Client sent me an OpenPGP key; I need to generate key for SSH authentication on FTP server

Question

One of my responsibilities is the monitoring of our company's SFTP sever, and making sure our clients upload the files we need from them daily. Until now they had username/password access, but we want to migrate to public key access for security.

The client uploads encrypted files (GnuPG) that I decrypt in an automated way.

Now they sent me their public key, which is a **PGP PUBLIC KEY BLOCK**", Version: GnuPG v1.4.7. If it were an SSH public key (id_rsa.pub) I know how to add it toauthorized_keys` to ensure access (as a matter of fact this is how I connect to the SFTP server myself). However I do not know how to deal with the client's OpenPGP key. I did some research, but I haven't figured out how to use the client's key to give them access to our SFTP server.

Answer 1

You (or your customers) seem to be confusing a whole bunch of different concepts. First of all, SSH keys cannot be used for FTP authentication -- this is simply not specified, the protocol does not allow to do so. There is SFTP which has FTP in its name, but actually transfers files over SSH.

Then again, OpenPGP keys cannot be immediately used for SSH. While both use the same mathematical principles, the formats (and some details regarding the cryptographic "mode of operation") are different. It is possible to convert OpenPGP keys to SSH keys, but it does not seem reasonable to generate OpenPGP keys to just convert them. It is possible to configure GnuPG's gpg-agent to be used by the SSH client for authenticating with OpenPGP keys, but then again it requires even more (rather uncommon) software on the server side. While it is possible and there is quite a number of people doing exactly this (including me), I'd not expect this to be seen in a general business environment where you have no control over the customer's computers.

A common use case would be using SFTP/SCP (both based on SSH) to transfer the files and protect SSH authentication through SSH keys instead of OpenPGP keys. OpenPGP keys might be used to additionally encrypt the files, but then you'd have to share your public key (so you can decrypt using your private key).

Answer 2

If the clients are uploading GPG files those should be encrypted with your PUBLIC key. If they get encrypted with the client's PRIVATE key (which is more like signing) then anyone with the client's PUBLIC key could decrypt them. That seems antithetical to the purpose of encrypting the files.