1

I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on the software they're using and OS integration some users can use keyboard shortcuts to sign their messages or verify messages from other posters, but some are simply copy/pasting content between another piece of software and the forum. This seems fine from a security perspective but it's not a great user experience.

Ideally I'd like to request signing before message submission from the user's local PGP software so my service never comes into contact with private keys in any capacity, it simply requests signing from some service that's aware of the user's private key, receives a signed response, and stores that. Is this possible? Would this represent a risk (from the user's perspective) of a chosen plaintext attack?

On the other side it would be nice to automatically verify signed messages. This seems more difficult since even if I as the service know every user's public key and can do the verification, users still have to take it on faith that my reporting of signature verification results is reliable, although perhaps there's some way for the user's software to report verification failure.

Does anything like this exist where a website can request crypto services from another piece of software that's trusted by the user? Is there any fundamental security issue with such a setup?

1

Assuming you are using forms one could add accept=multipart/signed,application/pgp as an attribute of the appropriate input element. I don't think there is anything out there that would actually do anything with this information but it is a standards compliant way of expressing that you want signed data submitted.

As far as security issues go I think as long as whatever does the signing makes it clear to the user what they are signing and gets their consent it should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.