Comment on Secure website-authentication using GPG keys

leo.zovic@gmail.com
Tue, 28 Feb 2012 04:12:08 +0000

Some heavy thread-necro action here, but I had to comment given that I'm considering implementing something like this (for a private system, so OpenID doesn't exactly fit).

Steps

Site displays random string/paragraph.

The user copies this string, using: gpg --sign -armour

The user copies the output into a textarea on the site, and submits it.

The site runs gpg --verify on the returned textarea

If it validates, who ever's key it is ("gpg: Good signature from "Bob Smith (Bob) bob@someFakeSite.com") is logged into the site.

You'd be able to cut steps 1 thru 4 by just having the client send a unique value each time. Sign the current time and send it out. On the server side, check that you don't already have the value you were just sent (wipe old ones occasionally if you're too cheap to get more disk, or require the signed values to be successive integers rather than the time), verify the signature and log them in (and store the new value) if it passes. It may get a bit storage intensive if your clients log in very frequently, but it knocks two network hops out of the process, and simplifies it a bit.