Operation of A Web of Trust
All OpenPGP-compliant implementations include a certificate vetting scheme to assist with this; its operation has been termed a web of trust. OpenPGP identity certificates (which include public key(s) and owner information) can be digitally signed by other users who, by that act, endorse the association of that public key with the person or entity listed in the certificate. This is commonly done at key signing parties.
OpenPGP-compliant implementations also include a vote counting scheme which can be used to determine which public key – owner association a user will trust while using PGP. For instance, if three partially trusted endorsers have vouched for a certificate (and so its included public key – owner binding), OR if one fully trusted endorser has done so, the association between owner and public key in that certificate will be trusted to be correct. The parameters are user-adjustable (e.g., no partials at all, or perhaps 6 partials) and can be completely bypassed if desired.
The scheme is flexible, unlike most public key infrastructure designs, and leaves trust decision(s) in the hands of individual users. It is not perfect and requires both caution and intelligent supervision by users. Essentially all PKI designs are less flexible and require users to follow the trust endorsement of the PKI generated, certificate authority (CA)-signed, certificates. Intelligence is normally neither required nor allowed. These arrangements are not perfect either, and require both caution and care by users.
In simpler terms, you have 2 keys: a public key that you let the people you trust know; and a private key that only you know. Your public key will decrypt any information encrypted with your private key, and vice-versa. In the web of trust you have a key ring with a group of people's public keys.
You encrypt your information with the recipients public key, and only their private key will decrypt it. You then digitally sign the information with your private key, so when they verify it with your public key, they can confirm that it is you. Doing this will ensure that the information came from you and has not been tampered with, and only the person you are sending it to can read the information (because only they know their private key).
Read more about this topic: Web Of Trust
Famous quotes containing the words operation of, operation, web and/or trust:
“You may read any quantity of books, and you may almost as ignorant as you were at starting, if you don’t have, at the back of your minds, the change for words in definite images which can only be acquired through the operation of your observing faculties on the phenomena of nature.”
—Thomas Henry Huxley (1825–95)
“It is critical vision alone which can mitigate the unimpeded operation of the automatic.”
—Marshall McLuhan (1911–1980)
“Our friendships hurry to short and poor conclusions, because we have made them a texture of wine and dreams, instead of the tough fibre of the human heart. The laws of friendship are austere and eternal, of one web with the laws of nature and of morals.”
—Ralph Waldo Emerson (1803–1882)
“I cannot trust myself to put in words what I feel at this time. Every kind thought that is in your minds and every good wish that is in your hearts for me finds its responsive wish and thought in my mind and heart for each of you. I love this city. It has been my own cherished home. Twice before I have left it to discharge public duties and returned to it with gladness, as I hope to do again.”
—Benjamin Harrison (1833–1901)