key signing

[David Shaw]

On Fri, Jan 03, 2003 at 08:49:40AM +0100, Tuyen DINH wrote:
> dshaw@jabberwocky.com (David Shaw) wrote:
>  > On Thu, Jan 02, 2003 at 03:18:12PM +0100, Tuyen DINH wrote:
>  > > 
>  > > Hello,
>  > > 
>  > > When you want to sign a key you have just imported, in which cases will
>  > > you choose one the following choices :
>  > >  
>  > >    (0) I will not answer. (default) ?
>  > >    (1) I have not checked at all.   ?
>  > 
>  > If you type a question mark (?) when GnuPG asks this question, you
>  > will get a long explanation.  That text is:
>  > 
>  > --------------------------
>  > 
>  > When you sign a user ID on a key, you should first verify that the key
>  > belongs to the person named in the user ID.  It is useful for others
>  > to know how carefully you verified this.
> 
> I wondered : if I have no idea about the key's authenticity, is it worth
> it to sign it ? (except sign it locally)

In general, you should never (publically) sign keys you have no idea
about.  This is what local signatures are for.

>  > "0" means you make no particular claim as to how carefully you
>  >     verified the key.
>  > 
>  > "1" means you believe the key is owned by the person who claims to own
>  >     it but you could not, or did not verify the key at all.  This is
>  >     useful for a "persona" verification, where you sign the key of a
>  >     pseudonymous user.
> 
> What is the interest for others to know that I couldn't check its
> authenticity ?

The theory is that they can then not trust that signature if they
don't approve of this type of signature.  However, both GnuPG and PGP
treat all signatures (including these persona signatures) alike, so
persona signatures are not that useful right now except in special
circumstances.

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson