Re: [gentoo-dev] Re: [gentoo-core] on the matter of security and cryptography

[Jean-Michel Smith]

On Tuesday 06 August 2002 09:22 am, Michael Cummings wrote:
> Perhaps I've missed part of this thread (or simply wasn't paying
> attention early enough) but will the keyserver itself (the actual
> repository manager) be housed at gentoo? That would make some small
> difference, at least if you accept keys in general, as far as a
> management standpoint goes. In that case, if you can verify the
> signature against keyserv.gentoo.org, then you know that unless someone
> has hacked gentoo.org itself (let's not even go there - then all
> arguments are void) the key is valid.

WRT the web of trust between the circle of developers and the Gentoo community 
at large:

I would put the keys up on several different, independent key servers, as well 
as make them available via download from multiple, independent locations (not 
mirrors of one another).  This allows one to download the keyring from 
multiple locations and check them not only against each other, but against 
keys obtained from one or more public key servers.  In addition, if the 
Gentoo folks offered the public keyring for sale on CDROM, that would be a 
third, independent genre of conduit through which the veracity of the keys 
could be verified.

Within the circle of developers they should follow the guidelines offered by 
GPG and PGP WRT to key signing parties, or verifying public key fingerprints 
via snailmail and telephone calls (it does matter who calls who, etc.).  This 
can be done with a high degree of confidence, if it is done right and corners 
are not cut.

Jean.