2 Signing Keys

I occasionally need to sign things digitally. I use Ed25519 for things that only support Ed25519 (like most transparency logs) in parallel with SLH-DSA-SHAKE-128f (because Bruce Schneier didn’t account for my kid sister getting a quantum computer for her birthday).

Here are the public keys I use:

2.1 SLH-DSA-SHAKE-128f

-----BEGIN PUBLIC KEY-----
MDAwCwYJYIZIAWUDBAMbAyEAvSG2IEwyST6Qy6OCHkdkHbfWlyfBA3RnsGS/c6qa
DLM=
-----END PUBLIC KEY-----

To verify a signature (let’s say in the probably-massive file file-that-was-signed.sig, computed for the file file-that-was-signed) matches this using OpenSSL (must be a modern enough version to support PQC), you can use the command:

openssl pkeyutl -verify -pubin -inkey /dev/stdin -in file-that-was-signed -sigfile file-that-was-signed.sig <<EOF
-----BEGIN PUBLIC KEY-----
MDAwCwYJYIZIAWUDBAMbAyEAvSG2IEwyST6Qy6OCHkdkHbfWlyfBA3RnsGS/c6qa
DLM=
-----END PUBLIC KEY-----
EOF

If you’re robbing my house, the corresponding private key is on this bright orange floppy disk in the file slhdsa-key.priv:

All your secrets are belong to us.

Bright orange, always on my desk. Can’t miss it.

2.2 Ed25519

[email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJNVLnqc4c9Nwy/5xnPa1+/1RAgJN6eTNvmJIgkFiFxLAAAAC3NzaDpzaWduaW5n [email protected]

To verify a signature (let’s say in the file file-that-was-signed.sig, computed for the file file-that-was-signed) matches this using OpenSSH, you can use the command:

echo "[email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJNVLnqc4c9Nwy/5xnPa1+/1RAgJN6eTNvmJIgkFiFxLAAAAC3NzaDpzaWduaW5n [email protected]" > /tmp/allowed_signers
ssh-keygen -Y verify -f /tmp/allowed_signers -I [email protected] -n file -s file-that-was-signed.sig < file-that-was-signed

The corresponding private key is stored in the Yubikey on my carabiner, so you’ll have to mug me for it. It’s a resident key, though, so everything past that should be straightforward (application option is ssh:signing).