Sign arbitrary data with your SSH keys
agwa.name
agwa.name
>* It's not PGP.
The most important reason people use the OpenPGP message format is because it is a well accepted standard. Sure the cryptography is not new and fun but it is secure. If you sign something with OpenPGP then you can be sure that those signatures are verifiable on any platform by anyone. The OpenPGP standard has provisions to ensure that the signatures are from a particular entity. This proposal suggests that Github could be treated as a trusted third party. If that is the case then you don't need signatures at all.
Obligatory "The PGP Problem" rebuttal:
No, it does not - it has provisions to ensure that the signatures are from a particular private key. Mapping that to a human-meaningful entity is beyond the scope of the OpenPGP specification.
The article you link does not really address that point, and it doesn't at all substantiate the claim that using GitHub as a trusted third party means you "don't need signatures at all".
(Also, the original post says that other means like key transparency can be used instead of trusting GitHub.)
In turn, the subject information in these keys does not matter - either the signing key is trusted, or it's not. There's an ongoing philosophical debate among users of the web of trust about what the subject (name and email) means. Should you sign a key if you see a passport Are you attesting to legal names? If someone works via a pseudonym, how (if at all) should you sign their key? How do you validate the passport? Maybe you should only sign keys for people you actually know, and attest to knowing their identity in a human sense and not to them having legal documents? What about the email field - do you need to verify that they possess the email? How?
The OpenPGP spec includes just enough functionality to encode trust into local keys (and specifies that it should not be exported), but it does not say anything about a web of trust: https://datatracker.ietf.org/doc/html/rfc4880#section-5.2.3....
At any rate: this comment thread is about signing with SSH keys, not your idiosyncratic response to my blog post.
I don't think PGP is that bad either. It's pretty standard asymmetric crypto. The implementations and especially the key sharing leaves a lot to be desired but for personal use I like it. And I love that there's lots of hardware key support. This is why I use it.
I personally use my hardware OpenPGP keys also for SSH, on yubikeys and OpenPGP smartcards. I also use those for encrypting and signing data. So I'm already doing something similar to start you're saying, just the other way around.
Having my keys on a hardware token is a must-have for me and I wonder if that's possible with your method. I also prefer having a token that requires a hardware input for each use like the Yubikeys can. You can set them up to require a touch for every signature or authentication. This stops a compromised server you log in to from milking your SSH agent.
But how would I store the keys in hardware if not PGP? I tried PKCS11 modules with different cards before but the software chain with middleware is pretty terrible. PGP's is pretty sane (gpg --card-edit is much more user friendly than what was offered by the other more expensive cards I used!)
And I don't like Fido2 either for this because it can't be used for content encryption/signing (which is what your blog post about)
So, I'm pretty open to doing what you're doing but my requirement for hardware key storage makes it pretty hard I think.
It would be nice to hear your thoughts on this, how this could work with hardware-backed keys.
> The key used for signing is specified using the -f option and may refer to either a private key, or a public key with the private half available via ssh-agent(1).
You can use age's AEAD encryption with Yubikeys. Yubikeys can do ECDHE in PIV mode.
I wrote https://github.com/tv42/yubage as a subprocess plugin to https://github.com/str4d/rage (and hopefully https://github.com/FiloSottile/age once they think plugins are stable in enough to go in the reference implementation). The rage author also wrote their https://github.com/str4d/age-plugin-yubikey
BTW, when used in a normal way, an offline capable, stateless system as embodied in the OpenPGP message standard uses signatures to provide integrity protection[2]. Which might bring us a bit closer to the matter at hand I suppose.
Hopefully that's a false dichotomy and the entire Free Software community doesn't end up reliant on Microsoft to host all our keys for us. The article goes on to mention key transparency, though, which does seem like the right solution.
I note that rekor (the transparency log implementation used by sigstore) already supports signing with SSH keys[0], so this TechRepublic article about it[1] from March (which lists only "GPG, x509 and Minisign") is already out of date.
[0] https://github.com/sigstore/rekor/blob/main/types.md#ssh
[1] https://www.techrepublic.com/article/a-new-linux-foundation-...
And really... > relying on a trusted third party ... like GitHub seems like a way better default than PGP's Web of Trust
Made me scream: "What??" I'd personally prefer some decentralized torrent-like way of user key distribution.
Having an append-only store is not the hard part of the problem and there are much better solutions than blockchains for that.
In NIST speak, you can get a level 2 assurance level (good for most commerce) by collecting two strong identifiers or verifying one.
Case in point - pgp supports exactly that - you can have keys, which can have attributes which are endorsed by your key. We've had this since the 90's. It didn't solve the problem back then, reinventing the same thing but worse using blockchains won't solve the problem now.
Just look at how many scam attacks have been made possible just on urls.
https://www.go350.com/posts/age-file-encryption/#age-pki-iss...
Honestly it kind of reminds me of the problem of defining "Truth" (in a philosophical sense)
All options are sucky in their own way.
Nothing can really replace out-of-band in-person verification because human perception is remarkably difficult to spoof against or MITM. Comparing keys found in two bands, e.g. DNSSEC records and WKD (using TLS verified by the wpki system), is close enough for most threat models: you'd have to compromise DNSSEC and a CA to break that system.
Now sure, depending on your needs, you might be able to get mild improvements by chosing a different set of trusted parties than the webpki's CAs, but i'm not sure its really that different at the end of the day.
MTA-STS depends on webpki and the CA system.
Since not everything leverages DNSSEC yet and it's tricky to implement I'd supplement records with something resembling WKD so you have two bands.
Another possibility is having clients fetch keys over both clearnet and an overlay network (e.g. Tor); this doesn't help if the web server is being MitM'd but at least you have to trust client endpoints a bit less.
I trust Google and Mozilla more than I trust the world governments that control the DNS hierarchy, and I see the actual transparency mechanisms, like CT, that the WebPKI watchdogs have built; unlike with DNSSEC, they aren't simply a theoretical thing that could be built in the future, but rather operate today and have been responsible for numerous detections of misissuance.
Control of Chrome or Google itself is a radically different matter. And with the CA system, there are a 140 other trust points to be attacked.
What is weaker will depend on your perspective and threat model, but if the measure is how easy it would be for the government to create an arbitrary fraudulent SSL certificate, it is objectively much easier than creating an arbitrary fraudulent DNSSEC record.
Even if the argument is, and I do not think that it is, that domain validated TLS certificates for the .com top domain are the only CA signatures worth considering, it is important to note that it is comparably more straightforward for the government department in question to seize those domain names if needed.
A domain registry PKI where domain ownership is cryptograhically asserted can never be less secure than the heterogenous global CA directory we have today, in any possible sense, not for domain validated certificates.
(I don't find Mozilla or Google to be especially trustworthy, of course; I simply have absolutely no faith in the reverence government agencies have for the sanctity of the DNS. Something about the way they publicly brag about manipulating it probably has a lot to do with it.)
I think the idea that we should vest more Internet trust into the DNS, the one bit of core Internet infrastructure governments have demonstrated any kind of deftness at manipulating, seems, respectfully, pretty nutty.
Unfortunately the development seems to have ceased after zoom acquired them.
From what I understand, it gives you nothing for anything that is signed and that does not have a direct link to a github account. Obviously, if someone releases software on that github account and I find a signed release of that software, I can validate that it really was signed by the official source of that software on github. For anything that does not have that direct link, it really does not give you anything.
