[openpgp] Re: Primary Key Binding sigs on authentication sub keys

Justus Winter <[email protected]> Thu, 23 Jan 2025 11:29:59 +0100
Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>
Hi :)

Daniel Huigens <[email protected]> writes:
> On Wednesday, January 22nd, 2025 at 17:50, Justus Winter wrote:
>> Wait, what? Counting individual uses, I think authentication as in
>> creating signatures using my authentication-capable subkey is my primary
>> use case for OpenPGP.
>
> OK, my bad. I wasn't aware that this functionality is used in practice.
> Mainly out of curiosity, which services/software support authenticating
> in this way?

I'm using it to authenticate myself to SSH servers.  I believe this is
the most common use case for authentication subkeys.

The way I use it is that gpg-agent also implements the ssh-agent
protocol, and my ssh client talks to gpg-agent, which in turn talks to a
hardware token.

But, that is not the only way to use it.  You could also have an
encrypted softkey, have your OpenPGP software decrypt it and load it
into ssh-agent via ssh-add.

The neat thing here is that we can use OpenPGP's PKI mechanisms for
other protocols: let's say you want to give me access to a server (or a
service that uses ssh as transport and authentication mechanism, such as
git and a git forge).  You don't have to awkwardly ask me for an ssh
public key, you can authenticate my OpenPGP certificate, find an
authentication subkey bound to it, and use that.  And, if I ever revoke
my OpenPGP cert (or the authentication subkey), you can discover that
and revoke access (you as in the tooling on all of your machines).

Further, there is/was https://github.com/dkg/monkeysphere which is an
implementation of that idea.  I think the project suffered from a lack
of good tooling to build upon.

We envision more cross-protocol subkey bindings.  For example, you could
bind an MLS identity key to your OpenPGP certificate, so that others can
leverage OpenPGP's PKI to authenticate your MLS identity key.

>> FWIW, Sequoia requires primary key binding signatures on signatures
>> binding authentication-capable subkeys.

We also require primary key binding signatures on signatures binding
certification-capable subkeys.

The motivation of requiring the primary key bindings is that it gives
you an authenticated path from the subkey to the primary key.  For
example, upon seeing a login using the subkey, you can robustly discover
the OpenPGP identity associated with the subkey.

> Interesting, good to know. Have you encountered any compatibility issues
> or complaints because of this?

No we haven't.  But to be fair, it is not clear that anyone tried to use
Sequoia to reason about authentication subkeys.  If anyone does, please
do speak up.

Best,
Justus

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]
signature.asc (application/pgp-signature, 584 B)