Re: ::scr tales from the crypto

[Richard Clamp <richardc@xxxxxxxxxxxxx>]

On Fri, Apr 19, 2002 at 11:05:44PM +0100, Alex Robinson wrote:
>  + 0.0 Sender looks up the recipients public key id.
>  ...
>  >Of course all this depends on the first step of people registering
>  >their keys with keyserver.net, or at least passing around their public
>  >keys in some way which pleases them.
> 
> No, you seem to have missed my point. Firstly that entails the sender 
> rather than the software having to look up the key. Secondly the 
> private keys get stored locally - and then how do you know that the 
> key is up-to-date?

No, I don't believe I have missed your point.

Firstly, the software the sender uses and the sender herself are
pretty much indistinguishable to me.  Yes, there could be some neater
integration in order to have the key exchange done for me, but those
are the few scripts I mentioned before.

Secondly, well big deal, that's just local caching.  Yes, for some
users it's not transparent enough yet, so write the code.

You know the key is up-to-date because if it's not then your recipient
will respond to you and tell you about it.  Or, using software again,
periodically check your cache is valid.

The rest of what you're imagining is smelling like overengineering to
ridiculous levels.  I just don't understand what's compelling you to
go to such extremes.

> [0] Obviously there are issues of your keyserver being spoofed/hacked 
> which would of course be as easy or as difficult as spoofing/hacking 
> your domain. But keyserver.net surely suffers from the same problems, 
> doesn't it? And how does keyserver.net prevent people posting false 
> information in the first place?

It doesn't, but, and here's the science bit, if you send me an
encrypted message that I can't decrypt, you didn't use a key I have.

That's either because:
       * It's an old key which I have discarded
       * It's someone else's key
       * Space weevils

If you're feeling paranoid, don't let your first encrypted message to
me contain all of your secrets, and always distrust space weevils.

-- 
Richard Clamp <richardc@xxxxxxxxxxxxx>