I've never used PGP, but I thought the web of trust was used to validate metadata on the key and that this can be used to validate that a key really belongs to the person that you think it belongs to. I saw it more like how you have SSL certificates with different degrees of validation and where you must deliver more proof of your identity if you want to receive a certification with a higher degree of validation.
I'm all for using SSH keys for signing, but I still would like to have something like PGP's web of trust for those keys.
As an alternative keybase.io worked well. If you knew the person controlling the github account also controlled the mastodon/twitter where you talked to them, and the website/blog, etc, then you can be pretty sure it's them. (I saw mention of more open systems here too https://news.ycombinator.com/item?id=29132024).
> I'm all for using SSH keys for signing, but I still would like to have something like PGP's web of trust for those keys.
same here. I use my gpg key for ssh (stored on a yubikey). Seems like a better option to me.
if you do need to link a key to an actual non-digital person, then you've got a whole different set of problems.
When you think about it, SSH keys are used as identifiers (just like PGP keys) so there's no reason not to use them as such. But as you pointed out, SSH doesn't have a WoT yet so we rely on trusted 3rd parties to discover keys (so far).
Meanwhile, I've been to multiple PGP key-signing parties and organized one or two myself, and the quality of the link is always very low. At one Ubuntu Developer Summit (a community that heavily relies on the Web of Trust), the person organizing the party wanted us to verify short key IDs. I refused, and set up my own list of full fingerprints that I distributed to participants, and earned the ire of the organizer. At one DebConf (another community that heavily relies on the Web of Trust), I saw at least one driver's license from another country that was of such quality that it could be easily reproduced by any fake ID shop for college kids. There may have been features on it to verify its authenticity; I certainly did not what I should be looking for, and I doubt others did. I don't remember if I signed the key in the end. I think I did. I expect others did.
So, if you find a signature on the Web of Trust for my key, what does that give you? What confidence do you have that the person signing it actually verified it was me?
"Encrypting to a GitHub user
Combining SSH key support and -R, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age"
I also like distributing public keys via DNS TXT records and have written about that some here:
https://www.go350.com/posts/age-file-encryption/#age-pki-iss...
https://docs.github.com/en/authentication?query=public+key+u...
[1]https://news.ycombinator.com/item?id=10004678 [2]https://github.com/FiloSottile/whoami.filippo.io
Public keys should be distributed in a trustworthy way.
http://manpages.ubuntu.com/manpages/bionic/man1/ssh-import-i...
Keybase (or similar) would ideally be used for this instead, but they chose to go a very weird route for their tool, and are now disappearing completely eventually probably.
This isn't possible with the "oh I synced your public keys from GitHub" pattern. The user might revoke a key later (we all rotate our keys every six months, right?), and remove it from GitHub but it can still be used to access your service.
Maybe this is OK if you sync from GitHub on every access request (or cache for a short period), using it as a poor man's OAuth, but that's not what GP was proposing.
https://gist.github.com/sivel/c68f601137ef9063efd7 - uses AuthorizedKeysCommand to make a remote server the authoritative source of your SSH keys, so (if you wanted to) you could make GitHub your key provider.
https://github.com/ierror/ssh-permit-a38 - 3 years old but that's not necessarily an issue
There's never a practical scenario where you'd just revoke one service-client key-pair while the other service-client key-pairs are totally safe. Imagine your GitHub-specific private key was compromised somehow - a private key that has never left your laptop that also stores private keys for all your other services - do you think it's safe to only revoke your GitHub-specific key?
You might need to go into your new service (possibly through another factor like physical access or web admin) and manually revoke compromised keys.
I just don't think any of this is a reason to have a separate key for each service you use, that still seems rather unnecessary.
It would be better to use a hardware authenticator like a Yubikey to either generate a FIDO token-backed SSH key or a GPG key and use the gpg agent as your ssh agent. This way you get SSH keys that cannot reasonably be compromised by other means than physical attacks (someone steals your key and coerces you to reveal pin code).
If your private keys are stored on your local machine, chances are if one is compromised, all are compromised.
* Using a strong passphrase on your private key(s) * Never copying your private keys around between systems (especially not unencrypted) * Using a hardware key management dongle
...then there is little to no _security_ risk in using one key for multiple services vs individual keys for each service. The threat model here is that an attacker is able to discover your private keys somehow. If the system holding the private key(s) is compromised, they can grab multiple keys just as easily as they can grab one.
Others have noted that there can be a slight _privacy_ risk to sharing your SSH public key across services. If you never want your accounts across different services to be correlated with each other, then yes, you would want a separate SSH keypair for each. But many of us use the same identity across services anyway as part of our personal brand so that point is moot for us.
I am talking about using the same key pair for two different things. E.g. GitHub and GitLab
You'd need several prerequisites for that to actually increase security, i.e. not using an ssh-agent (required password for every key prompt) and encrypting them at rest
Otherwise you'll leak all your keys as soon as any attack vector is utilized such as hostile host siphoning from the ssh-agent forwarding or filesystem access.
there is no security benefit from revoking individual keys unless they've been compromised - however, the likelihood of only leaking a single key is extremely unlikely.
There are very few attack vectors how you can compromise a private/public key pair and they all basically boil down to local access. This is not a PreSharedKey situation like a password, where both parties effectively share a single string for authentication. The private key never leaves the authenticating machine, as you're only sending a signature over which will be validated against the public key. So, how are you going to compromise a single key that splitting them increases your security?
you're either completely compromised and somebody has filesystem access or you've forwarded your SSH-Agent to a compromised host. When its the former, you'll have to have the private-key encrypted so they're unable to use them (encrypted at rest) and when its the later, you cannot have your keys added to the agent, making the forwarding redundant in the first place.
Generally you need to have one key per host that you use (or per any storage location). You can use separate keys for separate services is if you for eg. privacy reasons don't want to associate the same identity with both services, but that's a personal choice, not something that improves security.
I use the same gpg key for talking to anyone, so why wouldn't I do the same with my ssh key? I suppose I could try to build a workflow around host-specific keys somehow derived from my auth key… but I'd need some reason to do so.
In order to compromise your private key the attacker would have to gain access to your local machine, in which case all of your private keys are compromised.
You should use different key pairs per client, so that if one client machine is compromised you don’t have to change keys on the rest of them.
users:
- name: foo
ssh_authorized_keys: [gh:foo]Doesn't doing this mean you trust github implicitly?
Curious why you think it would be a bad idea to trust Github/Gitlab to warrant your identity.
The only way github could be used as key distribution for this purpose would be if individuals take (and keep) a copy of every public key they are interested for future verification in-case an attacker changes it. But then I guess any public key distribution system has this problem??
So if the repo has that file, and as long as you don't allow history rewrite when pulling (disabled by default), you can be pretty confident all commits have been signed only by authorized keys from the point you checked out initially.
