GitHub API OpenPGP Key Format

Question

What is the format of the public_key field returned from the GitHub REST API v3 for GPG keys ?

For example, the command curl -v -H "Accept: application/vnd.github.cryptographer-preview" https://api.github.com/users/DurandA/gpg_keys returns the following keys:

 pub dsa2048/403094DF 2017-09-03 [SC] [expires: 2018-09-03] uid [ultimate] Arnaud Durand < [e-mail] > sub elg2048/A454F414 2017-09-03 [E] [expires: 2018-09-03] 

According to the doc API :

The data returned in the public_key response public_key is not a GPG key. When the user downloads the GPG key, it is parsed and the cryptographic public key is retrieved and stored. This cryptographic key is what the API returns on this page. This key is not suitable for direct use by programs such as GPG.

Can I use these keys from the CLI or programmatically?

Answer 1

The returned key is a bare (RSA, DSA, ...) key that cannot be used when implementing OpenPGP without "transferring" it to the correct OpenPGP key package. I would not recommend doing this, why you can create a key package again, you will have no chance to build binding signatures for subkeys and user IDs (this requires access to private keys), and this will fail and will not build something useful for this.

The “OpenPGP model” for community key exchange retrieves the current copy from the key server network (including all current certificates and reconnaissance) instead of relying on possibly obsolete versions in “third-party locations” such as GitHub. This is possible by fingerprints and key identifiers, which (more or less unambiguously, see below) indicate specific keys - they do not look for mail addresses, everyone can create keys with arbitrary user identifiers, and key servers do not perform any verification.

Instead, take a look at the API output, which returns keyid objects for all keys (some for the subkey):

 [ { "id": 3, "primary_key_id": null, "key_id": "3262EFF25BA0D270", "public_key": "xsBNBFayYZ...", "emails": [ { "email": " [e-mail] ", "verified": true } ], [snip] } ] 

To use such a key identifier, run gpg --recv-keys <key-id> . And uncheck GitHub to follow best practices and include full fingerprint:

These 64-bit hexadecimal values ​​( 3262EFF25BA0D270 in this example) are identifiers of a long key. Although any softkey links should always include a key fingerprint and not abbreviated key identifiers , at least they do not provide a short key identifiers that are severely affected by collision attacks .