Certify one's public PGP key. Problems figuring how

The underlying private keys used by OpenPGP and X.509 can be the same keys, because these technologies are "just" transport formats and ontologies for key-to-identity bindings and messages using those. In fact, I remember some efforts a few years ago to try to make these technologies interoperable by literally using the same subject key in an OpenPGP identity and an X.509 certificate, or maybe one of them was OpenSSH instead.

You can, in principle, extract the subject key in each case and then import it into a different identity ecosystem. That's not at all impossible. The big challenge with that is that the tools and concepts in each ecosystem are so different that you're unlikely to find other people who will successfully interoperate with such a crossover system, unless you personally persuade them to install custom software to do so. You might also have to write some of that software yourself, depending on which exact crossover you want to do.

I remember discussing this quite a lot before Let's Encrypt was set up when many privacy activists were expressing skepticism toward the centralization (and, at the time, limited transparency) of the CA system. Since then, it's remained pretty centralized but become more transparent, which I think is great progress. There was a question about making OpenPGP and X.509 interoperate so that you could sign website keys with your OpenPGP key (thereby confirming that you agreed that that website was supposed to be using that key), or so that you could receive OpenPGP e-mail with your X.509 key (thereby allowing people to bootstrap trust in certificate authorities in order to send you encrypted e-mail, especially if they preferred OpenPGP to S/MIME).

These ideas are not technically impossible, but as people have mentioned in this thread, they start with somewhat different trust and identity models, and the software ecosystem to interoperate between them is significantly lacking.

I think the energy around developing some of that software has also been hindered by a series of events that have led to decreased popularity of end-to-end e-mail encryption as a whole, even though of course the OpenPGP technology can also be used for other applications.

Anyway, my summary is, yes, these things could interoperate at a low cryptographic level (in the specific sense of exporting and importing subject keys), but they can't directly consume or verify one another's trust assertions, and the software to make any kind of crossover between X.509 and OpenPGP practical is not widespread or well-developed. You also can't convert between an existing X.509 signature and an OpenPGP signature because the signature is taken over specific bytes, so the holder of the private key would have to regenerate it explicitly in each format.

3 Likes