About bootstrapping, several strategies are possible:
- [crev](https://github.com/crev-dev/cargo-crev) is an alternative (not PGP/SSH based) web of trust for vetting code
- [radicle](https://radicle.xyz/) is a p2p forge to do away entirely with web-based centralized forges (like github)
- we could imagine a sort of public-key-addressed DHT where a forge (such a Github) advertises the public keys of its members, for example based on IPNS (although a history-preserving system would be better)
- of course source-based distros like NixOS and GNU/guix are also a very good answer about bootstrapping trust in the code you run ; guix in particular does intensive research and development about bootstrappability and reproducibility [1] which you can read about on their blog [2]
Shameless plug: i wrote an article earlier this year about some of the challenges surrounding decentralized forging: https://staticadventures.netlib.re/blog/decentralized-forge/
[0] https://guix.gnu.org/en/blog/2020/securing-updates/
[1] I'm personally really amazed and slightly disappointed by both: they're really cool on paper, but although guix has a much better CLI UX than nix (and in my opinion Guile Scheme is much easier than nix programming language), both have very cryptic errors
> Since .guix-authorizations is a regular file under version control, granting or revoking commit authorization does not require special support. In the example above, commit B is an authorized commit by Alice that adds Bob’s key to .guix-authorizations. Revocation is similar: any authorized committer can remove entries from .guix-authorizations. Key rotation can be handled similarly: a committer can remove their former key and add their new key in a single commit, signed by the former key.
I'm unaware of the implementation details, such as whether git will validate sigs for a PGP key which has been revoked. That's a fair question, although for this usecase i can't imagine how it would be useful to deny signatures from the entire project's history because a key has been revoked.
From your quote around "public", I presume you think there is some sense in which they're not really public? They are and should ALWAYS be considered PUBLIC. If you find yourself ever crafting a security solution where public keys somehow need to be private or secret, go back to the drawing board or reach out to someone with serious expertise.
There are cases where information on a certificate (which is associated with a public key)may indeed need to be protected, in that case you need to implement an information mask (via hashing) that can protect the private information, we had to do something similar with Certisfy.com certificates. But public keys should be considered public without exceptions.
I know you’re taking the “strict teacher” approach with your comment, but you’re totally wrong. And the reason you’re wrong is, security doesn’t equal privacy. But for the “average person,” security does equal privacy, or should, so they find systems that could potentially expose their identity to be “insecure.”
In this particular case, there have been past examples of using keys to fingerprint users without their consent. Yes, it’s been super edge-case and proof-of-concept, but for a lot of people — and perhaps more importantly, in a lot of jurisdictions — leaving a personal identifier sitting around like this (without ever informing the user!) is the very opposite of a best practice.
The end result is, you should only have a key on GitHub that isn’t used anywhere else. That’s what I do, and I’m sure lots of us on this comment thread do, but there’s definitely lots of My First Coding Bootcamp people who were guided through their GitHub account installations who might not have been aware that these are keys that shouldn’t be reused elsewhere.
I would have a very different view on this if GitHub had been explicit about the use of registered keys for other services. That’s a GREAT concept, but I’m not going to trust a company with that business when they’ve just backdoored themselves into it without asking for permission. And the problem for them is, in this particular situation you need the weird paranoid privacy crowd on your side for it to work.
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCalPlcbQUWX5caNedbKuWxAOUG+wFU2jtPUXmAcUDTIUgNz9JeW7cOAH1FPAcouIBM/0e48hdswSB2XHR0yHj3HvGx2KfB1lsd+FxXRR+dGPzO3WiMHXHdKogmHilk9U1ztwEFoZAkXuxvykv+Sn16j/xHXgFHdx5IDl/jyT5/IEIZHiePQqPYgptea/kXDiQGClMcT5V1bczCQH5tIcXdSKHhXn3oV1IAd79FpznmeCMALsyS4MUeU7uSx32PknIpgev64aMFgZItJUanqaeABuc9mcGNgHLBhBdO+gCOwBnwd+7boKmRawvMnEwsoznN9elr4FeBB81mBRnc6Q53 numairssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCssSd91viJEmUQNx28L6JifYcGwTNEkLnmvZvdNxWxdTCrKwPEBVdlLooN90QugL/mJVwcWj9qsnOLbcoVaJlqMppY8UYlHP6OnGwKRGkpPdbKHnBA+Rrg7r8GUwdLW/PvI8DWhEPXzzWvrCNiESJWVdSCT2bTfAA3CQuPnL9cr5hcpw0i1jf7PBXRiVw2E2133KhEr91xNMH/jXh4jrly3J+kmBEmJcrkHNrHj0O8Ml+PmVQknq+tYT1DivnE2dxHoMkfdP0xP9yV9s0+7/JhU+tnXJ2+kaIOSpOOmhBPyjNYO6wkNvQh3aYzKrtcoOWPO2y56sfw9Uqlbpyr1ZU1 Gargyle
Your SSH public key is really the least of your identifiable information you’d be worried about because that’s the easiest to create a unique key for GitHub.
Just because the functional security of a system isn't dependent on the exposure of a public component doesn't mean it should implicitly be shared.
Some platforms don’t publish users lists but it’s often the same platforms that like to post headline figures about their user base so I suspect not publishing user lists is more about a company being able to exaggerate its worth rather than privacy. Especially when those same platforms readily publish user names in every format aside one consolidated list.
In short, if a piece of information isn’t available on a social platform, or is frowned upon scraping, then odds are it’s more likely financially motivated than it is down to privacy. Given these same companies typically make their money from you handing over your data in the first place it would be naive to think they really care about your privacy.
Edit If course you mean the new signing feature which will come to git and GitHub in the future. Sorry
https://therecord.media/security-agencies-leak-sensitive-dat...
If you agree that said platforms leak lots of other identifiable data (which you seam to) then thus it is a fair statement to say GitHub hiding public keys do little to enhance your privacy. And thus one can reasonably conclude that privacy argument doesn’t really hold with regards to SSH keys.
I’m happy to agree that it’s bad UX and probably should be advertised better so people are aware they should follow the (in my opinion best practice) of using a unique SSH key for GitHub.
The whole intention was to raise attention to a less often mentioned part of the information github exposes about accounts.
Nonsense. Would you say the same thing about a password? Would you make the same comment about a conversation over a messaging service? This is a configuration detail of an account setting -- not a blog post.
Privacy is not binary; there are many shades of grey. It is surprising that this is made public and while it is not necessarily wrong to provide this service (I'm fine with it; I see the utility) it is also reasonable to ask for a way to opt out.
Passwords are secrets. Public keys are not. So the comparison doesn’t work.
> Would you make the same comment about a conversation over a messaging service?
If it was a public messaging service like HN, or public comments on Twitter or Facebook, then yes.
> This is a configuration detail of an account setting -- not a blog post.
We could be here all day and night saying what this is or isn’t but it doesn’t address the point I was making. The moment you create a GitHub account you start leaking far more sensitive data than your public keys. Data that is far harder to create anonymously (unlike your SSH keys). Thus if privacy is a concern then you shouldn’t be using GitHub in the first place. Even git version control itself leaks information about you.
> Privacy is not binary; there are many shades of grey.
Ironic you state that when you’re the one applying privacy in a binary way. I’m saying the SSH public keys are a lower risk than other details you share in GitHub. Not that it’s a zero or 100% bad thing, which is the only pidgin holes you’re allowing for this discussion.
> It is surprising that this is made public and while it is not necessarily wrong to provide this service (I'm fine with it; I see the utility) it is also reasonable to ask for a way to opt out.
That’s literally the point I’ve been making.
The parents quote I think is illustrative
> But for the “average person,” security does equal privacy, or should, so they find systems that could potentially expose their identity to be “insecure.”
And I’m not trying to pile on here, because I sympathize with that sentiment of “should”. But I think the two issues that make that never a real possibility are 1) privacy is actually a harder problem to solve than security and 2) companies aren’t incentivized to provide privacy.
Anything you provide online should by default be assumed to end up public, and as much as we might not want that, we all really need to assume that.
