[openpgp] Re: Signatures with in-band subkeys

[Bart Butler <[e-mail]>]

Hi Julian,

Sounds interesting, and I see why the online subkey scheme would be attractive to you.

I suspect you could also do something like this within OpenPGP out-of-the box.

The first and I think nicest way would be to have your trusted master offline signing key as the primary key of your certificate and generate signing subkeys for use online. Your build system would have the signing subkey private key information but not the private key information for the primary certificate signing key. 


You could ship the public-key only variant of this certificate with your signatures easily, as it's all OpenPGP packet structure, so they can just be serialized together with your signature or data packets if you desire as long as your tooling can pick it up (a solvable problem if it exists I think). If you want to revoke a signing subkey, you can simply ship the subkey revocation with the embedded key, and OpenPGP tooling should persist that revocation as long as the client sees it once. The client trusts the subkeys via the binding signature from the (offline) primary signing key.

You can also pre-generate a revocation certificate for the primary key as a sort of break-glass emergency measure and deliver that to clients via your key delivery mechanism as well if you ever worry that the entire chain has been compromised. All this you could get "for free" (read, modulo maybe some tooling work) from existing OpenPGP stuff.

This kind of scheme might also be possible using a separate certificate hierarchy and certifications but I think the tooling problems there could be worse and I find it less elegant and more complex.

Cheers,

Bart Butler


On Tuesday, August 20th, 2024 at 12:32 PM, Julian Andres Klode <[e-mail]> wrote:

> 

> 

> Hi OpenPGP folks!
> 

> as some of you know I maintain APT, the Debian/Ubuntu package
> manager.
> 

> One topic of concern for package management is the ability to
> have online signing keys and an offline primary key that they
> are chained too, as you want your repositories to work automatically.
> 

> I've been drafting a new signing scheme for APT repositories
> a couple years back that hasn't been implemented, so far at
> least, we are still using OpenPGP.
> 

> Now one of the ideas there is that instead of having to know
> the online subkey a-priori, we instead ship the online subkey
> alongside the signature.
> 

> In case your online subkey gets compromised you can just create
> a new subkey and sign your data with that and the client trusts
> it.
> 

> I also added a generation number: We only trust a new subkey
> if its generation is higher. This means that once a client
> sees a signature from a new in-band subkey, it won't ever
> trust a previous in-band subkey again.
> 

> You can have multiple subkeys with the same generation on
> a technical level, which is why I did not call it a serial
> number.
> 

> This works reasonably well for the native apt-sign scheme:
> 

> 1. We read the previous signed metadata and get a list of
> (primary key id, generation)
> 2. We read the new signed metadata and check that the subkeys
> in there are >= the generation in the old one
> 

> 

> Alternative means are to keep the mapping in a global state file.
> 

> I'm curious to hear if this is something of interest to the
> OpenPGP community.
> --
> debian developer - deb.li/jak | jak-linux.org - free software dev
> ubuntu core developer i speak de, en
> 

> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]