The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including:

0x20 - This key may be used for authentication.

In GnuPG, one of the most popular implementations of OpenPGP, it is possible to generate [sub]keys with the authenticate capability (using the --expert flag). Okay, great, I know have a key which has the four capabilities – Encrypt, Certify, Sign, Authenticate (ECSA). Now what?

I am curious about that Authenticate capability. Is there any real-world use for authentication OpenPGP [sub]keys, other than not using them and export them as SSH keys instead?


There is an informational RFC for use of OpenPGP keys in SSL/TLS; as the RFC says:

The term "OpenPGP key" is used in this document as in the OpenPGP
specification [RFC4880].  We use the term "OpenPGP certificate" to
refer to OpenPGP keys that are enabled for authentication.

That's what these keys are for: usages as part of authentication protocols which may technically look like signatures, but are not meant to fulfil "non repudiation" requirements.

I never saw a working implementation of RFC 6091, though. I don't think it gets much used anywhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.