KEYMANAGER 0.4.0- validation levels
Implement levels of trust to validate new keys: https://leap.se/en/docs/design/nicknym#Automatic.key.validation https://leap.se/en/docs/tech/hard-problems#Public.key.problem
A conversation on irc about it:
[12:27:12] for key management, the essential thing that is missing, afaik, are some strict and consistent rules as to when the key manager will accept a key update. [12:27:57] for this, i think we come up with a numbering system for how a key was validated. i use 'validated' and not 'authenticated', since the latter is a cryptographic term and 'validated' is much more fuzzy. [12:28:32] so, maybe there is a very low level of validation, level 0, where we just discovered the key on a keyserver and we otherwise have no reason to suspect it is actually valid. [12:31:53] elijh: sounds good, we can store the level with the key and check if the new key has >= level [12:35:00] meskio: yeah, and if we add new methods that are better then some previous methods and worse that some previous methods, we can make the number a decimal, e.g. validation level = 2.5 [12:37:22] uff, that will get complex [12:37:43] maybe is better to have some kind of names for the levels instead of numbers in the storage [12:37:54] what matters is rank [12:37:58] and later in the code map this names to numbers for the comparation [12:38:07] yep [12:38:16] aka classes + __cmp__ [12:38:18] if new ones are added, decimal numbering is better than trying to change all previous keys [12:38:43] ok, sure, storing symbols work, i guess
(from redmine: created on 2014-08-27, closed on 2015-05-18, relates #875 (closed), precedes #6120 (closed))