Subject: Trust Packets

From: "Weins, Thorsten" <[email-masked]>
Date: Thu, 29 Jan 2004 10:19:30 +0100

Hello,

the implementation of Trust Packets is implementation specific.
Does anybody know, how these packets are implemented in PGP 7.x or
higher?

BTW, is there a reason why they are implementation specific? If somebody
uses
different implementations (e.g. on different platforms) of PGP, he will
not be
able to use his "one and only" keyring.

Thanks in advance,

Thorsten

---

From: Werner Koch <[email-masked]>
Date: Thu, 29 Jan 2004 14:08:52 +0100

> different implementations (e.g. on different platforms) of PGP, he will

OpenPGP defines message and key transport formats but not how an
application stores the key for its own purpose.  

The concept of a keyring is PGP specific, other implementations may
use an SQL DB or use a mixed approach, where the trust information is
kept separate from the keys.

Shalom-Salam,

   Werner

-- 
Werner Koch                                      <[email-masked]>
The GnuPG Experts                                http://g10code.com
Free Software Foundation Europe                  http://fsfeurope.org

---

From: Ian Grigg <[email-masked]>
Date: Thu, 29 Jan 2004 09:09:04 -0500

> able to use his "one and only" keyring.

Some random comments.

One of the most perceptive decisions that the early PGP
designers made was to not define trust.  This was a good
decision because trust defies definition.  Trust is too
much wrapped up in context of the user and her companion
users, and the programmer can't really narrow that down
usefully ahead of time.

Encouraging an implementation to more closely define trust,
and standardising this across implementations, would break
it.  An example of this is the x.509 PKI in use in HTTPS -
they define trust as being a CA-signed cert that includes,
for example, some notion of what country you are in (? from?).

In terms of keyrings - Werner mentioned the local issues
with databases.  Trust includes lots of information that
will/should never be exported.  By not standardising the
format of the keyrings (and suggesting inter-program exports
to be done by means of ascii-armoured keys) PGP votes to
encourage experimenting with trust at the implementation
level.  This allows an implementation to add some special
notes in there, or turn it into an addressbook, or build
up signing networks.

That's much more beneficial than some committee trying to
define trust.

iang

---

From: Len Sassaman <[email-masked]>
Date: Fri, 30 Jan 2004 09:01:25 -0800 (PST)

> users, and the programmer can't really narrow that down

I wouldn't say that they didn't define trust. PGP has internal trust
calculation algorithms, which happen not to be documented within the IETF.
I have always thought this unfortunate. I agree that trust calculation
should be orthogonal to the OpenPGP message format specification, but I do
wish that it were documented.