Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.213.180 as permitted sender)
	client-ip=209.85.213.180; envelope-from=gmaxwell@gmail.com;
	helo=mail-ig0-f180.google.com; 
MIME-Version: 1.0
In-Reply-To: <3205491.XcafbkJRvW@crushinator>
References: <20140913135528.GC6333@muck>
	<3E354504-0203-4408-85A1-58A071E8546A@gmail.com>
	<3586037.E6tZxYPG6n@coldstorage> <3205491.XcafbkJRvW@crushinator>
Date: Mon, 15 Sep 2014 16:10:14 +0000
Message-ID: <CAAS2fgRXUZxHSPyCo-tNdFE8nSky5ocuaPp7Yo-SbTXinQOpNQ@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Matt Whitlock <bip@mattwhitlock.name>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Does anyone have anything at all signed
 by Satoshi's PGP key?
Precedence: list

On Mon, Sep 15, 2014 at 3:51 PM, Matt Whitlock <bip@mattwhitlock.name> wrot=
e:
> On Monday, 15 September 2014, at 5:10 pm, Thomas Zander wrote:
>> So for instance I start including a bitcoin public key in my email signa=
ture.
>> I don't sign the emails or anything like that, just to establish that ev=
eryone
>> has my public key many times in their email archives.
>> Then when I need to proof its me, I can provide a signature on the conte=
nt
>> that the requester wants me to sign.
>
> That would not work. You would need to sign your messages. If you were me=
rely attaching your public key to them, then the email server could have be=
en systematically replacing your public key with some other public key, and=
 then, when you would later try to provide a signature, your signature woul=
d not verify under the public key that everyone else had been seeing attach=
ed to your messages.

If the server could replace the public key, it could replace the
signature in all the same places.

Please, can this stuff move to another list? It's offtopic.