Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When using GPG to sign Git commits, and as the SSH-agent, is it important to use separate sub-keys for the signing of the Git commits as it is for authentication with the SSH host of the Git server?
Does using the same sub-key for both expose owner of the to an attack vector where previously or planned signatures of Git commits could be used to impersonate during SSH authentication?
I'm particularly interested if this would be the case with ed2559 keys, or RSA.
Generally, no, mentioned git signatures do not make you more vulnerable to impersonation during SSH authentication. For SSH authentication, the attacker would have to know the private key. And the security of the private key does not depend on how many different messages you sign with it, since it cannot be derived from signatures. That is, as long as the key algorithm is secure, such as ed25519, or RSA with at least 2048 bits.
I also can't see a way how an attacker could correlate the signed git-hashes and SSH authentication in such a way that by signing the one you are signing the other. I don't know if the key exchange mechanism would even allow for this, but even if it did, git hashes contain a random / time based component, and so does the key exchange with an SSH server. So for an attacker to be able to fabricate git hashes on your local system that correspond with real-time SSH authentication requests, and having you sign the same, he would need such a high level of control over your system that there would be more direct ways to access your private keys. If for example, he intercepts the git process, or places a modified version of the executable on your system, then he might as well intercept the key itself.
No, using the same key for git/ssh does not make you vulnerable to impersonation.
One possible attack is Chosen-plaintext attack. The oracle/blackbox would be the Git signatures.
Consensus I found on the practicality is close to zero. And the gnupg folks even default the main key to Certify and Sign, which might show some confidence on their signing methods being able to isolate any key reversal. Though everyone suggest to not sign/encrypt data an attacker control, to the point of the current best practices is to not even quote longer emails...
Here is a an interesting discussion on the topic I stumbled upon recently https://crypto.stackexchange.com/questions/2846/what-is-the-difference-between-known-plaintext-attack-and-chosen-plaintext-attac#comment5057_2873
