add some rough instructions on getting the extension/perl validation agent going...

[monkeysphere.git] / website / trust-models.mdwn

diff --git a/website/trust-models.mdwn b/website/trust-models.mdwn
index c8dd93615a34537167a007a995698c4a245622bb..37928ebd52f4f8759f53fefc9cd00bbbc971adc3 100644 (file)
--- a/website/trust-models.mdwn
+++ b/website/trust-models.mdwn
@@ -1,4 +1,4 @@
-[[meta title="OpenPGP Trust Models"]]
+[[!meta title="OpenPGP Trust Models"]]

 
 # OpenPGP Trust Models #
 
 
 # OpenPGP Trust Models #
 


@@ -6,11 +6,11 @@ Monkeysphere relies on GPG's definition of the OpenPGP web of trust,
 so it's important to understand how GPG calculates User ID validity
 for a key.
 
 so it's important to understand how GPG calculates User ID validity
 for a key.
 

-The basic question asked is: For a given User ID on a specific key,
-given some set of valid certifications (signatures), and some explicit
-statements about whose certifications you think are trustworthy
-(ownertrust), should we consider this User ID to be legitimately
-attached to this key (a "valid" User ID)?
+The basic question that a trust model tries to answer is: For a given
+User ID on a specific key, given some set of valid certifications
+(signatures), and some explicit statements about whose certifications
+you think are trustworthy (ownertrust), should we consider this User
+ID to be legitimately attached to this key (a "valid" User ID)?

 
 It's worth noting that there are two integral parts in this
 calculation:
 
 It's worth noting that there are two integral parts in this
 calculation:


@@ -62,9 +62,9 @@ validity*:
 
  *  Given that:
 
 
  *  Given that:
 

-        * the key itself is valid, in the first narrow sense used above, and
-        * given the UserID's set of cryptographically-correct certifications, and
-        * given your personal subjective declarations about who you trust to make certifications (and *how much* you trust them to do this), 
+    * the key itself is valid, in the first narrow sense used above, and
+    * given the UserID's set of cryptographically-correct certifications, and
+    * given your personal subjective declarations about who you trust to make certifications (and *how much* you trust them to do this), 

 
     is this User ID bound to its key with an acceptable trust path?
 
 
     is this User ID bound to its key with an acceptable trust path?
 


@@ -85,7 +85,7 @@ These colon-delimited records say (in order):
  * `1`: uses new "PGP" trust model (0 would be the "Classic trust model") -- see below
  * `1220401097`: seconds since the epoch that I created the trust db.
  * `1220465006`: seconds after the epoch that the trustdb will need to be rechecked (usually due to the closest pending expiration, etc)
  * `1`: uses new "PGP" trust model (0 would be the "Classic trust model") -- see below
  * `1220401097`: seconds since the epoch that I created the trust db.
  * `1220465006`: seconds after the epoch that the trustdb will need to be rechecked (usually due to the closest pending expiration, etc)

- * `3`: Either 3 certifications from keys with marginal ownertrust are needed for full User ID+Key validity
+ * `3`: Either 3 certifications from keys with marginal ownertrust ...

  * `1`: Or 1 certification from a key with full ownertrust is needed for full User ID+Key validity
  * `5`: `max_cert_depth` (i'm not sure exactly how this is used, though the name is certainly suggestive)
 
  * `1`: Or 1 certification from a key with full ownertrust is needed for full User ID+Key validity
  * `5`: `max_cert_depth` (i'm not sure exactly how this is used, though the name is certainly suggestive)
 


@@ -133,7 +133,7 @@ formally public by publishing the trust signature to any keyserver.
 
 If you trust my judgement in this area ([the
 spec](http://tools.ietf.org/html/rfc4880#section-5.2.3.13) calls my
 
 If you trust my judgement in this area ([the
 spec](http://tools.ietf.org/html/rfc4880#section-5.2.3.13) calls my

-role in this scenario a "meta introducer"), then you should be able to
+role in this scenario a "!meta introducer"), then you should be able to

 automatically accept certifications made by my sister by creating a
 level 2 trust signature on my key.  You can choose whether to publish
 this trust signature or not, but as long as your `gpg` instance knows
 automatically accept certifications made by my sister by creating a
 level 2 trust signature on my key.  You can choose whether to publish
 this trust signature or not, but as long as your `gpg` instance knows