title: OpenPGP/X.509 bridge: how to verify public key?
body: <p>I'd like to use <a href="https://www.rfc-editor.org/rfc/rfc6091" rel="nofollow noreferrer">OpenPGP authentication over TLS</a>, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate.</p>
  <p>The approach is very similar to the approach used in Foaf:<br />
  <a href="https://svn.java.net/svn/sommer%7Esvn/trunk/misc/FoafServer/pgpx509/src/net/java/dev/sommer/foafserver/utils/PgpX509Bridge.java" rel="nofollow noreferrer">https://svn.java.net/svn/sommer~svn/trunk/misc/FoafServer/pgpx509/src/net/java/dev/sommer/foafserver/utils/PgpX509Bridge.java</a></p>
  <blockquote>
  <p>Basically, you create a certificate request starting from a converted PGP private key, including your converted PGP public key into the certificate request. Then you sign the request with your converted PGP private key.</p>
  </blockquote>
  <p>I'm using the word &quot;<em>converted</em>&quot; because OpenPGP and OpenSSL key formats are incompatible: I have to extract the key parameters from the OpenPGP key and use them to form a new X.509-compatible (OpenSSL) key. Nevertheless, it works as expected.</p>
  <p>The result is a X.509 certificate with the PGP public key parameters used in the public key of the X.509 certificate, but <strong>without the user IDs and the public key signatures</strong>, thus making it unusable for authentication purposes.</p>
  <p>The missing piece here is server authentication. The server has previously signed the user's PGP public key, but how do I verify that through the X.509 bridge certificate?</p>
  <p>Even if I use my PGP user ID as my CN (Common Name), <strong>how do I certify that it's the same user ID used in the originating OpenPGP key?</strong><br />
  There are no public key signatures on the X.509 bridge certificate, only the same key parameters. Can I safely just check against those?</p>
  <p>Although I have to do this in Python, any suggestions on how to proceed in general would be really helpful.</p>