From Pretty Good To Great: Enhancing PGP using Bitcoin and the Blockchain

TL;DR

This paper enhances PGP's Web of Trust by integrating Bitcoin transactions for trust verification, creating a more quantifiable and secure trust system, and demonstrating a blockchain-based key server with a prototype application.

Contribution

It introduces Bitcoin-based certificates for trust verification, a blockchain-backed distributed PGP key server, and a prototype demonstrating these innovations.

Findings

Bitcoin-based certificates enable trust verification with actual transaction values.

A distributed PGP key server leveraging Bitcoin blockchain is designed.

Prototype application demonstrates practical implementation of the proposed system.

Abstract

PGP is built upon a Distributed Web of Trust in which the trustworthiness of a user is established by others who can vouch through a digital signature for that particular identity. Preventing its wholesale adoption are a number of inherent weaknesses to include (but not limited to) the following: 1) Trust Relationships are built on a subjective honor system, 2) Only first degree relationships can be fully trusted, 3) Levels of trust are difficult to quantify with actual values, and 4) Issues with the Web of Trust itself (Certification and Endorsement). Although the security that PGP provides is proven to be reliable, it has largely failed to garner large scale adoption. In this paper, we propose several novel contributions to address the aforementioned issues with PGP and associated Web of Trust. To address the subjectivity of the Web of Trust, we provide a new certificate format based on Bitcoin which allows a user to verify a PGP certificate using Bitcoin identity-verification transactions - forming first degree trust relationships that are tied to actual values (i.e., number of Bitcoins transferred during transaction). Secondly, we present the design of a novel Distributed PGP key server that leverages the Bitcoin transaction blockchain to store and retrieve Bitcoin-Based PGP certificates. Lastly, we provide a web prototype application that demonstrates several of these capabilities in an actual environment.