These are not binary attributes. A public key absolutely can be a secret, and in many cases should be.
> If it was a public messaging service like HN, or public comments on Twitter or Facebook, then yes.
You're avoiding the question because in this case it isn't a "public messaging service." It's an attribute of an account configuration.
> Thus if privacy is a concern then you shouldn’t be using GitHub in the first place.
Nonsense. What if I use a private email for my github account? What if I only use private repositories?
You're repeatedly making an error of portraying privacy as black and white and it simply is not.
> I’m saying the SSH public keys are a lower risk than other details you share in GitHub.
No, you made a categorical, absolute statement that "If you need privacy then you shouldn’t be uploading to GitHub in the first place."
This statement is utter nonsense. Now you're just arguing that you didn't say what you actually said.
> That’s literally the point I’ve been making.
No, your statement that we're discussing was "If you need privacy then you shouldn’t be uploading to GitHub in the first place."
This statement is flatly incorrect. Your comments are demonstrably false, and your followups are irrelevant deflections.
I answered your question despite it being a straw man argument.
> No, you made a categorical, absolute statement that "If you need privacy then you shouldn’t be uploading to GitHub in the first place." This statement is utter nonsense.
Thus far all the arguments you’ve made have been either unsubstantiated or straw man.
Take the quote above, you argue it’s nonsense but offer zero evidence to back up that remark.
> Now you're just arguing that you didn't say what you actually said.
You’re changing the subject again instead of providing a counter argument. I’ve made my points clear, with examples as to why I’ve came to that conclusion, and there’s history of our chat in this forum.
This is clear an emotive topic for you but if you want to prove me wrong then please at least stick to the subject.
You didn't, and I think that's all that needs to be said. There's no need to address the rest of your comment. I don't care to engage in whatever it is you're doing.
http://www.paulgraham.com/disagree.html
Thus far we’ve seen DH2, DH3 and DH4 but you haven’t yet refuted my central argument (nor even anything close to it) despite posting a multitude of emotionally charged paragraphs.
Now take a look at the discussions I’ve had with others in this thread. They’ve been on topic and informative. Unlike the responses from yourself.
I’m genuinely open to discussion, if you’re genuinely interested in having one.
Take another look at your own responses, vis a vis that article. You and I are done here.
Pity you couldn’t be bothered to hold a proper discussion here because some of your other posts in other threads have been informative. C’est la vie
So your argument against SSH keys are just as valid for all the other items of meta data you’re dismissing as not a privacy problem.
And that’s the point I’m making. If you care enough about privacy that your public SSH key is an issue, then creating a GitHub account is not the brightest idea regardless of their policy on public SSH keys.
I don’t disagree that GitHub could do a better job documenting this risk nor that an ideal scenario would be giving users the option. But they’re all just side stepping the real issue that this is not a privacy because of the fact that public SSH keys are not more of a risk than any of the other data you’re already volunteering to be published by virtue of signing up to a social platform.
If you want privacy then host your own git server (it’s really easy!) because GitHub is designed around sharing, not privacy.
It’s weird the number of people here who don’t realise that convenience and privacy are often opposing forces and I bet the majority complaining don’t even pay for their GitHub account. Yet they are still complaining about specific aspects of privacy while willingly handing over a crap load more identifiable information for free. The whole debate here screams of security theatre: privacy for show rather than actual safeguarding of personally identifiable data.
> If you need privacy then you shouldn’t be uploading to GitHub in the first place. The moment you do that you’re publishing email addresses, other projects that you contribute too and potentially leaking your timezone by virtue of commit times.
You are wrong. GitHub doesn't have to leak anything, apart from your public SSH key.
Also, plenty of people collaborate in private on GitHub. It has free private collaboration these days, not to mention.. paid. While it never strongly irked me that SSH public keys are visible, it’s not really that obvious. And I don’t buy the “but it has public in the name!” bit either. Sure, it’s not made to be confidential, but that doesn’t mean it should be published indiscriminately. I mean, I’m using it to authenticate to GitHub, and nobody browsing GitHub needs it.
Having them visible by default can be convenient. I’ve used it to populate authorized_hosts for example. However it is unnecessary and unexpected. If you use different private keys on each machine, it reveals a lot of opsec info you may not have expected to be public.
It’s a “public” key in the cryptographic sense, not in the address book sense.
I disagree. The article points to simplifications that SSH did compared to GPG, like no web of trust.
But there's now something very close to one, a bit hidden though: SSHFP + DNSSEC
I think a lot of people here may not be familiar with SSHFP records, so check https://fanf.livejournal.com/130577.html for a more detailed explanation.
It's more or less a work around the problem of initially trusting a key, by using SSHFP records to verify that the server keys are validated by the domain, with DNSSEC validating the whole thing.
When you can match server keys to domains and user keys to github users, you are just one link away from having a global picture of the web of trust.
EDIT: and I wonder how feasible it would be to do just that with a sniff of the initial handshake
> because that’s the easiest to create a unique key for GitHub
And how many people do you think have done that, instead of uploading the keys of the servers/laptops/etc. they use?
I hate to say this, but Bitcoin did it right: by having a discardable private+public pair of keys derived from a seed key, it prevents leaks of information by correlation based on the public key.
Equally they might use the same user name as on other services, thus making them traceable.
Ultimately if you care about privacy then it’s up to you, the individual, not to share that information or to provide anonymous information yourself.
Sharing identifiable information and then blaming the company you shared it with is like blaming the horse for bolting after you’ve intentionally left the barn door open. Sure it should be that way but ultimately it’s your own responsibility to keep your stuff safe.
I’d agree with your point more if you were advocating that documentation should be more explicit. Ie helping educate users into making smarter choices.
The setup process looks a bit crazy, so I’m hoping it’s gotten easier since 2014? I would love to test it out, but life is too short for the process they’ve outlined...
You are correct.
> The setup process looks a bit crazy, so I’m hoping it’s gotten easier since 2014?
I don't think I used that in uni, so I can't tell you how complicated it was. It's just a nice didactic article that I found explained all the details.
In practice in 2021, you run a sshfp script on the server, and publish the output of the script on your DNS by adding a key.
If you use scripted DNS, it's a one step process, if not, a 2 step process.
Related, VPN users can easily be fingerprinted if they are assigned unique certificates for each account.
Its a big privacy leak, not a big security leak.
Your Pubkey can be used to cross-match multiple identities. Example: You have different coding personae. One that is activist, one that is company-peon. Different accounts, same SSH pubkey in Github or other server with publicly listed pubkeys --> Same person confirmed.
As a result of this the information can be used to target each of the identities in a more precise manner. On the human layer of the security side: New phishing/deception/blackmail vectors.
On the organizational layer: we have to target these keybearer devices now.
Maybe it even helps in a cryptanalytic way in some weird exotic scenario but not substantially.
And of course separation of concerns if you have different keybearer devices.
(Also the famous Keysticks are a nice solution to that organizationally but they are an additional risk for big scale attacks by having biased RNGs. In the end its hardware and audits are just a voluntary thing by corps. They can always choose to hide things from auditors or do a compromised batch at their mercy.)
How to practically manage this, with git in particular.
i see that the docs are missing info on ssh there still. i will update this since with 2.34 you can also specify a ssh publik key literally in this variable or point it to a file with it.
Doesn’t GitHub only allow a key to be associated with a single account? After all, they use it to authenticate SSH pushes.
