14 ms·

What are the advantages of signing with SSH rather than GPG?

Shank 4y ago
For starters, you don't have to manage two keys at minimum. That's already a plus. For another reason, I wasted a lot of time diagnosing problems with gpg not working correctly, from the daemon crashing and needing to be killed periodically to random lockups or failed signatures due to keys not being unlocked. All of that is alleviated with ssh. Edit: Turns out this still uses gpg? I think?
- divbzero 4y ago
  My gut feeling is to create a separate key for signing but I’m not sure why. Is there downside to using the same SSH key for both signing and login?
  - cmeacham98 4y ago
    If you wish for a computer to be able to sign commits but not push (or push commits but not sign) that would be impossible. Anytime you use that public key (for example, to SSH into a server) that session is linked to your identity via git commits (this doesn't actually matter for github, as github exposes all your SSH keys via its API anyways).
  - tialaramex 4y ago
    Ordinarily you should not use private keys for more than one purpose because the algorithms may make it possible for bad guys to surprise you with the consequences. e.g. you sign a document vouching for someone to adopt a cat, but it turns out actually when interpreted as a bank sign-in instead of cat adoption document your signature still works. However, the OpenSSH team were very careful to design their signature feature so that what is signed is always different from any possible SSH login. Now, of course if you sign a text document which says "I want Bill to have all my stuff" but you meant, you know, Bill at work, can keep my stapler and that cool glow-in-the-dark mug, because I'm leaving next week and I can't be bothered to box it all up and take it, whereas your 2nd cousin William tries to persuade a judge it's a legal Will, and so your untimely death in a car crash should result in him inheriting everything instead of your bereaved wife and six year old daughter - well, that OpenSSH can't do anything about. But you would be correct to assume it is not safe in general to use keys for unrelated purposes, and only the (documented and justified) choice by OpenSSH reverses that assumption for the SSH tools.
- cmeacham98 4y ago
  > Edit: Turns out this still uses gpg? I think? Nope, it uses your SSH agent. It's super confusing because the git config key is `gpg.format` (which you set to `ssh`), but I promise it works without GPG installed. I suspect this confusing name is because when support for signing commits was originally added to git it only supported GPG, and a bad choice on the parameter name was made.
- jbboehr 4y ago
  You can use your GPG key as an SSH key[0], and you'll also only need to manage one key - although that doesn't fix whatever issues you might have with GPG, of course. [0]: https://wiki.archlinux.org/title/GnuPG#SSH_agent https://wiki.archlinux.org/title/GnuPG#SSH_agent
michaelt 4y ago
In my experience, almost every git user has an SSH key already set up, to push with. Far fewer people have GPG keys set up.
_vdpp 4y ago
I think hardware SSH keys using FIDO2 are a lot more convenient to set up than GPG as well.
Beltalowda 4y ago
It's a lot simpler to set up. I have forgotten the details on all of this, but basically gpg signing worked fine for a few years until it didn't and then I couldn't fix it in under an hour. I just stopped signing stuff until git added ssh support last year.

For starters, you don't have to manage two keys at minimum. That's already a plus. For another reason, I wasted a lot of time diagnosing problems with gpg not working correctly, from the daemon crashing and needing to be killed periodically to random lockups or failed signatures due to keys not being unlocked. All of that is alleviated with ssh. Edit: Turns out this still uses gpg? I think?

divbzero 4y ago
My gut feeling is to create a separate key for signing but I’m not sure why. Is there downside to using the same SSH key for both signing and login?
- cmeacham98 4y ago
  If you wish for a computer to be able to sign commits but not push (or push commits but not sign) that would be impossible. Anytime you use that public key (for example, to SSH into a server) that session is linked to your identity via git commits (this doesn't actually matter for github, as github exposes all your SSH keys via its API anyways).
- tialaramex 4y ago
  Ordinarily you should not use private keys for more than one purpose because the algorithms may make it possible for bad guys to surprise you with the consequences. e.g. you sign a document vouching for someone to adopt a cat, but it turns out actually when interpreted as a bank sign-in instead of cat adoption document your signature still works. However, the OpenSSH team were very careful to design their signature feature so that what is signed is always different from any possible SSH login. Now, of course if you sign a text document which says "I want Bill to have all my stuff" but you meant, you know, Bill at work, can keep my stapler and that cool glow-in-the-dark mug, because I'm leaving next week and I can't be bothered to box it all up and take it, whereas your 2nd cousin William tries to persuade a judge it's a legal Will, and so your untimely death in a car crash should result in him inheriting everything instead of your bereaved wife and six year old daughter - well, that OpenSSH can't do anything about. But you would be correct to assume it is not safe in general to use keys for unrelated purposes, and only the (documented and justified) choice by OpenSSH reverses that assumption for the SSH tools.
cmeacham98 4y ago
> Edit: Turns out this still uses gpg? I think? Nope, it uses your SSH agent. It's super confusing because the git config key is `gpg.format` (which you set to `ssh`), but I promise it works without GPG installed. I suspect this confusing name is because when support for signing commits was originally added to git it only supported GPG, and a bad choice on the parameter name was made.
jbboehr 4y ago
You can use your GPG key as an SSH key[0], and you'll also only need to manage one key - although that doesn't fix whatever issues you might have with GPG, of course. [0]: https://wiki.archlinux.org/title/GnuPG#SSH_agent https://wiki.archlinux.org/title/GnuPG#SSH_agent

michaelt 4y ago

In my experience, almost every git user has an SSH key already set up, to push with. Far fewer people have GPG keys set up.

_vdpp 4y ago

I think hardware SSH keys using FIDO2 are a lot more convenient to set up than GPG as well.

Beltalowda 4y ago

It's a lot simpler to set up. I have forgotten the details on all of this, but basically gpg signing worked fine for a few years until it didn't and then I couldn't fix it in under an hour. I just stopped signing stuff until git added ssh support last year.