keybase / keybase/keybase-issues
Verify more public key types
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I like the idea of being able to verify someone's identities through their public key. That said, I'd love it if we could tie together even more public keys that are already in use in various places.
I carry with me a USB drive with all my public keys and fingerprints, all signed with my PGP key, so that I can give them out to anyone I meet, and they can verify later that the files are valid with the PGP signature. This strikes me as a remarkably similar use case to keybase, albeit with my public keys rather than my online identities.
What I'd like to see is support for verifying more public keys and fingerprints via keybase. For my purposes, this means SSH keys and my Off the Record fingerprints, though others such as X.509 certs are likely also valuable to some.
For SSH keys, I'm envisioning a textbox on keybase that accepts the output of `cat ~/.ssh/id_rsa.pub | gpg -a --sign` or some similar command, which would produce the SSH public key for the user, signed with their PGP key. Anyone else can now verify that I have signed the SSH public key, and can, at their discretion, allow me SSH access without having to bother asking me for the key. For further confirmation that I actually own the relevant SSH private key, keybase could ask that I SSH into a server, similar to how github handles SSH keys.
I'm not sure how I'd deal with Off the Record fingerprints, but it would be nice to have signed copies of those available as a second line of verification, outside of the chat client. Maybe this use case should just be satisfied manually with a `keybase sign 'fingerprint'`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the proposed verification flows for SSH public keys, Off the Record fingerprints, and X.509 certificates, including the suggested PGP signing and SSH challenge approaches. The issue does not name files, tests, or an implementation entry point, and completion criteria remain broad because the supported key types and workflow are undecided.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100