Skip to content

KEYMANAGER 0.4.0- validation levels

Implement levels of trust to validate new keys: https://leap.se/en/docs/design/nicknym#Automatic.key.validation https://leap.se/en/docs/tech/hard-problems#Public.key.problem

A conversation on irc about it:

[12:27:12]  for key management, the essential thing that is missing, afaik, are some strict and consistent rules as to when the key manager will accept a key update.
[12:27:57]  for this, i think we come up with a numbering system for how a key was validated. i use 'validated' and not 'authenticated', since the latter is a cryptographic term and 'validated' is much more fuzzy.
[12:28:32]  so, maybe there is a very low level of validation, level 0, where we just discovered the key on a keyserver and we otherwise have no reason to suspect it is actually valid.
[12:31:53]  elijh: sounds good, we can store the level with the key and check if the new key has >= level
[12:35:00]  meskio: yeah, and if we add new methods that are better then some previous methods and worse that some previous methods, we can make the number a decimal, e.g. validation level = 2.5
[12:37:22]  uff, that will get complex
[12:37:43]  maybe is better to have some kind of names for the levels instead of numbers in the storage
[12:37:54]  what matters is rank
[12:37:58]  and later in the code map this names to numbers for the comparation
[12:38:07]  yep
[12:38:16]  aka classes + __cmp__
[12:38:18]  if new ones are added, decimal numbering is better than trying to change all previous keys
[12:38:43]  ok, sure, storing symbols work, i guess

(from redmine: created on 2014-08-27, closed on 2015-05-18, relates #875 (closed), precedes #6120 (closed))