The privacy worry here is a little more esoteric —- your SSH public key could be used to cross match your GitHub user account with an account on a different system.
I shouldn’t have phrased my comment as a question: a former employer required that I use different GH accounts for different purposes, and it was a hassle to get local repositories to use the correct keypair. I recall being annoyed at GH at the time, but since your SSH key is used as an authentication mechanism on SSH pushes, they really can’t let a keypair be associated with multiple accounts.
I agree. The way that I deal with this is as follows:
In my ~/.ssh/config I have content that looks like:
Host gh-company-a
User git
HostName github.com
IdentityFile ~/.ssh/id_ed25519_company_a
Host gh-acme-inc
User git
HostName github.com
IdentityFile ~/.ssh/id_ed25519_acme_inc
Host gh-sponges-corp
User git
HostName github.com
IdentityFile ~/.ssh/id_ed25519_sponges_corp
git clone git@github.com:companya/foo.git
git clone gh-company-a:companya/foo.git
git clone git@github.com:acmeinc/baz.git
git clone gh-acme-com:acmeinc/baz.git
With this way of doing it, the correct key pair gets used both for the initial clone and for subsequent pulls and pushes.
I suppose I could make a wrapper program that would take care of the substitution for me, to further reduce the amount of hassle. In fact I might end up doing that. I already have a few wrapper programs for various git commands.
IdentitiesOnly yes
Otherwise all your public keys will be tried regardless.
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_ed25519_company_a -o IdentitiesOnly=yes" git clone ...
git config core.sshCommand "ssh -i ~/.ssh/id_ed25519_company_a -o IdentitiesOnly=yes"Your answer actually stumbled into the reason why so-called "public" keys may not want to be published. There are 2 different objectives:
- public key as part of a encryption pair : publishing this is no big deal as it shouldn't compromise SHA256 private key for decryption. So "security by obscurity" isn't necessary.
- public key as an identity for metadata/tracing : some may not want public keys to be known for correlation ... e.g. That's why Bitcoin wallet software generates new public+private keys for each transaction even though exposing a public key doesn't compromise ECDSA encryption.
To say it another way. Private means, only I know it. And public just means anything but private. With varying degrees of how public something might be.
Funnily enough that's very different from what ordinary people think private and public is.
Private is everything they didn't explicitly intended to be visible to all the people on the internet and public is only that.
Here's my ed key though.
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3sRdLQYzhroFcUsId9X2xS1Um9bP0E+FiuiO5/qF5W oehpr
While some may be fine having public keys dissiminated publicly, other github users would prefer keeping this data private, as it can be used for looking up their real identities.
For example, to access secure areas of my network, you need to access the management plane first, with a separately managed system. Look at how GCP manages ssh keys for web consoles as another example.
From the privacy perspective, they are PII. You should not publish them or link them to any information.
"Public" is a very overloaded word.
On paper it sounds pretty cool, i would dare say the only interesting application for DID i've heard so far :)
The private key part is secret of course, never shared (that's where the analogy above breaks) but the public part is fine and desirable for everyone to have access to - that's how they verify that you signed something with your private key, how they encrypt a secret message to you.
I say this regardless of whether public keys are being.. publicised. User database could be leaked, say, or public keys visible to employees/logged. OpenSSH literally refers to them as 'identities' - if you're trying to be anonymous/anon w.r.t. another it goes without saying that you need to not use the same identity!
By default, the ssh client will try to each of your public keys to connect to any given server, which naughty servers can effectively use to enumerate your identities.
Services like Github really shouldn't publish these keys without consent. One could argue they're really PII and subject to privacy laws ..
New versions of Ubuntu Server will actually let you import keys from GitHub during setup. Really handy, although obviously not something for highly secure environments.
It's pretty great.
I forgot where I learnt about it; I think I was inquiring how NameCoin was able to gift their cryptocurrency to GitHub developers with more than 50 followers.
[0] https://github.com/FiloSottile/age
[1] https://github.com/FiloSottile/age#encrypting-to-a-github-us...
Please note that these come with their own pitfalls and precautions you'll need to take to ensure your key's safety!
If you consider agent forwarding i'd recommend use of "ssh-add -c" to have your agent at least confirm every use of your private key. Generally for private key security i'd always use a hardware token. Modern yubikeys are really easy to use and you can even enable touch policy instead of the agent confirmation. The UX for this is still a bit lacking in the tooling though.
PGP public keys you can also just copy around? Nobody is forcing you to use the web of trust with PGP either, if you don't want it. But if you do use keys extensively, it actually helps you: if your boss already verified a customer key, you don't have to re-do the work and meet up in person or ask your boss to send it over before you can use it. Now extend that to a whole network of colleagues, where you configure per-colleague whether you think they properly verify other people's keys, and this whole key distribution problem becomes a lot easier without having to rely on third parties (CA system like with https).
Just a small note, this obviously doesn't invalidate the rest of the article!
Maybe you have backup signing keys or whatever secret project encryption keys - and you would prefer for privacy and obscurity that the "public" halves are not distributed on keyservers.
In this sense, I think GPG continues the culture of a more naive and smaller internet by thinking that most keys want to have their public part online.
I can't speak about others, but for myself I use a single gpg key across all my machines, but I use one ssh key for each of my machine. When I replace a machine with a new one, I don't move/transfer that key to the new machine, I just generate a new key on the new machine and revoke my old key everywhere. To me a ssh key does not map to me, it maps to me and a machine combination. If I use an ssh key to sign something then after a few years I replaced that machine, that key is no longer used anywhere, and the verification can start to become tricky (I'll certainly remove it from my github, which invalidates the key distribution way proposed by the article).
I also always use name@machine to name/annotate my ssh keys, but github's name.keys strip that info (for good reasons).
So this is probably good for short lived signing needs, but for something that needs to be verified long into the future (git commits/tags), I don't think this is a good idea?
(*) Hiding signing behind a command that's called keygen is not the interface we deserve.
I have seen both and using one key pair looks very convenient but also makes me feel a little uneasy.
I myself have a key pair for each of my machines.
How do you handle it?
In each alias you put the appropriate "-i private_key_for_that_server", the server name and also "-l user_name" if you have a different user there and "-p port" if the server uses a non-standard port.
Thus, after the initial key setup, connecting to any server with different credentials is no more complex than when using a single key pair.
Except for an extra keygen step, the initial setup is not more complex than when using a single key pair, as you have to copy the public keys anyway, which is the more difficult part of the setup.
If you frequently move between workstations, maybe look into the new hardware key features (Circ’s version 8.3). If you have multiple users that all connect to the same account, a SSH CA (circa version 7.4) would permit new access without needing to constantly modify server-side authorized_keys.
https://www.linuxjournal.com/content/flat-file-encryption-op...
You will have to generate an openssl-compatible public key:
openssl rsa -in ~/.ssh/id_rsa -pubout -out ~/.ssh/id_rsa.pub.openssl
openssl dgst -sha256 -sign ~/.ssh/id_rsa -out known_hosts.sha256 known_hosts
openssl dgst -sha256 -verify ~/.ssh/id_rsa.pub.openssl -signature known_hosts.sha256 known_hosts
$ cat rsign
#!/bin/sh
set -eu # http://redsymbol.net/articles/unofficial-bash-strict-mode/
case "$(basename "$0")" in
rsign)
for n
do openssl dgst -sha256 -sign ~/.ssh/id_rsa -out "$n".sha256 "$n"
done ;;
rchek)
for n
do printf "$n "
openssl dgst -sha256 -verify ~/.ssh/id_rsa.pub.openssl \
-signature "${n}.sha256" "$n"
done ;;
esac
$ cp /etc/passwd /etc/group /etc/hosts .
