Mailing List Archive: Learning about authentication

I want to know a bit, on how authentication and authorization works in
GnuPG.

I know that for encryption, GnuPG creates a session key with the public
key, that is then used with symmetric encryption. For decryption, the
private key is used to recover that session key, in which then, the
ciphertext get's symmetrically decrypted, using that session key.

I know that for signing, a hash of the content is produced, that,
afterwards, gets encrypted with the private key. For verification, the
public key is used to recover the original hash, and then that gets
compared with the content hashing.

I don't understand how authentication and authorization works. Can
someone clarify this for me?

Thanks.

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Hello,

Daniel Cerqueira wrote:
> I want to know a bit, on how authentication and authorization works in
> GnuPG.

Do you mean authentication subkey in GnuPG? It's basically
user-defined; It's up to user how it is used.

Usually, it means use with OpenSSH. For example, I have an
authentication subkey as my OpenPGP key. I use it with GnuPG, when I
accesss git repo with OpenSSH. SSH authentication is done by OpenSSH
and ssh-agent emulation of gpg-agent. It means that the key is under
control of GnuPG, actually.

(Other possible use case is use with Scute for X.509 client certificate
authentication, together with Web browser. This is not that
common/popular, though.)

FYI, I wrote this ten years ago:

Using GPG's authentication key for SSH access:
https://www.gniibe.org/memo/software/ssh/using-gpgkey-for-ssh.html

Hope this helps,
--

Mailing List Archive

Mailing List Archive

Attached Files: