Authentication using GPG

Question

I've been reading about authentication, both in-band and out-band. I know one can sign his/her own GPG key and then others can verify the signer using their fingerprint.

I also read GPG key signing question posted at : https://stackoverflow.com/questions/34234/how-does-gpg-key-signing-work-and-how-is-it-done

Isn't this type of authentication vulnerable to man in the middle attacks? How does one fully verify an identity without using digital signatures?

PS: I've looked at the following ways for authentication: GPG signed messages (emails), SMS (out of band), using a shared secret password, application of the socialist millionaire protocol and zero knowledge based undeniable authentication.

Which one of the above listed serves best for preventing man in the middle attacks and also provide good amount of authentication?

Answer 1

The protection from man-in-the-middle attacks is your brains :-) When signing keys, GPG will ask you if you really checked the key owner's identity, just as the GPG howtos (e.g. this one) warn you to be careful what you're doing here:

You should only sign a key as being authentic when you are ABSOLUTELY SURE that the key is really authentic!!!. So if you are positive you got the key yourself (like on a key signing party) or you got the key through other means and checked it (for instance by phone) using the fingerprint-mechanism. You should never sign a key based on any assumption.

When signing a key, it is your responsibility to verify the identity of the key owner. In contrast to CACert (which has a defined procedure how to verify ones identity), there is no general policy how this verification is to be done. Then, on the other hand, GPG makes it up to you whom you trust to introduce new keys.

This means:

• You should make yourself acquainted how to verify that a key actually belongs to the person the key id says. The CACert guidelines (personal meeting, checking official documents, exchange of fingerprints) are good for people you don't know personally, for good pals of you the personal exchange of the fingerprint (or verifying the fingerprint via phone if you recognice the voice of your friend) should suffice, too
• You should only set the trust attribute of keys belonging to persons of whom you are absolutely sure they understood the meaning of a signature and do a careful checking as mentioned above.