X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=website%2Ftrust-models.mdwn;h=37928ebd52f4f8759f53fefc9cd00bbbc971adc3;hb=9fb7f481e3d09d3b3658cb78bd75c4910fff8c0a;hp=792c6b65d27aa206ab15caa7e96b2797af505ad7;hpb=47310fe430e417934b582b9aa716a9de473ac46a;p=monkeysphere.git diff --git a/website/trust-models.mdwn b/website/trust-models.mdwn index 792c6b6..37928eb 100644 --- a/website/trust-models.mdwn +++ b/website/trust-models.mdwn @@ -1,4 +1,4 @@ -[[meta title="OpenPGP Trust Models"]] +[[!meta title="OpenPGP Trust Models"]] # OpenPGP Trust Models # @@ -6,11 +6,11 @@ Monkeysphere relies on GPG's definition of the OpenPGP web of trust, so it's important to understand how GPG calculates User ID validity for a key. -The basic question asked is: For a given User ID on a specific key, -given some set of valid certifications (signatures), and some explicit -statements about whose certifications you think are trustworthy -(ownertrust), should we consider this User ID to be legitimately -attached to this key (a "valid" User ID)? +The basic question that a trust model tries to answer is: For a given +User ID on a specific key, given some set of valid certifications +(signatures), and some explicit statements about whose certifications +you think are trustworthy (ownertrust), should we consider this User +ID to be legitimately attached to this key (a "valid" User ID)? It's worth noting that there are two integral parts in this calculation: @@ -85,7 +85,7 @@ These colon-delimited records say (in order): * `1`: uses new "PGP" trust model (0 would be the "Classic trust model") -- see below * `1220401097`: seconds since the epoch that I created the trust db. * `1220465006`: seconds after the epoch that the trustdb will need to be rechecked (usually due to the closest pending expiration, etc) - * `3`: Either 3 certifications from keys with marginal ownertrust are needed for full User ID+Key validity + * `3`: Either 3 certifications from keys with marginal ownertrust ... * `1`: Or 1 certification from a key with full ownertrust is needed for full User ID+Key validity * `5`: `max_cert_depth` (i'm not sure exactly how this is used, though the name is certainly suggestive) @@ -133,7 +133,7 @@ formally public by publishing the trust signature to any keyserver. If you trust my judgement in this area ([the spec](http://tools.ietf.org/html/rfc4880#section-5.2.3.13) calls my -role in this scenario a "meta introducer"), then you should be able to +role in this scenario a "!meta introducer"), then you should be able to automatically accept certifications made by my sister by creating a level 2 trust signature on my key. You can choose whether to publish this trust signature or not, but as long as your `gpg` instance knows