$ ./rsign passwd group hosts
$ ls -l *.sha256
-rw-r--r-- 1 luser lgroup 256 Nov 12 13:21 group.sha256
-rw-r--r-- 1 luser lgroup 256 Nov 12 13:21 hosts.sha256
-rw-r--r-- 1 luser lgroup 256 Nov 12 13:21 passwd.sha256
$ ln rsign rchek
$ ./rchek passwd group hosts
passwd Verified OK
group Verified OK
hosts Verified OKIt doesn't take long to generate an RSA key, though. A dedicated signing key would seem to be the obvious thing to do.
PGP ironically, got this right... and has a nice solution for this, where you can have multiple authentication subkeys tied to a single identity, each individually revokable, plus with key transparency when on is added/removed.
In the case of SSH, if a key is lost or compromised, no big deal: create a new set of keys and distribute the public key(s) to system(s) for which you wish to authenticate to. There's also no need to use the same key for different remote systems --- you can use specific keys only for a specific remote system (making an adversary's task of determining what remote systems you connect to, based on public keys used on such systems if obtained, a bit harder).
The use-case for PGP was meant to be encrypting or authenticating (signing) data which would need to be accessible and/or validated from that point forward. If the sender's public key, or receipient's private key, are not available, valid, or uncompromised at some future time, then the data are either unreliable or unavailable.
Using SSH for more durable cryptographic transactions is convenient. But it also changes the use-case and environment around SSH. That will have side-effects.
Terrifying idea: trusting a third party to maintain the metadata about a key and who's identity it represents.
PGP absolutely got this part right: if you modify the contents of the metadata, the hash changes. Basically, if a private key were to point to Myself, and I distributed it widely, then lost it... an attacker who recovered said key could _transparently_ change the identity of the key and we'd have no record of who was actually correct. And lets not pretend that a government couldn't coerce Github to add an ssh identity to your account (it is owned by Microsoft now, and they have DOD contracts to fulfill).
Keybase solved both these issues: easy and intuitive, transparent proofs, along with the rigidity of metadata with pgp keys: if a key owner changes, the pgp key mutates.
How does Keybase address this problem completely? If an attacker gains possession of a key, they don’t have to change ownership, they just assume the role of that user. NB: I know they could feasibly only do this once before the key is considered burned by detection from the original user, so I’m somewhat lost here. Presumably you could mean that revocation of a known stolen key would be easy to point to, but any PKI can handle this.
Edit: I’m aware of Keybase itself doing per-device salts, but under a sophisticated attack, I don’t see a workaround here unless they’re doing some multi-party signing process with authorization against the Keybase server who acts as a second party, but even then, a sophisticated attacker who has control of the user’s machine impersonating someone would still be able to circumvent this.
Contrast that to an ssh key, which has no bound metadata.
And to your point, both systems in isolation are useless. But the first, combined with proofs and a distribution point like keybase, form a complete system. The second however, ALWAYS relies on a trusted party not doing bad things.
I tossed them without a second thought after they annoyed me with Stellar. Nobody uses Stellar if they dont have a hidden incentive. It always had a huge forced marketing vibe.
Is there some sucessor to keybase?
(Motivation disclaimer: I want to dump on Keybase because in the end, even with flawless crypto at first, those organizations always erode the good things down to centralized with platform control again.)
Depends on the use case. E.g. for raw identity proofs https://keyoxide.org works well but it's not as straightforward to use as Keybase.
Lol no.
There is no mechanism to invalidate keys by the domain owner, while it uses email as one of the core identifiers.
I purchased a cool domain, which had PGP users who published their keys to various key servers.
Their keys have no expiration, while I'm in control of the domain...
PGP was good, 30 years ago. But technology has evolved, along with the understanding of the problem.
I made a reply about SSHFP records (https://news.ycombinator.com/item?id=29212552), to push server keys in the DNS: that + DNSSEC means you remove the problem of initial trust (deciding to add a server to your known_host on the first connections)
Now imagine if something like MX records could also contain SSH keys for the mail users: you'd solve the problem of mail encryption on a global level.
People who want to send me encrypted mail could ask my server for my key, DNSSEC would prevent tempering with that, and if I lose access to the domain, there would be no issue with stale keys from old PGP directories.
As for scalability issues, DNS is perfectly done (with caching, etc) to handle that easily.
Like you, I could say "SSH got this part right" - but no. Again, technology has evolved.
The "only" problem would be correlation attacks, and I think that's a big one, in the age of surveillance.
Ideally, we'd have something like bitcoin key-derivation from a seed key, where you'd have:
- a key you publish to receive encrypted email,
- derived public keys, one per server, so that you do not risk correlation attacks
This is a great article, because it looks at the ubiquity of SSH keys, and how the technology is better than PGP keys, to advance the problem - say by signing git commits and tags.
I hope we'll also use the advances from other technologies.
Unfortunately that leads to this: now imagine said MX servers were under whatever political party you oppose.
Hmm, what could I do?
Maybe change my MX records to move from mailgun to postmark or any other mail provider? Or self host?
But that's if we assume the key servers would have to be the same as the MX servers, because of some technological limitations.
Alternatively, it could be done like SSHFP where SSHFP records exist independently from the CNAME records: then the problem disappear, as you as the domain owner can delegate the MX part to one company, while only entrusting yourself with the publication of the public keys.
If you mean "but what about gmail users" - if gmail servers are under whatever political party you oppose, you've got a much bigger problem, and I don't think there can be a technological solution.
* https://coderwall.com/p/tx_1-g/gpg-change-email-for-key-in-p...
If you want to invalidate the identity entirely you just upload the revocation certificate.
To make things worse, there is no mechanism to let the key server know that the emails associated with these keys are invalid.
And I have tried my best to get in touch with maintainers to explain the stupidity of this situation, but there is apparently no way besides revocation certificates to deprecate or delete a key. Or, if I give a less generous interpretation, maybe they want to keep pretending that PGP still has a lot of users?
So a known bad key is associated with my domain, with no way to fix that - except maybe waiting for PGP key servers to die and be finally replaced by something better.
This is why I call that an outdated technology. I'm sure it was good 30 years ago, but it should have evolved.
The PGP web of trust is as good as dead, and denialism around the usability issues in gnupg is mostly to blame. If we want people to use a decentralized web of trust solution going forward, it's time to accept the fact that we'll need a new set of clients and usability/accessibility standards.
Things are being worked on.
Watch Sequoia.
Maybe some things regarding UX on my radar will surface in a range of <2 years.
I don't think the thing you are referring to ever actually existed. Just like in real life you would trust someone just because someone you trusted trusted them. This is a common strawman and does not represent some sort of weakness in the relatively straightforward certifications provided by stuff that supports OpenPGP.
I guess we need better words.
If you give ssh-agent some data and a public key then — if it has the corresponding private key — it will return a signature for your data using that private key.
The protocol command is SSH_AGENTC_SIGN_REQUEST and it’s the bread and butter of how the agent does its job.
Historically, it’s not tractable for public sign/verify but you can use it as a way to do symmetric encrypt/decrypt with ssh-agent.
