Operation of A Web of Trust
All OpenPGP-compliant implementations include a certificate vetting scheme to assist with this; its operation has been termed a web of trust. OpenPGP identity certificates (which include public key(s) and owner information) can be digitally signed by other users who, by that act, endorse the association of that public key with the person or entity listed in the certificate. This is commonly done at key signing parties.
OpenPGP-compliant implementations also include a vote counting scheme which can be used to determine which public key – owner association a user will trust while using PGP. For instance, if three partially trusted endorsers have vouched for a certificate (and so its included public key – owner binding), OR if one fully trusted endorser has done so, the association between owner and public key in that certificate will be trusted to be correct. The parameters are user-adjustable (e.g., no partials at all, or perhaps 6 partials) and can be completely bypassed if desired.
The scheme is flexible, unlike most public key infrastructure designs, and leaves trust decision(s) in the hands of individual users. It is not perfect and requires both caution and intelligent supervision by users. Essentially all PKI designs are less flexible and require users to follow the trust endorsement of the PKI generated, certificate authority (CA)-signed, certificates. Intelligence is normally neither required nor allowed. These arrangements are not perfect either, and require both caution and care by users.
In simpler terms, you have 2 keys: a public key that you let the people you trust know; and a private key that only you know. Your public key will decrypt any information encrypted with your private key, and vice-versa. In the web of trust you have a key ring with a group of people's public keys.
You encrypt your information with the recipients public key, and only their private key will decrypt it. You then digitally sign the information with your private key, so when they verify it with your public key, they can confirm that it is you. Doing this will ensure that the information came from you and has not been tampered with, and only the person you are sending it to can read the information (because only they know their private key).
Read more about this topic: Web Of Trust
Famous quotes containing the words operation, web and/or trust:
“Human knowledge and human power meet in one; for where the cause is not known the effect cannot be produced. Nature to be commanded must be obeyed; and that which in contemplation is as the cause is in operation as the rule.”
—Francis Bacon (1560–1626)
“However, our fates at least are social. Our courses do not diverge; but as the web of destiny is woven it is fulled, and we are cast more and more into the centre. Men naturally, though feebly, seek this alliance, and their actions faintly foretell it.”
—Henry David Thoreau (1817–1862)
“Nevertheless, no school can work well for children if parents and teachers do not act in partnership on behalf of the children’s best interests. Parents have every right to understand what is happening to their children at school, and teachers have the responsibility to share that information without prejudicial judgment.... Such communication, which can only be in a child’s interest, is not possible without mutual trust between parent and teacher.”
—Dorothy H. Cohen (20th century)