From: "Antti Kurenniemi" 

Thanks, I got it now - so it's there for checking your identity if I feel
like doing so, and also to use as a key if I want to send you private
message.

But doesn't the first part, the identifying, sort of fail if you always
sign your messages? I mean, what's to stop me from copying your signature
and sending a message as Chris, which someone would the look up and confirm
that yes, this is indeed from Chris?


Antti Kurenniemi

"Chris"  wrote in message news:4429952a$1{at}w3....
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> No, not really.  The PGP Public Key is used if you want to send me an
> encrypted message.  My private key is not available to the general
> populous because it's just that...private (and used to decode the
> messages encrypted with the public key).
>
> The reason you can read the message is because I did not encrypt the
> message.  Signing the message with my PGP key is like a digital
> signature, if you will permit the analogy.  You can examine the
> signature and compare it to the signature found on the various PGP Key
> repositories.  For example, in alt.games.microsoft.flight-sim, there is
> a poster named Lawn Dart who signs her messages.  I have a plug-in for
> Thunderbird that examines the PGP key and, if I choose, can validate it
> against the repositories.  The US-CERT signs all of their messages, too.
> Part of this is to verify the authenticity of a message.  Ok, I've
> rambled and confused it all around.  Can someone make better sense of
> what I am saying?
>
> Also, for Antti's benefit (and with Geo's tolerance), I will post a
> duplicate of this message in an encrypted form.
>
> /Chris
>

--- BBBS/NT v4.01 Flag-5