I've been patching support for this into ssh-agent for about a decade. I wrote a PKCS#11 module which talks to the SSH agent socket to forward your smartcard [0]. Doing so requires three changes to the protocol:
1. The ability to sign arbitrary data and get back the signed result [1]; normally you get back a hashed result [2].
2. The ability to decrypt data, this is what you said. This is less important since many things only require signatures (and not all algorithms support encryption/decryption).
3. The ability to request your certificates [3] [4] this one is kinda obvious.
The benefits of this are that you can use your smartcard on the remote host to do fully authenticated password-less sudo with pam_pkcs11. You can also do anything else that requires you to use your private key to be used, which can include fetching files (TLS client certificate authentication).
Within the US Government, passwords have been being phased out since 2004, but the requirements for authenticated privilege elevation remain.
Another way to accomplish this is to use SSH forwarding of your PC/SC socket but that's less portable and more fragile (and even less secure).
[0] https://github.com/rkeene/ssh-agent-pkcs11
[1] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l...
[2] https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent...
[3] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l...
[4] https://datatracker.ietf.org/doc/html/rfc6187#section-2.1
Additionally, I wrote an SSH Agent (in JavaScript, for ChromeOS, but works on any platform) that has these modifications [3]. I use this more frequently these days (via Tcl [4]).
[0] https://marc.info/?l=openssh-bugs&m=119214228626872
[1] https://rkeene.org/viewer/archive/openssh/openssh-4.4p1pkcs1...
[2] https://rkeene.org/viewer/archive/openssh/openssh-4.5p1-pkcs...
[3] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c
[4] https://cackey.rkeene.org/fossil/artifact/183583332c474aa9
I have a config file per identity (work, personal, second job, etc) in ~/.git/config_$identity. Each of those files contains a Host entry with key configuration for every service I use. I rely on a bit of shell foo to to select the correct identity (an environment variable and an alias).
Life would be a bit easier if ssh_config supported the use of variables in Include statements, that way I could just Include ~/config_${identity}. Oh well.
To sign: openssl dgst -sha512 -sign ~/.ssh/id_rsa file > file.sig
To verify, needs converting the public key (who.pub) to something OpenSSL can grok:
ssh-keygen -e -f /tmp/who.pub -m pkcs8 > /tmp/who.openssl.pub
Then verify: openssl dgst -sha512 -verify /tmp/who.openssl.pub -signature file.sig file
> SSH keys held on YubiKeys can't be used to decrypt files.
So I'm stuck with gpg. I don't want to store my private keys as a file on a computer just to decrypt stuff.
I quite like the idea of using my SSH Keys for this use case as it makes setting this up incredibly simple. I seem to spend a non zero amount of time helping developers and QAs at work setting up SSH Keys for GitHub, I might as well get them to sign commits at the same time now.
Also, article is biased toward pki (vs web of trust) and tries to pass off github as a type of 'cert authority'. ssh signing is 'web of trust' but it leaves the trust implementation totally up to the user. Neither system is "better", the tradeoffs just need to be known and at least pgp implementations will have ux to provide for web of trust.
At any rate, if you want to tell me you actually believe most users of PGP actually properly deal with key rotation and don't just give up and set unreasonably long expiration cycles on their keys or stop using pgp when they first encounter an error about an expired key, I might have a bridge to sell you.
[1] See `man ssh-keygen` for the -h and -s arguments and -V for the validity window.
I’d assume they’re using Ed25519ph (pre-hash) with a context (the -n file namespace), but I can’t find the source for ssh-keygen with a quick search to confirm. But then again, it’s also not advisable to share keys between Ed25519 and Ed25519ph, which the author would be doing...
Definitely will mean some interesting things for Git workflows, though. I've long been in favor of requiring every commit to be signed, and making that easy to enforce either in merges or push hooks. On the other hand, Linus is publicly against it[2], with good reasoning, though I don't think compelling enough reason[3].
Signing every commit would completely break the common pattern of handling merges centrally. Most companies, unlike kernel development, have a centralized server with a "trunk" and code review is done as part of that. Signing every commit with your SSH key would break that model, badly, but it could instead be an opportunity to improve the git tooling.
One of my favorite features of the now-defunct Phabricator was that you typically merged your commits with `arc land`, which a) squashed and annotated your merge with the Phabricator code review metadata and b) Deleted your branch. The latter was especially handy, but the former made code review great. Github and Gitlab can do the same as part of their UI, but it would be far better if it were nicely integrated with your existing git workflow, and this would be the opportunity to add prepush hooks to nicely integrate with hosting sites and code review tools.
[1]https://docs.aws.amazon.com/cli/latest/reference/ec2/get-pas... [2]https://web.archive.org/web/20201111174438/http://git.661346... - There has to be a better archive of this mailing list than the wayback machine. Searching for this, though, led me to my previous comment[3] [3] https://news.ycombinator.com/item?id=12291462
Git can probably also do this for certain merge modes ? I'm not very familiar with how this works in Git.
btw. i am also a great fan of the phabricator workflow :)
I always feel embarrassed when I see government systems that use digital signatures infrastructure. Usually, a government website has their own web application through which you input your private key and your password. Sure, usually those applications use standard libraries that do computations locally. But how do I know this? If such a website is hacked – my private key will be exposed.
Sorry, what? Can you point me to some examples, because this sounds so crazy. Why would you ever upload your private key to a server? Sounds like security theatre to me...
I mean hackers could change the code of the website so that private keys will be uploaded without noticing by users.
1. Government forces you to jump through hoops with some collection of favored — sorry, I meant “authorized” — vendors who can issue you a certificate for $WTF (either paid directly or through your taxes...).
2. You are provided with the private key in some manner. Hopefully not in your email, but that’s often what happens.
3. Whenever you want to validate yourself to the service, the government website then has you upload that private key to use in their own homemade implementation of JavaScript PKI. Sometimes they actually take the key from you and send it to their server to do the work.
... I think we are both in agreement that this is pretty lousy. And if you’re seeing it in Ukraine, it’s a world-wide “security” model. Maybe someone else here on HN can explain the thinking that went into these sorts of implementations...
Once Git 2.34 adds the ability to do this, will Github still show its verified indicator?
https://docs.github.com/en/authentication/managing-commit-si...
Nevertheless, it's nice to have some more direct support.
If you sign using a key that also controls cryptoassets, then you're incentivized to keep the key safe and secure indefinitely. Contrast with tendency to lose GPG and SSH keys after losing interest for a few years, changing jobs, etc.
Moreover, consider key revocation. The revocation mechanisms for GPG and SSH keys are not that effective, due to impracticality of publishing your revocation in a way that really ensures subsequent verifiers are alarmed. If only there were some sort of decentralized, permissionless, globally-replicated database which verifiers could check for that information...
More generally if you have a really important signature to publish, you can mint an NFT for it or otherwise inscribe it on the blockchain. There it will live, irrefutably notarized and timestamped, forever.
I explored these ideas in a weeklong side project [3] that only got to cumbersome proof-of-concept stage.
[1] https://eth.wiki/json-rpc/API#eth_sign
[2] https://eips.ethereum.org/EIPS/eip-712
[3] https://github.com/mlin/stakesign
Footnote: Bitcoin also had an arbitrary-message-signing mechanism -- commonly used on bitcointalk back in the day -- but I think it may now be ~defunct due to not keeping up with the newer address types introduced in recent years.
Albeit for long-term public signatures I see the benefit in spreading the sig and revocation information from the classical tools in to as many hard to modify places as possible. Popular global databases like Ethereum and similar are good condidates for that.
