Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'd like to use OpenPGP authentication over TLS, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate.

The approach is very similar to the approach used in Foaf:

Basically, you create a certificate request starting from a converted PGP private key, including your converted PGP public key into the certificate request. Then you sign the request with your converted PGP private key.

I'm using the word "converted" because OpenPGP and OpenSSL key formats are incompatible: I have to extract the key parameters from the OpenPGP key and use them to form a new X.509-compatible (OpenSSL) key. Nevertheless, it works as expected.

The result is a X.509 certificate with the PGP public key parameters used in the public key of the X.509 certificate, but without the user IDs and the public key signatures, thus making it unusable for authentication purposes.

The missing piece here is server authentication. The server has previously signed the user's PGP public key, but how do I verify that through the X.509 bridge certificate?

Even if I use my PGP user ID as my CN (Common Name), how do I certify that it's the same user ID used in the originating OpenPGP key?
There are no public key signatures on the X.509 bridge certificate, only the same key parameters. Can I safely just check against those?

share|improve this question
Tricky. One relatively simple solution would be to keep the clients PGP certificate server side. You should be able to find it by using any identifying data in the certificate. If there is no (signed) identifying data then you can find it by looking for the matching RSA modulus (or hash over the modulus). – Maarten Bodewes Nov 7 '13 at 19:42
Matching the modulus came to my mind, it would be enough for identifying the key, wouldn't it? I could put the PGP certificate in a custom extension and compare its public key with the X.509 public key. Afterall all I need to do is verifying that the X.509 certificate is signed with the same PGP private key which I need to prove the ownership of. – Daniele Ricci Nov 7 '13 at 20:47
If you can put the entire PGP certificate in a proprietary non-critical extension then you don't need to compare anything. The question if you are able to create your own OID and insert the PGP certificate in the extension, and if the server would accept such a certificate. Comparing the modulus with the PGP key in a local truststore should always work, but it requires a local trust store at your server. – Maarten Bodewes Nov 7 '13 at 21:07
What about just checking if the private key that signed the certificate is the same of the PGP certificate included in the extension? I don't really need to authenticate (that's done at another layer), I just need to verify that the client owns the private key matching the PGP public key contained in the X.509 certificate. – Daniele Ricci Nov 7 '13 at 22:07
The extension is signed, so if the CA software does not want to generate a certificate with an embedded cert., it will simply refuse. Obviously, you will have to use a CA that understands this use case. The CA is also able to verify that the moduli match, of course. – Maarten Bodewes Nov 7 '13 at 22:45

1 Answer 1

up vote 2 down vote accepted

If you can put the entire PGP certificate in a proprietary non-critical extension then you don't need to find the PGP certificate in a store. This solution depends on the condition that you are able to create your own OID and insert the PGP certificate in the extension. Furthermore, the server should accept such a certificate and contain methods of validating the PGP certificate as well.

The CA can accept or refuse requests containing a PGP certificate. It should at least check that the key in the PGP certificate matches the one in the signed request. One method of doing this is to validate that the modulus of the PGP and X5.09 public key match.

share|improve this answer
Glad this solution worked out for you, please update or comment if anything is wrong or missing from my answer... – Maarten Bodewes Nov 13 '13 at 13:54
It's perfect :) Sorry I don't have enough reputation to vote your answer up... – Daniele Ricci Nov 13 '13 at 15:44
Well, I cannot vote up your question any further either, so we'll have to wait a bit :P – Maarten Bodewes Nov 13 '13 at 17:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.