4 ms·

Everyone likes to crap on PGP, but this is why my ssh keys are subkeys of my GPG key and locked up with the GPG SSH agent. This approach is far from perfect b

Everyone likes to crap on PGP, but this is why my ssh keys are subkeys of my GPG key and locked up with the GPG SSH agent. This approach is far from perfect but certainly disallows outright exfiltration attacks.

lostmsu 4y ago
Can you elaborate more? What's the difference between PGP, and having a regular SSH key password protected + running a regular SSH agent?
- exabrial 4y ago
  The advantages are very similar actually. The added ‘benefit’ or ‘disadvantage’ is dependent on your use case. If I regard my PGP key as the toehold to my online identity, having an ssh key tied to that identity is quite useful. Kind of neat to see the guy that signed the git commit is the same guy logging into the server, installing the software signed with the same pgp key. If your threat model needs to key your online identity somewhat anonymous, than a private key per server is likely the way to go. An encrypted ssh key is somewhere in the middle there.
- eropple 4y ago
  For me, physical smartcard storage + overarching identification. I've been using a Yubikey as my GPG key for a long time (and another in my safe as my GPG root). You can use SSH with FIDO2 today as well, but outside of SSH GPG provides a web of trust which has other benefits, such as a root of revocation (a different Yubikey in my document safe contains my GPG root) and signature validation not being tied to SSH key presence/absence on GitHub.
  - aaronmdjones 4y ago
    I too have a primary YubiKey with my 3 PGP subkeys on it (signing, authenticating, decrypting), and a backup YubiKey in my safe with my PGP master key on it. I find it works quite well. The primary YubiKey goes everywhere I go; I have a lanyard for it. The backup YubiKey stays in the safe until I need it for something (e.g. signing someone else's PGP key, rotating subkeys, renewing the expiration date on a subkey, ...). I also use both of them for FIDO, on websites that support real 2FA; more specifically, I enroll both of them, but I only routinely use the primary one.

lostmsu 4y ago

Can you elaborate more? What's the difference between PGP, and having a regular SSH key password protected + running a regular SSH agent?

exabrial 4y ago
The advantages are very similar actually. The added ‘benefit’ or ‘disadvantage’ is dependent on your use case. If I regard my PGP key as the toehold to my online identity, having an ssh key tied to that identity is quite useful. Kind of neat to see the guy that signed the git commit is the same guy logging into the server, installing the software signed with the same pgp key. If your threat model needs to key your online identity somewhat anonymous, than a private key per server is likely the way to go. An encrypted ssh key is somewhere in the middle there.
eropple 4y ago
For me, physical smartcard storage + overarching identification. I've been using a Yubikey as my GPG key for a long time (and another in my safe as my GPG root). You can use SSH with FIDO2 today as well, but outside of SSH GPG provides a web of trust which has other benefits, such as a root of revocation (a different Yubikey in my document safe contains my GPG root) and signature validation not being tied to SSH key presence/absence on GitHub.
- aaronmdjones 4y ago
  I too have a primary YubiKey with my 3 PGP subkeys on it (signing, authenticating, decrypting), and a backup YubiKey in my safe with my PGP master key on it. I find it works quite well. The primary YubiKey goes everywhere I go; I have a lanyard for it. The backup YubiKey stays in the safe until I need it for something (e.g. signing someone else's PGP key, rotating subkeys, renewing the expiration date on a subkey, ...). I also use both of them for FIDO, on websites that support real 2FA; more specifically, I enroll both of them, but I only routinely use the primary one.