Trust, Validity, and Authority
Trust is a broad concept. It means many things in many contexts. In this discussion we will use a narrow, strict definition: the mechanism that is used to decide whether a key is valid. A key is valid if it is actually owned by the person who claims to own it. In other words, if the descriptive information traveling with the key is accurate, then the key is valid. You tell PGP whom you trust to introduce keys; in return, PGP tells you which keys are valid.
Thus, if a key says it is owned by the same person who owns the
email address "Alice"
<alice@example.com> and that information is correct, that
key is valid (or accurate). If Bob believes the key is valid because
Charlie signed that key, then Bob considers Alice’s key valid because he
trusts Charlie.[55]
Let us start with this definition:
A key is valid if it is actually owned by the person who claims to own it.
We can then move on to define trust:
Trust is the mechanism we use to decide that a key is valid.
Most people confuse trust and validity. Even those of us who know the Web of Trust best sometimes make mistakes. Validity is only a score and can be used only to determine whether the name on a key is accurate. Trust is a relationship that helps us determine validity.
You tell PGP whom you trust to sign keys, and in return PGP tells you which keys are valid. It does this by tallying up a score for each key depending on who signed the key and how much you trust the person who signed it. (PGP calls the ...
Get Beautiful Security now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
