Sops: Adding support for ssh keys for encryption.

Created on 9 Jul 2020 · 4Comments · Source: mozilla/sops

SSH keys could be also used for encryption. They are already in well-known locations i.e. /etc/ssh/ssh_host_rsa_key. Most developer/servers have already ssh keys.
Since most users also have ways of trusting those ssh keys (TOFU, DNS, hosters like github/gitlab or certificates) importing them should be easy. For my project I am thinking about converting ssh keys to gpg keys. However it would be probably also beneficial for sops itself to have this supported out-of-the box. I think usability of ssh-keygen over gpg is out of question.

Source

Mic92

👍3

Most helpful comment

I agree with the initial request of using SSH keys for encryption, and #688 will give us that because age supports ssh keys.

The PGP key storage format is an abomination and it would be a mistake to add more complexity. Ultimately, we need to steer people away from PGP entirely.

jvehent on 9 Jul 2020

👍3

All 4 comments

Here is some boilercode to convert ssh keys to gpg: https://gist.github.com/Mic92/24c40996cd97cb8edd53fd688c60ab6f

Mic92 on 9 Jul 2020

I agree with the initial request of using SSH keys for encryption, and #688 will give us that because age supports ssh keys.

The PGP key storage format is an abomination and it would be a mistake to add more complexity. Ultimately, we need to steer people away from PGP entirely.

jvehent on 9 Jul 2020

👍3

@jvehent unfortunately, #688 missing ssh keys supports