Hi, Rupert Kittinger-Sereinig <[EMAIL PROTECTED]> writes:
> Ludovic Courtès schrieb: >> Hi, >> >> Rupert Kittinger-Sereinig <[EMAIL PROTECTED]> writes: [...] >>> I mean trusted in the sense of the pgp trustdb. Ideally, every user >>> should be able to configure how he wants to construct his web of trust. >>> >>> E.g. for a server application, the admin could choose a handfull of >>> "user managers" whose keys he would put in the keyring and assign >>> ultimte trust to each one. >>> >>> Another example: a user of web services could validate the server key >>> fingerprint, and locally sign them with his own key. >> >> Nitpick: As mentioned earlier in this thread, signing an OpenPGP public >> key means that "the signer is testifying to his or her belief that this >> public key belongs to the user identified by this user ID" [RFC 2440, >> Section 10.1]. I think this is not what you want here. >> >> Thanks, >> Ludovic. >> > > Why do you think so? If I verify that the key belongs to a person (e.g > by checking the fingerprint) I may well document that for later > reference by signing the key. Just because you know for sure that key XYZ belongs to Mr. Someone whom you've met at the pub the day before doesn't mean you grant him _authorization_ to use the service you provide. Instead, you need something that says "key XYZ is authorized to take such and such actions". And this does not depend on whether key XYZ actually belongs to Mr. Someone. Thanks, Ludovic. _______________________________________________ Help-gnutls mailing list [email protected] http://lists.gnu.org/mailman/listinfo/help-gnutls
