Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

GnuPG subkeys can be flagged with three kind of capabilities: Sign, Encrypt and Authenticate.

While the first two actions are widely used and documented, the authenticate action is somehow mysterious. You can make such key only using editing a primary key with the --expert option:

$ gpg --expert --edit-key 889C36B7
gpg (GnuPG/MacGPG2) 2.0.17; Copyright (C) 2011 Free Software Foundation, Inc.
gpg> addkey    
...                  
Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Sign Encrypt 
   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished
...

There are rumors about GPG keys being used to do SSH authentication, but I haven't read or found a way to make it work. There are also a couple of unanswered question concerning [gpg] and [ssh] interaction:

Are GPG and SSH keys interchangable?

How to use gpg and SSH together?

A part this, I cannot found other uses for the "authentication" subkeys.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

OpenPGP keys can be used for authentication in various protocols:

  • SSH, as bare ssh-rsa keys (monkeysphere subkey-to-ssh-agent, or smartcards)

  • SSH, as pgp-sign-rsa certificates (no implementations known to me)

  • TLS according to RFC 5081 (supported by GnuTLS)

  • of course, less well-known protocols and software such as gpgauth.org, Enigform, and such; they do find the "authentication" flag suitable.

share|improve this answer
    
Yes "Using OpenPGP Keys for Transport Layer Security (TLS) Authentication" is an interesting draft. But a part from that it seems that the authentication facility was added as a "bonus", but relies completely to third parties implementations. I will wait for some time to collect other answers before accepting your good one. Thanks –  Claudio Floreani Feb 17 '12 at 17:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.