https://bugzilla.mindrot.org/show_bug.cgi?id=3001
Bug ID: 3001
Summary: enable sending OpenPGP-formed certificates for ssh
hosts
Product: Portable OpenSSH
Version: 8.0p1
Hardware: Other
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: sshd
Assignee: [email protected]
Reporter: [email protected]
This is a feature request for in-band transmission of OpenPGP
certificates for OpenSSH hosts.
I propose adding a new HostKeyAlgorithm
`[email protected]`, which transmits that same
public key material, wrapped in OpenPGP key material to the client.
The first step of the implementation would just be server-side: if the
client states a preference for that algorithm, and sshd knows of a
`HostKey` named `$FOO` that contains an ed25519 secretkey, and
`$FOO.pgp` exists, then `sshd` should just send the content of
`$FOO.pgp` over the wire, while working with the secret key found in
`$FOO`.
This permits the host to send in-band OpenPGP-style certificates,
without `sshd` needing to know anything about the format.
The second step toward making this useful in an
OpenSSH-on-both-endpoints ecosystem would be client-side, something
like the `KnownHostsCommand` request from bug 1777; i'll defer that
discussion over there.
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
