From 1d5010f55ce5494c853bc6f9ffb15455a7d0f189 Mon Sep 17 00:00:00 2001 From: Heiko Schaefer Date: Wed, 6 Dec 2023 15:51:03 +0100 Subject: [PATCH] Move footnote text --- book/source/04-certificates.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/book/source/04-certificates.md b/book/source/04-certificates.md index 1dea90d..1df8625 100644 --- a/book/source/04-certificates.md +++ b/book/source/04-certificates.md @@ -562,8 +562,6 @@ Different mechanisms allow certificate lookup by email, for example: Their properties differ, also see {ref}`distribution`. -[^hip1]: - (cert-freshness)= ### Certificate freshness: Triggering updates with an expiration time @@ -612,6 +610,8 @@ Different mechanisms for discovering certificates, and updating certificate data - The *keys.openpgp.org* service is a "verifying" keyserver: the keyserver software only publishes identity components (which include email addresses) after sending a verification email to that address, and receiving opt-in consent by the user of the email address. This service makes a different tradeoff: it is centralized, and relying on it to correctly perform the verification step requires trust in the operator. The tradeoff allows the service to only list identity information with the consent of the owner of that identity, and to prevent "enumeration" of the certificates and identities it stores (that is: third parties cannot obtain a list of email addresses in the service's database). By design, this service allows easy publication of revocations without requiring publication of any identity components. - *SKS-style keyservers* act as a distributed synchronizing database, which accepts certificate information without verification (TODO: does the network handle third party signatures? If so, how?[^hip1]). +[^hip1]: + One central difference between hockeypuck and hagrid (the software that runs the *keys.openpgp.org* service) is that hockeypuck distributes identity packets and third-party certifications that have indeterminate validity, while hagrid does not. (cert-flooding)=