If you are one of those who find it easier to understand the Maths behind public key encryption, than to implement the tools to correctly encrypt and/or sign your emails and attachements, you are on the right post. If not, you might still learn something here.
Yesterday I had a conversation with a friend who is a certified ethical hacker and an early-pre-Snowden-adopter of PGP, and to my biggest surprise, he was not aware of how the public keys and signatures are trusted on the public domain.
Let me recall why public key encryption works: imagine a box with two keys, one only able to open it, and one only able to close it. You keep the opening key with you, and distribute in the public domain copies of the closing key: people can come to you box, put their message, and close the box, no one is able to open the box but you. This relies on the mathematical foundations for why it is impossible to guess your private key. Unless of course your computer is compromised with trojans… You find a 6 minutes video explaining this principle on Wandida in English, Arabic, French and Maghrebi Darija.
Public key encryption or asymmetric encryption has solved a problem as old as humanity: how to encrypt conversation without the need to agree with each correspondant on the same way to encrypt the messages, and without having a different secret for each correspondant.
Now the problem rising here is “how to know that the public key on the public domain is really yours ?”
Why it cannot be someone pretending to be you, putting it an email adress and a public key on your behalf that are not yours, and then receives the conversations intended to be sent to you ?
The answer lies in the Web of Trust: once you (let us call you A) put the key on the public domain, it should be validated by someone (call him B) who is 100% sure the key is yours. For B, your key (and/or you signature) is trusted. But what about someone who do not know you but knows B ?
Put simply, the web of trust starts from this simplified scheme:
If a third correspondant, C, fully trusts B, he would infer that your key is valid by simply using his validated copy of B’s public key to check that B’s signatures on yours is good. But C can also choose not to fully rely on B’s validation of your key, the web of trust model accounts for this by associating with each public key on your keyring an indication of how much you trust the key’s owner.
With this principle, you can define four types of trust, full trust, marginal trust, none and unknown all explained in details at the GNU Privacy Handbook.
Thanks to Giuliano L. for helpful explanations on the web of trust.