Web of trust

As explained in Real-World Cryptography

A web of trust is a decentralized model in which users establish confidence in public-key-to-identity associations through signatures and transitive trust.

A web of trust lets users establish confidence in public-key-to-identity associations through signatures. If Alice trusts Bob and Bob signs Charles’s key, Alice can transitively trust Charles’s key. section 10.3.2

The model works through a small chain of social verification:

• Obtain and verify Bob’s public key in person. section 10.3.2
• Rely on Bob’s signature associating Mark’s public key with Mark’s identity. section 10.3.2
• Treat key-signing parties as a possible but cumbersome way to expand the trust network. section 10.3.2 section 10.4.1

Figure 10.4 The web of trust (WOT) is the concept that users can transitively trust other users by relying on signatures. In this figure, we can see that Alice trusts Bob who trusts Charles. Alice can use Bob’s signature over Charles’s identity and public key to trust Charles as well.

Follow the Alice–Bob–Charles chain to see how signatures support transitive trust. section 10.3.2

How Real-World Cryptography covers it

How deep it goes

Explains transitive signatures and key-signing practices, but stops short of implementation details or formal trust calculations.

Examples

Uses Alice, Bob, and Charles; key-signing parties; and PGP email trust expansion.

What it assumes

Assumes familiarity with public keys, identities, signatures, and encrypted messaging.

What you can do after

Understand how signatures can extend trust across users and why cumbersome verification limits adoption.

How it connects

Connects public-key cryptography, digital signatures, end-to-end encryption, PGP, and trust on first use.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• decentralizationequivalent to · Decentralization is an arrangement in which authority, control, or responsibility is distributed among multiple participants rather than concentrated in a central authority.
• PGPused by · PGP is a cryptographic standard for protecting messages and files with public-key encryption, digital signatures, and key management.
• digital signatureuses · A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.