Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

310

|

Chapter 9: Securing Internet Email

For this reason, PGP and GnuPG users participate in what is known as the Web of

Trust. The idea is simple: if people cryptographically sign each other’s keys, and if

each person’s key has been signed by people whose keys have in turn been signed by

other people, then at some point it becomes likely that any given key you come

across has either been signed by the key of someone you trust or by a key that has

itself been signed by the key of someone you trust. It’s really just a variation of the

concept of “six degrees of separation.”

For example, suppose Bob knows and trusts Ted, and therefore Bob cryptographi-

cally signs Ted’s public key. Suppose further that I don’t know Ted, but I do know

Bob. If I see that Ted’s key includes a valid signature from Bob, I can safely conclude

that trustworthy Bob vouches for the authenticity of Ted’s key.

Suppose Ted uses his key to sign Alice’s key, and that I know neither Ted nor Alice.

If I validate Ted’s signature on Alice’s key, I can assume that Ted vouches for that

key’s authenticity. However, I don’t know or trust Ted, so I examine his key: it was

signed by Bob, whom I do trust. Therefore, although I don’t trust Alice’s key as

much as I do Bob’s, I can still trust it more than if it had no signatures at ...