That's why there is public key server, and pgp/gpg got a slow adoption:
the model is the web of trust (A knows from direct encounter that the
key of B is ok, and sign & trust it. J knows from direct encounter that
the key of A is ok and sign & trust it. and so on)

The nice point, if everyone would have public key, is that the
generalisation of Erdos Number would be very low.
(If you have a letter to transmit to Obama (or anyone else), from hand
to hand using only directly know people, it is assumed to be something
as low as 7 (assuming everyone is ready to cooperate and not put in in
the bin))

Signing & trusting a key is something that should not be handled lightly.

The alternative to the web of trust is the current implementation of
certificates (used in all new Microsoft code for 64 bits at driver
level). Alas, central agencies have demonstrated that they are weak
points. (compromised private keys or stolen... oh well, nobody cares...
keep the money flowing!)

Post a reply to this message