>
> If you *really* did all the things you described, and Jim signed his
> communication keys with his auth key, then the comm keys should get
> accepted, I think. Have you tried gpg --check-sigs on both keys?
> Does gpg --edit-key <auth-key> list the trust as "f/f"?
>
Thanks for the reply. I really did all the things I said (sign, add,
trust, update. add, update, etc.). I think the path of trust should
be complete as well, although I think my logic in my last e-mail was
flawed. I assumed that who owns a key matters, and now I think it doesn't.
All that matters is that there is a "path of signatures" leading back
to my key. I think the path of signatures here is complete, but gpg
claims there is not enough info to evaluate trust of my friend's comm-key.
This is what --check-sigs and --edit-key reveal. ID1 is his auth-key,
ID2 is his comm-key, ID3 is his comm-sub-key, and ID4 is my key ID.
The ID's 0, -1 and -2 are older keys used by the same individual.
gpg --check-sigs Jim@Jim.com
pub 1024D/ID0 1999-09-05 Jim Smith <Jim@Jim.com>
sig! ID-1 1999-09-05 Jim Smith <Jim@Jim.com>
sub 2048g/ID-2 1999-09-05
sig! ID-1 1999-09-05 Jim Smith <Jim@Jim.com>
pub 1024D/ID2 2000-08-10 Jim Smith <Jim@Jim.com>
sig! ID2 2000-08-10 Jim Smith <Jim@Jim.com>
sig! ID1 2000-08-11 Jim Smith <Jim@Jim.com>
sub 4096g/ID3 2000-08-10 [expires: 2001-02-06]
sig! ID2 2000-08-10 Jim Smith <Jim@Jim.com>
pub 1024D/ID1 2000-02-13 Jim Smith <Jim@Jim.com>
sig! ID1 2000-02-13 Jim Smith <Jim@Jim.com>
sig! ID4 2000-08-19 Rich Bodo <rsb@ostel.com>
gpg --edit-key ID1
pub 1024D/ID1 created: 2000-02-13 expires: never trust: f/f
(1) Jim Smith <Jim@Jim.com>
gpg --edit-key ID2
pub 1024D/ID2 created: 2000-08-10 expires: 2001-02-06 trust: -/q
sub 4096g/ID3 created: 2000-08-10 expires: 2001-02-06
(1) Jim Smith <Jim@Jim.com>
gpg --edit-key ID4
Secret key is available.
pub 1024D/ID4 created: 1999-10-26 expires: never trust: -/u
sub 1024g/ID5 created: 1999-10-26 expires: never
(1) Rich Bodo <rsb@ostel.com>
The two things that look suspicious here are that I have an old key of
his, and my own keys have no ownertrust assigned. I don't think the
old key should matter whatsoever. That my own key has no ownertrust
assigned is a surprise. O.K. I guess having the secret key in my
secret keyring doesn't mean that I trust the owner. I'm sure there is a
good reason for that, I just can't fathom it right now. Let's see
what happens when I mark my own public key as full/ultimate
trust...NOPE :(. GPG still tells me there is no path when I try to encrypt.
Here is the command I use:
gpg -o gpgfile -se -r ID2 clearfile
And here is the error I get:
No path leading to one of our keys found.
4096g/ID3 2000-08-10 "Jim Smith <Jim@Jim.com>"
Fingerprint: blah blah blah
It is NOT certain that the key belongs to its owner.
If you *really* know what you are doing, you may answer
the next question with yes
So I answer no. Well, some new info, if no new solution. If anyone
sees an obvious mistake, please let me know.
-Rich
--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org
> If you *really* did all the things you described, and Jim signed his
> communication keys with his auth key, then the comm keys should get
> accepted, I think. Have you tried gpg --check-sigs on both keys?
> Does gpg --edit-key <auth-key> list the trust as "f/f"?
>
Thanks for the reply. I really did all the things I said (sign, add,
trust, update. add, update, etc.). I think the path of trust should
be complete as well, although I think my logic in my last e-mail was
flawed. I assumed that who owns a key matters, and now I think it doesn't.
All that matters is that there is a "path of signatures" leading back
to my key. I think the path of signatures here is complete, but gpg
claims there is not enough info to evaluate trust of my friend's comm-key.
This is what --check-sigs and --edit-key reveal. ID1 is his auth-key,
ID2 is his comm-key, ID3 is his comm-sub-key, and ID4 is my key ID.
The ID's 0, -1 and -2 are older keys used by the same individual.
gpg --check-sigs Jim@Jim.com
pub 1024D/ID0 1999-09-05 Jim Smith <Jim@Jim.com>
sig! ID-1 1999-09-05 Jim Smith <Jim@Jim.com>
sub 2048g/ID-2 1999-09-05
sig! ID-1 1999-09-05 Jim Smith <Jim@Jim.com>
pub 1024D/ID2 2000-08-10 Jim Smith <Jim@Jim.com>
sig! ID2 2000-08-10 Jim Smith <Jim@Jim.com>
sig! ID1 2000-08-11 Jim Smith <Jim@Jim.com>
sub 4096g/ID3 2000-08-10 [expires: 2001-02-06]
sig! ID2 2000-08-10 Jim Smith <Jim@Jim.com>
pub 1024D/ID1 2000-02-13 Jim Smith <Jim@Jim.com>
sig! ID1 2000-02-13 Jim Smith <Jim@Jim.com>
sig! ID4 2000-08-19 Rich Bodo <rsb@ostel.com>
gpg --edit-key ID1
pub 1024D/ID1 created: 2000-02-13 expires: never trust: f/f
(1) Jim Smith <Jim@Jim.com>
gpg --edit-key ID2
pub 1024D/ID2 created: 2000-08-10 expires: 2001-02-06 trust: -/q
sub 4096g/ID3 created: 2000-08-10 expires: 2001-02-06
(1) Jim Smith <Jim@Jim.com>
gpg --edit-key ID4
Secret key is available.
pub 1024D/ID4 created: 1999-10-26 expires: never trust: -/u
sub 1024g/ID5 created: 1999-10-26 expires: never
(1) Rich Bodo <rsb@ostel.com>
The two things that look suspicious here are that I have an old key of
his, and my own keys have no ownertrust assigned. I don't think the
old key should matter whatsoever. That my own key has no ownertrust
assigned is a surprise. O.K. I guess having the secret key in my
secret keyring doesn't mean that I trust the owner. I'm sure there is a
good reason for that, I just can't fathom it right now. Let's see
what happens when I mark my own public key as full/ultimate
trust...NOPE :(. GPG still tells me there is no path when I try to encrypt.
Here is the command I use:
gpg -o gpgfile -se -r ID2 clearfile
And here is the error I get:
No path leading to one of our keys found.
4096g/ID3 2000-08-10 "Jim Smith <Jim@Jim.com>"
Fingerprint: blah blah blah
It is NOT certain that the key belongs to its owner.
If you *really* know what you are doing, you may answer
the next question with yes
So I answer no. Well, some new info, if no new solution. If anyone
sees an obvious mistake, please let me know.
-Rich
--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org