David Shaw wrote:
If such a feature existed in GnuPG, yes.
David
Uhm,.. I rethought the whole thing,... and I came to the reason that I
gave up too fast ;-)
Ok,.. you told me that the disadvantage of C-only keys would be that you
can't response to challenges. Is this the only reason?
As far as I know a challenge/response is used by some users to verify
the email of an UID before they sign it. But lots of people do not
validate this, because they think it wouldn make sense at all. E.g. if
someone uses some freemail address he could lose the address after
validation because the provider stops his service. So signing the eMail
as part of an UID does not really secure that the address is under the
controll of the keyholder, does it?
The only solution (in my opinion) are services like PGP Global Directory
Key or so,...
But I think it is not so important to secure if the email is under
controll of the keyowner. The worst thing that could happen is, that an
encrypted message isn't received by the (private)-key owner, because the
email is wrong. But this can even happen when the email is correct (e.g.
if someone controlls part of the network).
What it all comes down to is: In my opinion - and correct me if I'm
wrong - validating the email once does not make much sense. The only
good alternative is some service like PGP Global Directory Key.
What are the advantages of using C-only keys?
Uhm,.. inm y opinion the stanard intends using C-only keys, if not they
would have created only the S-flag, that stands for both, signing and
certification.
But they created the following flags:
0x01 - This key may be used to certify other keys.
0x02 - This key may be used to sign data.
0x04 - This key may be used to encrypt communications.
0x08 - This key may be used to encrypt storage.
0x10 - The private component of this key may have been split by a
secret-sharing mechanism.
0x80 - The private component of this key may be in the possession of more than
one person.
Another advantage is perhaps, that a C-only key shows other users that
the key is perhaps used in a more secure way (because it's not used for
signing plain data).
=> I think GPG shoud offer an option (like setprefs) to switch the
key-usage flags of primary and secondary keys.
I spent the last three or four hours browsing through the GPG code, but
I had to resign because it probably takes to long to become familiar
with it.
1) Is this feature going to be introduced in upcoming versions, or is
there some kind of wishlist where I could ask for it :-D ?
2) Or can someone here help me and point me to the right places and
funtions that I have to use for implementing such a feature?
Best wishes,
Chris.
begin:vcard
fn:Mitterer, Christoph Anton
n:Mitterer;Christoph Anton
org:Munich University of Applied Sciences;Department of Mathematics and Computer Science
adr;quoted-printable;quoted-printable:;;Lothstra=C3=9Fe 34;M=C3=BCnchen;Freistaat Bayern;80335;Federal Republic of Germany
email;internet:[EMAIL PROTECTED]
tel;home:+49 89 24409568
tel;cell:+49 172 8617341
x-mozilla-html:TRUE
url:http://fhm.edu/
version:2.1
end:vcard
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
