Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

GnuPG subkeys can be flagged with three kind of capabilities: Sign, Encrypt and Authenticate.

While the first two actions are widely used and documented, the authenticate action is somehow mysterious. You can make such key only using editing a primary key with the --expert option:

$ gpg --expert --edit-key 889C36B7
gpg (GnuPG/MacGPG2) 2.0.17; Copyright (C) 2011 Free Software Foundation, Inc.
gpg> addkey    
Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Sign Encrypt 
   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

There are rumors about GPG keys being used to do SSH authentication, but I haven't read or found a way to make it work. There are also a couple of unanswered question concerning [gpg] and [ssh] interaction:

Are GPG and SSH keys interchangable?

How to use gpg and SSH together?

A part this, I cannot found other uses for the "authentication" subkeys.

share|improve this question
up vote 3 down vote accepted

OpenPGP keys can be used for authentication in various protocols:

  • SSH, as bare ssh-rsa keys (monkeysphere subkey-to-ssh-agent, or smartcards)

  • SSH, as pgp-sign-rsa certificates (no implementations known to me)

  • TLS according to RFC 5081 (supported by GnuTLS)

  • of course, less well-known protocols and software such as, Enigform, and such; they do find the "authentication" flag suitable.

share|improve this answer
Yes "Using OpenPGP Keys for Transport Layer Security (TLS) Authentication" is an interesting draft. But a part from that it seems that the authentication facility was added as a "bonus", but relies completely to third parties implementations. I will wait for some time to collect other answers before accepting your good one. Thanks – Claudio Floreani Feb 17 '12 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .