Sign GnuPG master key with own X.509 certificate?

Question

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust?

To be more specific:

1. Can I use my X.509 certificate to sign my personal GnuPG master key?
2. Will recipients be able to use the CA's certificates to verify that the public key is indeed mine?
3. How does this compare to current web of trust expansion methods such as the key signing party when it comes to the trustworthiness and authenticity of my public key?
4. Would this provide enough security for someone who doesn't know me personally to sign my master key?

---

When researching this topic, I came across this page about key signing policy:

Signing PGP keys with X.509 certificates

While a certificate from a CA is no real basis for trust in a PGP key, it may serve as a reasonable substitute when no other options are available.

Why would a signature from a national certificate authority not make a published key trustworthy?

My country implements a public key infrastructure around the PKCS #7 and X.509 standards. Their process is as follows:

• CAs meet cryptographical requirements and get their keys signed by the government.
• Users pay a fee to verify their identity with and get a digital certificate issued by the CA.
• Certificates are issued most often as smart cards and enable legally-binding digital signatures.

It seems to me that the CA is equivalent to a person in the web of trust whose signatures can be fully trusted, as per the GnuPG documentation:

The owner has an excellent understanding of key signing, and his signature on a key would be as good as your own.

If my key can indeed be signed by such a certificate, how can a recipient of my public key not be sure it is mine, given that my identity has been personally and rather thoroughly verified by the CA?

---

Related Information Security.SE questions I found:

• Cross-certification between worlds like X.509 and PGP?

  The trust systems of OpenPGP (web of trust) and X.509 (hierarchical) are not compatible, nor are the signatures

• Is is typical to create both x509 and OpenPGP key pairs?

  An X.509 certificate, or a signed OpenPGP public key (same concept)

There seems to be a lot of conflicting information in a lot of different places. If a signed OpenPGP or GnuPG public key is the same thing as a X.509 certificate, how can the signatures be incompatible? Also the trust systems seem to be analogous to one another, save for the amount of bureaucracy involved.

Answer 1

Can I use my X.509 certificate to sign my personal GnuPG master key?

Technically, yes, you could use the private key associated with your certificate to sign the X.509 public key, as a statement of authenticity from the X.509 cert. However, I suspect you're really asking "is there an existing integrated implementation of this which is ready to be used?", and the answer to that (as far as I'm aware) is no.

Will recipients be able to use the CA's certificates to verify that the public key is indeed mine?

Assuming you're talking about using the CA certs to verify that the PGP public key is yours, no. You have to distribute the public part of your X.509 certificate (what we would typically just call "the certificate" - the private part is usually called "the key") to all clients who want to use it to verify anything. In SSL/TLS, this distribution happens at the start of the connection, after the ServerHello packet is sent - the server directly provides the client with its certificate. In your case, you'd have to work out some way of distributing your certificate to people. You'd also need to be able to distribute the signatures, which wouldn't be attached to the PGP keys themselves (although you could likely jury-rig the signatures into the same extensions that WoT implementations use).

How does this compare to current web of trust expansion methods such as the key signing party when it comes to the trustworthiness and authenticity of my public key?

It's more cumbersome, lacks a real implementation, and merges two ecosystems that are designed to be separate. Web of trust allows other users to sign your public key with their private key, and publish those signatures.

As a scenario, imagine that Alice and Bob live in the same town, but I moved away and can no longer come visit. We all talk over email, signed with PGP. Before I moved, we all got together and exchanged public keys in person. Alice has just suffered a disk failure and didn't make a backup, so she has lost her keypair. She creates a new keypair, but I don't have a way of validating it. However, I trust Bob. He signs her public key with his private key, and distributes that signature. I can then trust Alice's signature by proxy, without ever validating it myself.

Introducing X.509 into this is painful. The certificate distribution alone is a major headache. If the CA goes rogue, they can issue arbitrary CAs and start socially engineering people into accepting new cross-signed keys. The other problem with an automated approach to key distribution is that it only takes one CA to go rogue - this is currently the case with PKI (especially HTTPS) and it's a major problem that we don't have strong solutions for (aside from certificate pinning).

Would this provide enough security for someone who doesn't know me personally to sign my master key?

That's subjective. My personal answer would be no, because I don't trust the CAs to be foolproof. It makes a certain amount of sense to use web-of-trust within the PGP ecosystem itself, because the sphere of influence is each person's system, key changes are infrequent, and the system is designed from the ground up to work with email. Introducing X.509 and PKI just turns everything into a mess, and moves the sphere of influence out to third-party CAs.