4 ms·
I can ssh (of course) with my ssh key, and now I can sign Git commits with it. Can I also use an ssh key for encryption? My keys are all ed25519 if that helps.
by sowbug 4y ago
I can ssh (of course) with my ssh key, and now I can sign Git commits with it. Can I also use an ssh key for encryption? My keys are all ed25519 if that helps. I see a few proofs of concept on the web, but nothing as easy* as gpg.
My only use case for gpg asymmetric encryption is encrypting my offsite backups, and various small things. In other words, I encrypt only to myself, and I like asymmetric encryption because I can keep the private key offline.
*that word is used ironically. gnupg is the devil I know, so I don't mind it much these days, but I'd love to migrate off it completely.
- nixgeek 4y agoYes, this is incredibly easy to use: https://github.com/FiloSottile/age https://github.com/FiloSottile/age
- sowbug 4y agoAh, I'd forgotten that age can use SSH keys. Thanks!
- lrvick 4y agoGnupg is shit but PGP itself is just fine and we recently have more modern and well tested implementations of it now like https://sequoia-pgp.org/ https://sequoia-pgp.org/
- conaclos 4y agoThe sq program is not stable yet. right?
- lrvick 4y agoNo, but it is way more tested and stable than GnuPG imo. That said limited smartcard support keeps me from using it yet, but that is in testing and rapidly maturing.
- Toreno96 4y agoWow, it seems promising. Did you have a chance to use their CLI? Is it indeed better (more intuitive, less complex, more idiot-proof) than the GnuPG one?
- megous 4y agoYeah, I'll certainly follow recomendation from someone who starts it with calling a well known successful FOSS project "shit". /s
- speed_spread 4y agoDodge K-cars were well known and succesful. They were also utter shit. Plenty of FOSS projects are of low quality but get adopted because they fulfil a need. Some dont age well. Some have poor docs. Some have insufferable interfaces. It's ok to call them shit. All code is shit anyway. Its just the smell ratio that varies.
- megous 4y agoYeah, sequoia certainly doesn't shine here either, unless you call a dump of sq https://docs.sequoia-pgp.org/sq/ https://docs.sequoia-pgp.org/sq/ help screens a useful user facing documentation. I guess it's a nice library, but it's no replacement for GnuPG. At least GnuPG has an actual user guide, FAQ, etc. with important concepts explained step by step. As a GnuPG user, it would not be hard to switch for simplistic use cases without any specialized HW, I guess. I already know most of the concepts, but for new users,... I wish them luck with sq, lol. Documentation is pretty much nonexistent, and the web page for sq tool just links to library documentation. Rust codebase is not everything.
- lrvick 4y agoIt is a giant aging and super buggy C codebase. I found a serious CVE in it myself on accident any basic test suite would have caught. It was very successful but it is nowhere near the security, documentation, testing, or UX standards of what we would call quality software today.
- megous 4y agoLooks like a typical GNU style C codebase with a few CVEs over the years. https://ubuntu.com/security/cves?q=&package=gnupg https://ubuntu.com/security/cves?q=&package=gnupg Not sure what's the grumbling about UX. Common tasks signing/verifying/encrypting are simple. Key export/import is also straightforward. So for common tasks you learn a few (~6) CLI --options by osmosis. Web of trust/key management stuff is mostly done via interactive UI where you're prompted for what's needed after you invoke some action. Not too bad I guess. Certainly easier to be prompted for what's needed than remembering a ton of random CLI options or fishing through manpages, for tasks that you'll do very infrequently.
- pointlessone 4y agossh keys are keys. You can use them with openssl for encryption/decryption. It's a little bit more complicated than gpg but nothing an alias can't fix.