And of course have the verification scheme expose inconsistencies between different key-sources and tag them with their respective power structure categories. (Lime Government, Cryptocurrency-Devs, HugeCodeHostingPlatform, CompanyBehindHugeCodeHostingPlatform, etc...)
I would speculate that there are probably already more people who practice decent opsec for their Ethereum keys than for GPG & SSH keys. Soon it won't be close!
So basically you know that an specific SSH key signed a file, but that's all you know. Not very useful? Who's going to maintain a file with allowed signers per key?
A repository only allows signed commits / merges / pushes and simply stores the file in the repo itself.
If you already rely on forges like github/gitlab/... and trust them to generate a file for you (e.g. from the users ssh keys having write access to the repo).
You maintain this file independently for yourself with a "Trust on first use" mechanism (which will follow in a future patch to git)
A git patch currently in progress will utilize the valid-after/before options that you can set on keys in this file to verify the commits/tags with keys valid at the time of the objects creation. This will allow for key rollover and still being able to verify old signatures. (Theres also the revoke file which will invalidate all signatures for a key). In addition to that a "trust on first use" patch will follow that can automatically add new keys with the committers ident to this file (unless the ident is already present with a different key of course, which should error badly).
disclaimer: i wrote the git integration for this
It is very easy to connect to the agent and ask it to sign something.
Nope. I just checked. I don't.
That's not convincing to me. Does anyone have more details on this?
It does not seem right to me that a signing protocol secure for similar things would necessarily be secure against random things; A LFR over a long sequence seems like it could be different than a single feedback over random space, and sometimes that difference could be important.
The crypto part is relatively easy. Ensuring that you've got the right keys on the right hosts is the hard part.
E.g.:
- If Eve gives Bob a key Eve describes as Alice's but which is in fact Eve's, then Bob is (unwittingly, but cryptographically validly) permitting Eve access.
- If Eve can copy Alice's public key from Bob's system to one controlled by Eve, and Alice isn't scrupulous in verifying host keys, then Alice may be tricked into logging into Eve's system (and perhaps divulging further information) when she thinks she's logging into Bob's.
- There's the more common problem where Bob permits a login using Alice's key, but that key has been compromised in some fashion by Eve. The cyrptography is putatively valid,[1] but the presumption over identity is not.
The PGP "web of trust" model was designed to give some assurance that a key purporting to be Alice, or Bob, or Eve, actually was, and without relying on a central certification authority. It ... mostly kind of worked, but also mostly kind of didn't.
Trust itself isn't a cryptographic property. Aspects or indicia of trust may be cryptographically validated.
For SSH, the trust aspect has been implied in the key-delivery mechanism. Either the trusted party transmits a key directly to the recipient, or they generate the key from on the recipient's system. Further trust of that key relies on both the crypto implementation remaining valid (see again CVE-2008-0166), and control over the private key and any additional authentication factors (passphrase, physical authentication factors, etc.) remaining uncompromised. There are numerous instances in which private keys and/or passphrases have been compromised.
That said, I see some appeal in being able to use, say, SSH keys rather than passwords and other factors to authenticate to websites. In fact there's no need especially to authenticate in the case of content, I need only sign the content which would demonstrated the authenticity of 1) my having signed it and 2) it not being altered since creation. (Say, if dang were to get into the sneaky habit of surruptitiously editing HN comments by other users.)
________________________________
Notes:
1. Or perhaps not, as in the case of CVE-2008-0166, the Debian bug in which time-of-day in seconds was used in key generation resulting in a namespace of only 86,400 keys being possible, a feasibly-brute-forceable space. Those key values are now blacklisted.
- Minizign: an implementation of Minisign in Zig
- Wasmsign: a tool for signing WebAssembly modules
I'm sure this has been a technical possibility since the dawn of ssh keys themselves.
My reasoning is that if your website get hacked it wont help if you have signed the file, the hacker could re-sign the files with a new public key.
It doesn't indicate who made the hash, if a simple checksum method was used.
A cryptographic signature is a hash made using a private key, indicating that only someone with access to that key could create the hash. It asserts both integrity (the contents haven't changed) and authorship.
Without the private key, the hash merely indicates access to the content at some prior point in time (which might be otherwise asserted or recorded), but not who had that access.
So signing only works if you already have an established relation with the one receiving the data.
The signature itself verifies:
1. That contents haven't been modified since they were signed. (Integrity.)
2. That a party had access to the private key in order to create the signature. (Authentication)
(You're not assured, of course, that others don't also have such access.)
Determining the real-world identity of the signer is ... another matter. Though an exchange of content encrypted against their public key, and returned to you, might help establish that. Process and protocol will depend on your own needs, intent, and goals.
But if the public key is required when verifying the signature, then where ever that key is requested from needs to be a trusted source and it's also the weakest link. If that source is a web site, you could just as well publish the file on that web site and the files would be just as trusted as if they where signed.
Example: Alice signs a file, and uploads the file on a public FTP server. Alice public key is published under the about section on her HN profile.
Hacker bob hacks into Alice HN account and changes her public key without Alice noticing it. Hacker bob then downloads the file from the public FTP, ads some malicious code, signs it with his own private key belonging to the public key he added to Alice HN about info. Then hacker bob sends the file to a victim.
The victim verifies the signature using the public key on Alice HN account as instructed by Alice.
If the SSH method descried in TFA is to become widely used, it will all but certainly end up replicating a similar model.
Otherwise: trust keys you're given directly, or which have a sufficient verification and trust chain attached to them. This is a Hard Problem of all authentication-based crypto. E.g., in our mutual transactions with Hacker News, we're implicitly trusting the site's TLS cert 02:b3:a8:b0:57:06:45:1c:7c:80:fb:d6:e8:31:e3:5e issued by DigiCert. That implied trust is the basis for multiple trillion-dollar-valuation companies, online commerce, communications, control, and other transactions. It has numerous known limitations. And yet it remains used.
https://medium.com/@chrispisano/ssh-authentication-with-gpg-...
TL;DR: Use the same key in GPG and SSH by it exporting out of GPG into SSH
gpg --export-ssh-keyIts relationship to your identity, contextually ("this is my GitHub key, this is the one for $VolunteerProject servers, and this third one is for my local machines") makes more sense for this purpose than in age too. Signing a git commit with a key you use on gitlab for example.
> This has literally nothing to do with age, which, by deliberate design, doesn't implement signing. What a strange and hostile thing to write.
But of course I never claimed age performs signing I wrote that it re-uses SSH keys without a safety rationale. Here's what age actually says about its re-use of SSH keys:
"As a convenience feature, age also supports encrypting to ssh-rsa and ssh-ed25519 SSH public keys, and decrypting with the respective private key file." -- https://github.com/FiloSottile/age#ssh-keys
So, we see age does in fact re-use SSH keys for this unrelated purpose. And we see that, unlike the OpenSSH feature described in this article, it offers no rationale for why this is safe. Filippo talked about writing such a rationale but ultimately there isn't one provided.
Ordinary users shouldn't try to imagine for themselves why something dangerous might be safe. In the absence of a rationale for why re-using your SSH private keys to decrypt age messages is OK, don't do it.
The article provides a rationale for OpenSSH's "sign arbitrary data" feature (a briefer one is included in the OpenSSH distribution itself) so that you can assure yourself that this is a reasonable thing to do.
> What remains open for future work is checking for cross-protocol attacks
Yes. Yes it does.