PGP: Difference between revisions
m (→Basics) |
m (→Trust: Minor cleanup) |
||
==Trust==
One of the big issues with any system for associating an identity with a person (e.g. a PGP key with a real person) is proving that link. How do you know someone is who they say they are. How do you know that someone's key is theirs
All keys have a fingerprint, which is easy enough to read out over the phone or check on a business card, etc. This is one way to check a key is genuine. You can then tell the key management software that you trust that the key
It is also possible to say that you trust someone to sign other keys. For example, if you trust the Andrews & Arnold Ltd company key to sign other keys, then any of our staff keys will immediately appear to be valid when you download them from a key server because the key itself is digitally signed by the Andrews & Arnold Ltd company key.
Even without knowing someone is who they say they are, PGP provides a
==Changing your key/passphrase==
|