Category: Identity

Posted on

Convert a X.509 (PKI) certificate to GPG

I see this question a lot all over the web, and it results in a lot of people saying it can’t be done.  However, this wasn’t the case back when PGP was owned by McAfee and had an official windows client.  Back then it was simply right click on the file and import it.

Heck, you could even create a CSR for your PGP key and have a CA create a signature for it, but only 2 CAs would do it, Thawte (before they were bought out by Verisign) and CAcert.  As far as I know they have both removed this functionality.

PGP.com has gone by the wayside, and many CAs no longer even offer s/mime email certs, which is a shame.  However, as this post will show, PKI and GPG suffer from major usability issues. In fact, the only successful public-key cryptography is https, and that is too hard for most admins to do well. U2F seems to be doing well, but I have GRAVE concerns about its long term security, but I have a bunch of specs to pour over before I make my concerns public.

Earlier this week, I used 2 different providers to get email certificates. One generated a private key for me, and sent it to me via email, along with an email of the password.  As Ben Franklin said “three can keep a secret, if two of them are dead”, because a shared secret really isn’t a secret.  Email isn’t secure, it really never has been, so sending me secrets unencrypted is not really useful.

I need to generate my own secret, and ask for a signature, this is the whole point of a CSR.  In the old days you could tell your browser to generate a certificate using a JavaScript API, apparently that has now been deprecated and only works in Internet Explorer.  Even though this makes sense, because getting true random numbers is hard, it makes for the first pain point in using public-key cryptography.

I finally found a company that would issue me my email certificate using the Sectigo CA, and they “validated my identity” … NOT.  They validated my email, took a copy my drivers license, over unencrypted email. Then never once talked to me in person, never validated that the person who sent the email matched the email etc.  This is to be expected, I guess,  I have mentioned that online identity validation really isn’t, in my previous article.   To generate my own certificate, and have the sign it, I had to use IE, on Windows,  yuck.  Even Microsoft doesn’t want you using IE anymore.

Now I have a certificate, and I wanted to show this import to PGP, so let’s get started.  Gnu Privacy Guard (GPG), is the Linux default for working with PGP. For the purpose of this discussion, GPG, PGP, and OpenPGP are synonymous terms, though PGP was a commercial product, GPG was the Linux product, and OpenPGP is the standard and not really a product at all.

I am using Ubuntu 20.04 (focal). I downloaded kleopatra because it is a nice cross platform GUI for GnuPG, I am only using command line utilities, for the work and using kleopatra to view the results. The pem2openpgp tool is included in monkeysphere.

sudo apt install kleopatra monkeysphere -y

Steps

  • Break the pfx (p12) into pem files that can be used.  For some reason, GPG cant handle standard encoding.

    openssl pkcs12 -in sectigo.pfx -nokeys -out gpg-certs.pem
    openssl pkcs12 -in sectigo.pfx -nocerts -out gpg-key.pem
  •  Combine the keys into something GPG recognizes
    openssl pkcs12 -export -in gpg-certs.pem -inkey gpg-key.pem -out gpg-key.p12
  • Import into GPG
    gpgsm --import gpg-key.p12
  • At this point we have the p12 imported, and we can see it in Kleopatra, but we can’t use it for PGP operations.
    cat gpg-key.pem | PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "Your Name <your@email.address>" > key.pgp
  • Now!!!! we have a pgp key and you import key.pgp into gpg and it will absolutely have the same key ask your certificate.
    gpg --import key.pgp

Now, if pull up kleopatra, you can see that you have a certificate AND a PGP key, if you delete EITHER of them and you delete the private key, you will see that BOTH private keys are removed, because it isn’t 2, but rather a single private key.

Remember to delete all these files, and to use strong passwords.  Ideally you would store these keys on a FIPS compliant smartcard that uses 2 factor authentication.

Posted on

The fallacy of identity verification online.

I have done a lot of work for various companies, dealing in different industries, including financial and insurance. Everyone wants to validate peoples identity for various reasons, HIPPA, Payment Card, or just validating the person is who they claim for signatures.

The assumption I see over and over and over again is, that if the person on the other end of the website knows the answers to the questions based off a credit report, that they are who they claim to be. This assumption is wrong, dead wrong, it has always been wrong, and it has been made all the more so by the Equifax hack.

As if the hack wasn’t bad enough, there are companies out there that collect information about you and sell it. They know WAY more about you than you would like. In many cases companies that coalesce this data, know more about you than you ever imagine. This is why the Lexis Nexis breach was so bad.

So, how can any company that claims to assure identity actually do it? There might be exceptions, but my experience says nobody truly does. The claims of such companies look all the more repugnant when you see the entirety of the “assertion” is based on an entirely automated process, asking questions off a credit report, and how these claims stand up in court is beyond me. All it will take is a single person signing for a house online, through one of these places and all of it will come crashing down like the house of cards that it truly is.

It is hard enough to validate someones identity in person, fake IDs, bribery, notaries not doing their jobs… Honestly, right now, I can’t think of anyone that does a better job of asserting someones identity than corporations, that are involved in heath insurance, do for their employees. Heck, employers do a better job of validating their legitimate employees identity, than most Notaries Public.