From 42b9e98e211638b83935c3ab482fa556478abd5d Mon Sep 17 00:00:00 2001 From: Heiko Schaefer Date: Tue, 21 Nov 2023 10:13:32 +0100 Subject: [PATCH] clarify that "authentication" key flag is not about validating user ids --- book/source/04-certificates.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/book/source/04-certificates.md b/book/source/04-certificates.md index 2ceb0cc..f0220bb 100644 --- a/book/source/04-certificates.md +++ b/book/source/04-certificates.md @@ -190,7 +190,9 @@ Commonly used key flags include: - **Certification**: enables issuing third-party certifications - **Signing**: allows the key to sign data - **Encryption**: allows the key to encrypt data -- **Authentication**: primarily used for SSH authentication +- **Authentication**: primarily used for SSH authentication[^auth-flag] + +[^auth-flag]: Note that the capability offered by the [authentication](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-authentication-via-digital-) key flag is unrelated to "authentication" in the context of certifying and verifying OpenPGP identities and their connection to certificates. This key flag is about a mechanism that proves control of private key material to a remote system, using cryptographic signatures. ```{note} Distinct component keys handle specific operations. Only the primary key can be used for certification, although it can have additional capabilities. Subkeys can be used for signing, encryption, and authentication but cannot have the certification capability. It is considered good practice, however, to [use separate keys for each capability](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-10.1.5-7).