X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=website%2Findex.mdwn;h=f7f9c06ab4fd5197319979ead4d82ab36faeeec9;hb=95fd733cb4c029b4221c162a38bb30eb1413b569;hp=5cdf4d9a2364c586e6996e3ef573b8b2d700634a;hpb=4a0f106f79e46edd6a0c18ec68e7f0cb9f05550f;p=monkeysphere.git diff --git a/website/index.mdwn b/website/index.mdwn index 5cdf4d9..f7f9c06 100644 --- a/website/index.mdwn +++ b/website/index.mdwn @@ -1,60 +1,86 @@ -The Monkeysphere project's goal is to extend the web of trust model and other -features of OpenPGP to other areas of the Internet to help us securely identify -each other while we work online. - -[[bugs]] | [[download]] | [[news]] - -##Conceptual overview## - -Humans (and monkeys) have innate capacity to keep track of the identity of a -finite number of people. After our social sphere exceeds several dozen or -several hundred (depending on the individual), our ability to remember and -distinguish people begins to break down. In other words, at a certain point, we -can't know for sure that the person we ran into in the produce aisle really is -the same person who we met at the party last week. - -For most of us, this limitation has not posed much of a problem in our daily, -off-line lives. With the Internet, however, we have an ability to interact -with vastly larger numbers of people than we had before. In addition, on the -Internet we lose many of our tricks for remembering and identifying people -(physical characteristics, sound of the voice, etc.). - -Fortunately, with online communications we have easy access to tools that can -help us navigate these problems. -[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) (a protocol commonly used for -sending signed and encrypted email messagess) is one such tool. In its simplest -form, it allows us to sign our communication in such a way that the recipient -can verify the sender. - -OpenPGP goes beyond this simple use to implement a feature known as the [web of -trust](http://en.wikipedia.org/wiki/Openpgp#Web_of_trust). The web of trust -allows people who have never met in person to communicate with a reasonable -degree of certainty that they are who they say they are. It works like this: -Person A trusts Person B. Person B verifies Person C's identity. Then, Person -A can verify Person C's identity. - -The Monkeyshpere's goal is to extend the use of OpenPGP from email -communications to other activities, such as: - - * trusting the servers we login to - * granting access to servers to people we've never met - -##Technical Details## - -The project's first goal is to integrate with -[OpenSSH](http://en.wikipedia.org/wiki/Openssh). - -OpenSSH provides a functional way for management of explicit RSA keys (without -certification of any type). The basic idea of this project is to create a -framework that uses GPG's keyring manipulation capabilities and public -keyservers to generate files that OpenSSH will accept and handle without -complaint. - -Both entities in an OpenSSH connection (client and server) thus have the -responsibility to explicitly designate who they trust to "introduce" others. -They can explicitly indicate this trust relationship with traditional GPG -keyring trust indicators. No modification is made to the SSH protocol on the -wire, which continues to use raw RSA public keys. +Monkeysphere is a framework to leverage the OpenPGP web of trust for +OpenSSH authentication. OpenPGP keys are tracked via GnuPG, and added +to the authorized\_keys and known\_hosts files used by OpenSSH for +connection authentication. + +[[bugs]] | [[download]] | [[news]] | [[documentation|doc]] + +## Conceptual overview ## + +[OpenSSH](http://openssh.com/) provides a functional way for +management of explicit RSA and DSA keys (without any type of [Public +Key Infrastructure +(PKI)](http://en.wikipedia.org/wiki/Public_Key_Infrastructure)). The +basic idea of this project is to create a framework that uses +[GnuPG](http://www.gnupg.org/)'s keyring manipulation capabilities and +public keyservers to generate files that OpenSSH will accept and +handle as intended. This offers users of OpenSSH an effective PKI, +including the possibility for key transitions, transitive +identifications, revocations, and expirations. It also actively +invites broader participation in the +[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) [web of +trust](http://en.wikipedia.org/wiki/Web_of_trust). + +Under the Monkeysphere, both parties to an OpenSSH connection (client +and server) have a responsibility to explicitly designate who they +trust to certify the identity of the other party. This trust +designation is explicitly indicated with traditional GPG keyring trust +model. No modification is made to the SSH protocol on the wire (it +continues to use raw RSA public keys), and it should work with +unpatched OpenSSH software. + +Monkeysphere does not modify ssh in any way, and ssh can be used "out +of the box". Monkeysphere is a set of tools that manages keys in the +known\_hosts and authorized\_keys files that ssh uses for connection +authentication. + +## Philosophy ## + +Humans (and +[monkeys](http://www.scottmccloud.com/comics/mi/mi-17/mi-17.html)) +have innate capacity to keep track of the identity of a finite number +of people. After our social sphere exceeds several dozen or several +hundred (depending on the individual), our ability to remember and +distinguish people begins to break down. In other words, at a certain +point, we can't know for sure that the person we ran into in the +produce aisle really is the same person who we met at the party last +week. + +For most of us, this limitation has not posed much of a problem in our +daily, off-line lives. With the Internet, however, we have an ability +to interact with vastly larger numbers of people than we had +before. In addition, on the Internet we lose many of our tricks for +remembering and identifying people (physical characteristics, sound of +the voice, etc.). + +Fortunately, with online communications we have easy access to tools +that can help us navigate these problems. +[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) (a cryptographic +protocol commonly used for sending signed and encrypted email +messagess) is one such tool. In its simplest form, it allows us to +sign our communication in such a way that the recipient can verify the +sender. + +OpenPGP goes beyond this simple use to implement a feature known as +the [web of trust](http://en.wikipedia.org/wiki/Web_of_trust). The web +of trust allows people who have never met in person to communicate +with a reasonable degree of certainty that they are who they say they +are. It works like this: Person A trusts Person B. Person B verifies +Person C's identity. Then, Person A can verify Person C's identity. + +The Monkeyshpere's broader goals are to extend the use of OpenPGP from +email communications to other activities, such as: + + * conclusively identifying the remote server in a remote login session + * granting access to servers to people we've never directly met + +## Links ## + +* [OpenSSH](http://openssh.com/) +* [GnuPG](http://www.gnupg.org/) +* [OpenPGP RFC 4880](http://tools.ietf.org/html/rfc4880) +* [URI scheme for SSH, RFC draft](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/) + ----