
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
310
|
Chapter 9: Securing Internet Email
For this reason, PGP and GnuPG users participate in what is known as the Web of
Trust. The idea is simple: if people cryptographically sign each other’s keys, and if
each person’s key has been signed by people whose keys have in turn been signed by
other people, then at some point it becomes likely that any given key you come
across has either been signed by the key of someone you trust or by a key that has
itself been signed by the key of someone you trust. It’s really just a variation of the
concept of “six degrees of separation.”
For example, suppose Bob knows and trusts Ted, and therefore Bob cryptographi-
cally signs Ted’s public key. Suppose further that I don’t know Ted, but I do know
Bob. If I see that Ted’s key includes a valid signature from Bob, I can safely conclude
that trustworthy Bob vouches for the authenticity of Ted’s key.
Suppose Ted uses his key to sign Alice’s key, and that I know neither Ted nor Alice.
If I validate Ted’s signature on Alice’s key, I can assume that Ted vouches for that
key’s authenticity. However, I don’t know or trust Ted, so I examine his key: it was
signed by Bob, whom I do trust. Therefore, although I don’t trust Alice’s key as
much as I do Bob’s, I can still trust it more than if it had no signatures at ...