

-----BEGIN PGP SIGNED MESSAGE-----

> >From khijol!erc@uunet.uu.net Thu Nov 23 16:21 EST 1995
> >From: "Ed Carp [khijol SysAdmin]" <khijol!erc@uunet.uu.net>
> 
> ..so..why the UUCP style address?

Because I don't have a real UUCP connection at the moment.  Khijol is 
expected to get back on the net as khijol.org in the next few days.  Just 
trying to get by until then :)

> >Subject: Re: crypto for porno users
> >To: khijol!clark.net!cme@uunet.uu.net (Carl Ellison)
> >Date: Thu, 23 Nov 1995 15:57:17 -0600 (CST)
> >Cc: khijol!got.net!edge@uunet.uu.net, khijol!toad.com!cypherpunks@uunet.uu.net
> >
> 
> >totally different from this "web of trust" I keep hearing about - and that is
> >*it*.  Do you trust me any more now than before I started signing my postings?
> 
> Actually, in my view, signed postings are the first step.  With those (and
> the right S/W (not there yet)), I get to know that a bunch of postings came
> from the same person.  I even know who they came from:  the person who
> is capable of signing with key 0xXXXXXXXX.

Yes, but that only establishes that I was the one who wrote the post, not 
that I am to be trusted...

> Since the only way I have of getting to know the person is through those
> postings, I get to know that person and through that knowledge I decide
> whether or not to trust.
> 
> And, yes, I can be fooled.

I've met a fair number of people in person that I've met over the net, and
I'm here to tell you that a lot of people I've met are totally different
in person than they are over the net.  People that I thought I could trust
gave me the willies in person, and I eventually found out that I couldn't
trust them at all.  Get burned a couple of times like that, and you learn
to suspend trust until you really meet someone in person. 

Just my $0.02.
- --
Ed Carp, N7EKG    			Ed.Carp@linux.org, ecarp@netcom.com
					214/993-3935	voicemail/pager
Finger ecarp@netcom.com for PGP 2.5 public key		an88744@anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMLVvXCS9AwzY9LDxAQFO+wP+KYeRi9K/9AgXA7iyha61lsjZpYkDoSD1
kGaH04GGKcBhxPbVeRDnKaqM8oxesi24aKBWC7Hc0mJhB1+fsjZpwghd5/CzYAiK
WcZULWnVLKIqXWJlQuV/1UsEgHVa0mCEFbIUVoJtILQXoSRGIO7ga+6poYy5ag/r
g4Kgbf4M8GM=
=+Ee3
-----END PGP SIGNATURE-----