OpenPGP Key Support

Overview

Implementation of OpenPGP key storage and related encryption features.

Short feature list:

• PGP Public Key Storage
• escrow for PGP backup keys and encryption keys
• support for PGP keys generated by hardware tokens
• basic keyserver functionality

Use Cases

• The administrator or the user registers a public PGP key into IPA, associated with a user account. The registration process validates the public key in case of erroneous input.
• The user can register a private PGP key into IPA, associated with a user account and inaccessible to parties excluding the user the key is associated with.
• The user can use a registered private PGP key associated with their account to sign certificates and binaries.
• The administrator or the user can enroll a hardware token, creating a public and a private key associated with a user.

How to Use

Registering Public PGP Key

• The administrator or the user provides a public PGP key to be associated with a user account. This can be done as a part of user account creation or after as an addition to an existing account.
• User accounts may have multiple public PGP keys associated with them.

Registering Private PGP Key

• The user provides a private key to be associated with a user account.

Enrolling Hardware Token

• The administrator or the user can enroll a hardware token, generating a public and private key associated with a user account.

Design

dn: cn=schema
attributeTypes: (1.3.6.1.4.1.3401.8.2.11 NAME 'pgpKey' DESC 'OpenPGP public key block' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE)

objectClasses: (1.3.6.1.4.1.3401.8.2.25 NAME 'ipaPgpGroupOfPubKeys' ABSTRACT MAY pgpKey)
objectClasses: (1.3.6.1.4.1.3401.8.2.26 NAME 'ipaPgpUser' SUP ipaPgpGroupOfPubKeys AUXILIARY)

Implementation

This feature does not require any new dependencies or any new files in Backup and Restore.

Feature Management

UI

This feature adds a multi-valued PGP key field to user management pages, similar to how SSH keys are presented and managed through the UI.

CLI

Additional flags added to some of the user-* subcommands and new commands are necessary to allow for signing and enrolling hardware tokens.

Configuration

KRA must be setup for PGP private key storage, escrow, and recovery.

Test plan

Test scenarios that will be transformed to test cases for FreeIPA Continuous Integration during implementation or review phase. This can be also link to source in pagure with the test, if appropriate.

• Key is valid and parsed correctly
• Key is invalid, raising a ValueError
• Key is invalid,
• Key is changed by a user with proper permissions, operation succeeds
• Key is changed by a user without the proper permissions, operation fails

Troubleshooting and debugging

This feature creates LDAP entries to store OpenPGP public keys.