Key signing without a fingerprint?

[Ingo Klöcker]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 30 January 2002 13:28, Huels, Ralf SCORE wrote:
> Hi,
>
> yesterday I met with a guy who had forgotten to bring his key
> fingerprint and we considered the following protocol:
>
> - I gave him my fingerprint and we exchanged photo ID
> - We agreed an a shared secret - a pass phrase
> - He will send his fingerprint and the shared secret in one message,
>   encrypted to my key.
>
> He gets all the information he needs through the physical printout
> of my fingerprint and I can rely on the pass phrase in the encrypted
> message, assuming that he will guard the shared secret closely.
> He may optionally sign the message as well but as proof of his
> identity lies solely in the shared secret, the signature would not
> give me any additional information.
>
> Would you consider this sufficient security for signing a key?

Yes and no.

Yes, because this protocol indeed guarantees that it's him who sent you 
the fingerprint as long as nobody can spy your shared secret.

No, because you should still check if he really controls the email 
addresses he claims to control before you sign his user ids.

Regards,
Ingo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8WFXnGnR+RTDgudgRAqoRAKCoPj0GCwWuRgcB9cIIU0tJGj1HywCdH4vM
fouOGWHXu9vD0j4sCRYUDuY=
=OYNJ
-----END PGP SIGNATURE-----