<![CDATA[In an E2EE system, how does Alice know what Bob's public key is?]]>In an E2EE system, how does Alice know what Bob's public key is?

]]>https://board.circlewithadot.net/topic/acad8967-a485-4924-8409-5c4c0f720f99/in-an-e2ee-system-how-does-alice-know-what-bob-s-public-key-isRSS for NodeFri, 17 Apr 2026 00:05:36 GMTWed, 08 Apr 2026 16:23:01 GMT60<![CDATA[Reply to In an E2EE system, how does Alice know what Bob's public key is? on Wed, 08 Apr 2026 17:06:06 GMT]]>@ghosttie @dacmot I think you need a second communication channel. And something to corroborate that multiple channels are controlled by the same person. The most surefire way is to meet in person and confirm the keys. I don't think there's a purely technical way to solve this without putting trust into some central authority. It's inherently a social problem.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Zoarial94/statuses/116370175881864636https://board.circlewithadot.net/post/https://infosec.exchange/users/Zoarial94/statuses/116370175881864636Wed, 08 Apr 2026 17:06:06 GMT<![CDATA[Reply to In an E2EE system, how does Alice know what Bob's public key is? on Wed, 08 Apr 2026 17:04:49 GMT]]>@ghosttie one way would be to meet in person.

In a system like Signal, it would be built in to the user ID. For things like PGP/GPG, websites, or developer signing key, there are multiple mechanisms to verify the key identity. You can use a web of trust (WOT) or keyrings, certificate authorities like DigiCert/Let's Encrypt, or MS/Google/Apple issuing signing keys.

Note that none of those methods are perfect, and a bad actor could still manage to impersonate someone else. But it makes it significantly harder.

]]>https://board.circlewithadot.net/post/https://sunny.garden/users/dacmot/statuses/116370170808485464https://board.circlewithadot.net/post/https://sunny.garden/users/dacmot/statuses/116370170808485464Wed, 08 Apr 2026 17:04:49 GMT<![CDATA[Reply to In an E2EE system, how does Alice know what Bob's public key is? on Wed, 08 Apr 2026 16:54:39 GMT]]>@dacmot how does Alice know that's Bob's actual public key and not Mallory's?

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/ghosttie/statuses/116370130856402817https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/ghosttie/statuses/116370130856402817Wed, 08 Apr 2026 16:54:39 GMT<![CDATA[Reply to In an E2EE system, how does Alice know what Bob's public key is? on Wed, 08 Apr 2026 16:53:25 GMT]]>@ghosttie it's public, so either Bob can send it to Alice, or if it's part of a system like Signal, then the public key is part (maybe hidden /abstracted) of the user profile data.

]]>https://board.circlewithadot.net/post/https://sunny.garden/users/dacmot/statuses/116370125965535884https://board.circlewithadot.net/post/https://sunny.garden/users/dacmot/statuses/116370125965535884Wed, 08 Apr 2026 16:53:25 GMT