-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====
Reference:
Subject: Re: Using root CAs as a trusted 3rd party
Date: Sat, 21 Jan 2012 13:49:20 -0800
From: Ken Hagler <[email protected]>
To: Aaron Toponce <[email protected]>
CC: [email protected]
> On Jan 21, 2012, at 10:12 AM, Aaron Toponce wrote:
>
>> What are your thoughts on using root CAs as a trusted 3rd party
>> for trusting that a key is owned by whom it claims? Of course,
>> this is merely for casual checking, but it seems to be "good
>> enough".
>
> As far as I can see the only checking CAs do before issuing a
> certificate is "does the credit card clear."
I believe you'll find that CAcert (www.cacert.org) is an exception *if*
you are relying on one of their x.509 certificates that includes the
individual's name since all CAcert certificates are free *and*
If the CAcert certificate includes the owner's name -- and if you're
willing to accept that CAcert assurance policies have been followed,
you can be confident that
a. The owner of the certificate has had a face-to-face
meeting with two or more CAcert assurers who
have examined (and accepted as valid) Government
issued photoID documentation provided by that
individual. Based on their assurance experience and
their belief that the documents they have reviewed
are valid, assurers can grant from 1 to 35 assurance
points per individual. An individual must have at
least 50 such points on their CAcert account to be
considered "trusted" by CAcert.
b. If an individual's name is included in their CAcert
x.509 certificate *and* if that individual is also listed
by location in CAcert's public list of assurers, you
can be confident that the individual has had a face-
to-face meeting with three or more CAcert
assurers who have examined provided Government-
issued photoID documentation and accepted them as
valid as noted in subpara "a" above and that the
individual has at least 100 assurance points on their
CAcert account and has met all other CAcert assurer
requirements.
c. Currently many operating systems do not automatically
include the CAcert root certificates (for details see
http://wiki.cacert.org/InclusionStatus) but they can be
easily obtained from http://www.cacert.org/index.php?id=3
and manually added to your list of root certificates.
====
Just as a matter of information regarding members of the Gossamer
Spider Web of Trust (GSWoT) <www.gswot.org>: Among other requirements
a GSIntroducer (GSI) must meet is that they are either:
d.. A CAcert assurer, or
e. Have an x.509 CAcert certificate that includes their
name (indicating they've met with at least two
CAcert assurers -- see subpara "a" above) *and have*
*also* had a face-to-face meeting with at least one GSI
who has examined and accepted as valid the Government-
issued photoID documentation they've provided, and has
trust signed their PGP/GPG key with their GSI key or keys,
or
f. Had a face-to-face meeting with three GSIs who have
examined and accepted as valid the Government-
issued photoID documentation they've provided, and
has trust signed their PGP/GPG key with their GSI
key or keys.
Only then -- again assuming all other GSWoT policy requirements have been
met and that it's been validated that they control the email addresses
associated with each of their key's userIDs -- are their PGP/GPG key
or keys userIDs GPG "sig!2 1" trust signed by the 8875BF7F GSWoT
"Signing Authority" key validating they are GSIs.
====
Ciao
Kara
Timestamp: Mon, 23 Jan 2012, 0553 Local (UTC -0500)
====
.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: For keyID and its URL see the OpenPGP message header
iEYEAREIAAYFAk8dPBcACgkQ15k+1L3RO5DfvgCePIFKfynHCmEdGvlbhhWTg/ka
QYkAnR+z3BzJSeSiY8SXA/aJ9bvwLmiX
=kOMi
-----END PGP SIGNATURE-----
_______________________________________________
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users
