Key Signature and Validity

"Validity" of another person's key (or more exact: of a User ID of that key) is the trust that you have that the key really belongs to the person you think it belongs to. A valid key is called a "trusted" key.

•

Local: To tell your program that it (the program) should trust this key. You use a local signature for this purpose. The program will put out warning messages about keys that it does not recognize as trusted.

•

Exportable: To tell the public that you as a person endorse the validity of the key. For this purpose you use an exportable signature. (The local signature is included in the exportable signature)

As this is a program for beginners, it does not allow you to make exportable signatures.

As anybody can made a key with anybody's name on it, you should not just trust appearances, but really verify the validity of a key before you sign it. Accepted methods are:

	•	You know the person that gave you the key in person, e.g., on a USB stick.
	•	You have verified the identity of the person who gave you the key in person (e.g., on a USB stick) with a picture ID.
	•	If you got a key via e-mail by a person you know, you may, if there is only the slightest chance of foul play, want to call the sender by phone: First, identify his or her voice, and then let the person read you the fingerprint of their key and compare it with the fingerprint of the key you have been sent. This is especially important if someone sent you the key "out of the blue".
	•	Sometimes people verify keys by asking for a confirmation from a specific e-mail address. This verifies that the key actually comes from the the e-mail address that it says it does, but does not prove that the name on the key is valid. This may be sufficient for some purposes.

The following remarks do not apply to this version of InstantCrypt, as it does not allow you to make exportable signatures and it does not allow you to set or change a key's Owner Trust.

Especially if you make your signature exportable, you should really verify the validity of a key before you sign it. Other people rely on your judgment!

An exportable signature will go with the public key when you export it, a non-exportable signature will not. You use a non-exportable signature to tell your own program that it can trust this key.

Friends or acquaintances may ask you to sign their key with an exportable signature before they give it to others in order to give their key more credibility. This applies especially if they want to give it to people who trust you, but do not know them very well. Or they may ask you to sign it and then to forward it to another person.

Your own (local or exportable) signature makes another person's key "fully trusted" to your program. But the program also uses other people's signature to calculate how much it trusts a key. In such a case, the program uses the signatures attached to the key plus the "owner trust" you assigned to the signatures with which the key in question is signed. The program uses formulas such as (this is only an example), “to have full validity, a key has to be signed by either one fully trusted signature (person) or by three marginally trusted signatures (persons).”

Thus, to repeat it here, be careful before you sign a key with an exportable signature and really verify the identity of the key owner before you sign it: others rely on it.

On the other hand, if you are certain that a key is valid, do not hesitate to sign it, as it helps others to distinguish between good and bad keys.