Path: csiph.com!weretis.net!feeder8.news.weretis.net!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Patricia Ferreira <pferreira@example.com>
Newsgroups: pt.comp.programacao
Subject: Re: Lisp, um mapa de trajeto
Date: Sun, 14 Jan 2024 11:01:16 -0300
Organization: A noiseless patient Spider
Lines: 53
Message-ID: <87edekrp3n.fsf@example.com>
References: <ungjlm$1gn5r$1@dont-email.me> <87sf37ajzn.fsf@example.com> <unj52m$1v0s5$1@dont-email.me> <87y1cy8z8u.fsf@example.com> <87v881z5qs.fsf@brilhante.top> <87a5pd6kuv.fsf@yaxenu.org> <8734v3ztrz.fsf@brilhante.top> <877cke4ny3.fsf@example.com> <87y1cujtsk.fsf@brilhante.top> <87ttni48z9.fsf@example.com> <87r0im428v.fsf@brilhante.top> <87edem3yds.fsf@example.com> <87edel4avz.fsf@brilhante.top> <874jfhvwb9.fsf@example.com> <uo0c1e$d6he$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: dont-email.me; posting-host="f00027c86e22405980e672862dc680af"; logging-data="494040"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18Ie4HJzIYTE4n7mokGUQ1Ru9XBrUPucQY="
Cancel-Lock: sha1:7fzIfqinMs8anQfMkhRuWQjWjt4= sha1:PRJLGEKtMi5xIlVapqvygWblwqE=
Xref: csiph.com pt.comp.programacao:152

Ninguém <usenet@rasparta.org> writes:

> On 13/01/24 19:59, Patricia Ferreira wrote:
>> Já entendi.  Você quer brincar de criptografia.  Podemos brincar.
> Eu gostava de "brincar de criptografia" com vocês? Posso? Quem é o
> dono da bola?

O dono da bola é o Eternal September --- da minha perspectiva.

> Para começar, ajudem-me a perceber como gerir as chaves pgp (gpg).
> Dentro de ~/.gnupg/ tenho:
> pubring.kbx (GPG keybox database)
> trustdb.gpg (GPG key trust database)
>
> O que são cada uma delas (o que contêm)?

O manual explica.  O pubring.kbx, como o nome sugere, é o seu chaveiro.
Você pega a chave de alguém e guarda em algum lugar --- esse lugar é o
seu chaveiro.  O trustdb.gpg é uma base de dados que armazena a rede de
confiança.  Pra compreender o que é essa rede de confiança --- chamada
de /web of trust/, recomendo a leitura do manual, que vai explicar muito
melhor que qualquer parágrafo meu por aqui.  Eis o trecho introdutório
do capítulo 2, ``concepts'', do ``The GNU Privacy Handbook''.

--8<---------------cut here---------------start------------->8---
(*) Validating other keys on your public keyring

In Chapter 1 a procedure was given to validate your correspondents'
public keys: a correspondent's key is validated by personally checking
his key's fingerprint and then signing his public key with your private
key. By personally checking the fingerprint you can be sure that the key
really does belong to him, and since you have signed they key, you can
be sure to detect any tampering with it in the future. Unfortunately,
this procedure is awkward when either you must validate a large number
of keys or communicate with people whom you do not know personally.

GnuPG addresses this problem with a mechanism popularly known as the web
of trust. In the web of trust model, responsibility for validating
public keys is delegated to people you trust. For example, suppose

Alice has signed Blake's key, and

Blake has signed Chloe's key and Dharma's key.

If Alice trusts Blake to properly validate keys that he signs, then
Alice can infer that Chloe's and Dharma's keys are valid without having
to personally check them. She simply uses her validated copy of Blake's
public key to check that Blake's signatures on Chloe's and Dharma's are
good. In general, assuming that Alice fully trusts everybody to properly
validate keys they sign, then any key signed by a valid key is also
considered valid. The root is Alice's key, which is axiomatically
assumed to be valid.
--8<---------------cut here---------------end--------------->8---