Feature Request
Enhancement request to support the OpenSSH Agent Protocol with OpenPGP authentication subkeys that reside on the hardware wallet.
Discussion
Managing keys under a common interface for both OpenPGP and OpenSSH can have its advantages. Additionally software including and such as Monkeysphere can honor the expire and revoke signatures connected to the OpenPGP authentication subkey, allowing for further benefits.
Possibly a mirror of what gpg-agent is capable of in terms of it's ability to support the OpenSSH Agent Protocol, via say a Trezor gpg-agent.ssh socket.
Currently one can generate and use ssh formatted keys directly via the trezor agent, but there does not appear to be a way of translating these into OpenPGP key format. Even allowing one to export a OpenPGP authentication public key from the trezor agent in connection with the ssh formatted public key would be useful. Since it could then be imported by hand into the OpenPGP keyring, thus allowing a revocation certificate to be created and an expiration date to be set.
Related
#324
#358 (comment) : Note that pull request #358 though related due to the attention given to adding an authentication subkey, differs in motivation and focus. A motivation for #358 is to be able to offload subkeys onto a separate smart card.
On the other hand #504, FR for using Trezor PGP with SSH, goal is to maintain the GnuPG authentication subkey solely on the Trezor for use with SSH via the Trezor agent. Thus keeping it strongly secured. At the same time and of equal importance, a Trezor generated paired public GnuPG authentication subkey is to be produced, facilitating updates for authentication key expiration and revocation certificate via a trezor or non-trezor primary key.
Feature Request
Enhancement request to support the OpenSSH Agent Protocol with OpenPGP authentication subkeys that reside on the hardware wallet.
Discussion
Managing keys under a common interface for both OpenPGP and OpenSSH can have its advantages. Additionally software including and such as Monkeysphere can honor the expire and revoke signatures connected to the OpenPGP authentication subkey, allowing for further benefits.
Possibly a mirror of what gpg-agent is capable of in terms of it's ability to support the OpenSSH Agent Protocol, via say a Trezor gpg-agent.ssh socket.
Currently one can generate and use ssh formatted keys directly via the trezor agent, but there does not appear to be a way of translating these into OpenPGP key format. Even allowing one to export a OpenPGP authentication public key from the trezor agent in connection with the ssh formatted public key would be useful. Since it could then be imported by hand into the OpenPGP keyring, thus allowing a revocation certificate to be created and an expiration date to be set.
Related
#324
#358 (comment) : Note that pull request #358 though related due to the attention given to adding an authentication subkey, differs in motivation and focus. A motivation for #358 is to be able to offload subkeys onto a separate smart card.
On the other hand #504, FR for using Trezor PGP with SSH, goal is to maintain the GnuPG authentication subkey solely on the Trezor for use with SSH via the Trezor agent. Thus keeping it strongly secured. At the same time and of equal importance, a Trezor generated paired public GnuPG authentication subkey is to be produced, facilitating updates for authentication key expiration and revocation certificate via a trezor or non-trezor primary key.