Sign arbitrary data with your SSH keys (agwa.name)

Article summary

The article discusses the ability to sign arbitrary data with SSH keys, a feature introduced in OpenSSH 8.0. This allows users to sign files and software releases using their existing SSH keys, providing an alternative to PGP. The article highlights the benefits of using SSH signatures, including ease of use and widespread availability of SSH keys. The feature is expected to be integrated into Git in version 2.34.

Main themes

• SSH signatures
• PGP alternative
• key distribution
• decentralized security
• trusted third parties
• CA system vs DANE/DNSSEC

What commenters say

• Using SSH keys for signing is more convenient and widely available than PGP, making it a viable alternative.
• Relying on a trusted third party like GitHub for key distribution is preferable to PGP's Web of Trust.
• Decentralized key distribution methods, such as blockchain or DNSSEC, may offer a more secure solution than traditional PKI systems.
• The security of SSH signatures and key distribution methods depends on the specific threat model and use case.
• Some argue that DANE and DNSSEC are weaker than the CA system due to centralized governance and lack of accountability.
• Others believe that DANE and DNSSEC can be more secure than the CA system, especially when combined with other security measures.
• The use of SSH agents and keys stored on hardware tokens, like YubiKeys, can enhance the security of SSH signatures.
• The complexity of key distribution and management remains a significant challenge, with no single solution being universally applicable.