What a public key directory is
A public key lets you check a signature or encrypt something for one person. It only helps if you know whose key it is. A public key directory is the place that answers that, and this page explains how one can answer without asking you to take its word.
Written on
A key on its own says nothing#
A public key is a long string of characters, and every key looks like every other. Someone sends you one and says it’s theirs. You have no way to tell, from the string, whether it came from them or from someone sitting between you. If the key arrived through the same channel an attacker controls, such as a hacked account or a forged email, checking signatures with it proves nothing.
Messaging apps solve this inside their own walls with safety numbers that two people compare in person. That works for one conversation. It doesn’t help when you want to check a release, a commit or a message from someone you know only online.
Tie the key to the accounts people know#
People know each other by accounts: a Discord name, a GitHub profile, an email address, a domain, a Fediverse handle. A directory becomes useful when each key comes with proofs that the same person controls those accounts. Then you can start from what you already know and arrive at the right key.
On Veil this is a card. It holds the owner’s device keys and the accounts they have linked, each with its proof, and it works both ways. From an account you get the key. From a key, a fingerprint or a signature you get the card and the accounts that confirm it. And since the keys stay on the owner’s devices, someone who steals one of those accounts can get into it but can’t sign as its owner.
How a transparency log keeps the directory honest#
A directory could lie. It could hand you an old key, or show one key to you and another to everyone else. A transparency log makes that kind of lie visible. Every change to every card is appended to the log, and nothing in it can be edited or removed later. The entries form a Merkle tree, and a short signed note called a checkpoint states the size of the tree and the hash at its root.
Two small proofs come with that. An inclusion proof shows that one entry is in the tree a checkpoint describes. A consistency proof shows that a newer checkpoint extends an older one without changing anything already there. Your browser asks for both and checks them. Certificate Transparency, which every web browser relies on for HTTPS certificates, works the same way.
What the witnesses do#
A log could still show two different trees to two different readers. Witnesses close that gap. They are independent operators who each keep their own copy of the latest checkpoint, check that every new one is consistent with the last, and only then cosign it. Veil’s log is followed by witnesses of the Witness Network, among them Google’s transparency team, Mullvad and Geomys, and a checkpoint counts only with at least two of their signatures.
To show you a different card from the one everyone else sees, Veil would need witnesses to cosign two histories that can’t both be true. An honest witness refuses the second one, because it doesn’t extend the history it already saw. The public log is open to anyone who wants to read it.
Questions#
Is a transparency log a blockchain?
No. A transparency log has one operator who writes and many readers and witnesses who check. There is no mining and no token, and checking an entry takes a couple of small proofs.
What do I have to trust when I use Veil?
The code that runs the check in your browser, which you can read, and the assumption that Veil’s log and the witnesses who cosign it don’t all lie together. You don’t have to trust Veil’s server, because its answers are checked against the log.
Who else uses key transparency?
Certificate Transparency has covered web certificates for years. WhatsApp and Apple’s iMessage have both announced key transparency for their users’ keys. Veil applies the same idea to an open directory that anyone can read.
Can I check the log myself?
Yes. The log is public at log.veil.pub, and the veil command line checks cards and checkpoints from a terminal with the same rules as the browser.