Skip to content

Instantly share code, notes, and snippets.

@dapithor

dapithor/gpg-offline-master.md

Forked from abeluck/gpg-offline-master.md
Created December 9, 2015 01:24
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dapithor/f0fa8f0e65055ebc9720 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dapithor/f0fa8f0e65055ebc9720 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @abeluck abeluck renamed this gist Aug 9, 2013. 1 changed file with 0 additions and 0 deletions.
    0 cmd.md → gpg-offline-master.md
    View file
    File renamed without changes.
  2. @peebs peebs revised this gist Oct 17, 2012. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -463,6 +463,7 @@ Reboot into your main machine. Insert the usb key from above.
    The secret key should say *sec#* instead of sec.

    Mark your master key as ultimately trusted:

    $ gpg --edit-key <UID or KeyID>
    >gpg trust
    Your Decision? 5
  3. @peebs peebs revised this gist Oct 17, 2012. 1 changed file with 6 additions and 1 deletion.
    7 changes: 6 additions & 1 deletion cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -313,7 +313,7 @@ Export the secret keys for your subkeys (does **NOT** include master secret key)

    $ gpg -a --export-secret-subkeys > sub-secret-keys.gpg

    ## Create Ork-Guarded Backups ##
    ## Save Backups ##

    Backup the following to the super-safe USB stick that is *never* plugged in to an online machine. Store this USB stick in your ork guarded vault:

    @@ -462,6 +462,11 @@ Reboot into your main machine. Insert the usb key from above.

    The secret key should say *sec#* instead of sec.

    Mark your master key as ultimately trusted:
    $ gpg --edit-key <UID or KeyID>
    >gpg trust
    Your Decision? 5

    ## Using the smart card without root ##

    You may want to use gpg from your user account on your local computer. If the pcscd package is installed you just need to add your user to the group pcscd.
  4. @peebs peebs revised this gist Aug 25, 2012. 1 changed file with 43 additions and 16 deletions.
    59 changes: 43 additions & 16 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -12,6 +12,18 @@ offline and while subkeys on an OpenPGP smart card. OpenPGP cards can be
    purchased at kernelconcepts.de. More information can be found at:
    http://g10code.com/p-card.html

    Tails live privacy enhanced version of debian runs as a live CD or USB. This
    guide will assume you are using this. It currently lacks the necessary packages
    to use the smart cards so we will have to manually ferry those Debian packages
    to Tails. Abel on Github who I forked this Gist from is working on a customized
    version of Tails called 'Clean Room' that will include the necessary software
    and forcibly keep you offline. This guide will be updated to reflect that. Clean
    Room will also automate many of these tasks, but this guide will preserve all
    the information needed to do so manually. This will ensure you have to building
    blocks to manage your keys as you see fit. You might not have a PGP smartcard,
    but want to ensure you manage a offline master key for example The important
    principle is that you keep your master key offline.

    # Requirements #

    * Bootable offline cd with gpg: http://tails.boum.org
    @@ -27,19 +39,17 @@ http://g10code.com/p-card.html

    ## Setting up a Secure Environment ##

    Tails is a good choice to use as a live bootable Linux distribution that will be kept offline. This guide will assume you are using this. It currently lacks the necessary packages to use the smart cards so we will have to manually ferry those Debian packages to Tails. Abel on Github who I forked this Gist from is working on a customized version of Tails called 'Clean Room' that will include the necessary software and forcibly keep you offline. This guide will be updated to reflect that. Clean Room will also automate many of these tasks, but this guide will preserve all the information needed to do so manually. This gives you the building blocks to manage your keys as you need.

    First, download tails from https://tails.boum.org/. Make sure to verify the iso image. Either burn it to a CD or USB drive. Instuctions for manually install to a usb are found at https://tails.boum.org/doc/first_steps/manual_usb_installation/index.en.html
    First, download tails from https://tails.boum.org/. Make sure to verify the iso image. Either burn it to a CD or USB drive. Instuctions for manually installing to a usb are found at https://tails.boum.org/doc/first_steps/manual_usb_installation/index.en.html

    If you are using Linux to create a live USB then:

    `apt-get install syslinux`
    `isohybrid [tails.iso] --entry 4 --type 0x1c`
    `cat [tails.iso] > [device] && sync`

    ## Setup ##
    ## Installing Smart Card Drivers ##

    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) and put them on your usb, so you can install them on the livecd.
    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) from your work computer and place them on a USB so that you can transfer them to your live CD.

    Specifically, I have found it necessary to manually download these .deb files from the wheezy release of Debian:

    @@ -50,11 +60,24 @@ Specifically, I have found it necessary to manually download these .deb files fr
    * libccid_1.4.7-1_i386.deb (http://packages.debian.org/wheezy/libccid)
    * pcscd_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/pcscd)

    Install using `dpkg -i filename.deb` and in the order listed above. May have to use `--auto-deconfigure` for libc6 package. Tested on Tails 12.1. In the future Tails may support the smart card by default. See https://mailman.boum.org/pipermail/tails-dev/2012-January/000779.html and https://tails.boum.org/todo/support_OpenPGP_smartcards/.
    Download these and place on one of the USB drives

    In the future Tails may support the smart card by default. See https://mailman.boum.org/pipermail/tails-dev/2012-January/000779.html and https://tails.boum.org/todo/support_OpenPGP_smartcards/.

    ## Go offline ##

    Reboot into the livecd, then disable the network. Install the smartcard packages.
    Reboot into the livecd, then disable the network. Install the smartcard packages from the USB drive.

    Install using `dpkg -i filename.deb` and in the order listed above. May have to use `--auto-deconfigure` for libc6 package. Tested on Tails 12.1. You can use this script as well:

    #/bin/bash
    #Requires root! ('sudo su')
    dpkg -i libc-bin_2.13-35_i386.deb
    dpkg -i --auto-deconfigure libc6_2.13-35_i386.deb
    dpkg -i multiarch-support_2.13-35_i386.deb
    dpkg -i libpcsclite1_1.8.4-1_i386.deb
    dpkg -i libccid_1.4.7-1_i386.deb
    dpkg -i pcscd_1.8.4-1_i386.deb

    ## Generate Master Key ##

    @@ -244,15 +267,19 @@ First we add the signing subkey, then the encryption subkey. Both are 3072 bits.
    gpg> save

    ## Setup uids ##
    UIDs can be added or deleted at any point in time. Just edit the key ID of your master key from Tails (the only time you should have access to your master key).

    $ gpg --edit-key 5AD20E1D
    gpg> adduid

    For any additional ids needed.
    If you type help at the `gpg>` prompt you can see other commands that let you perform other actions such as deleting uids.

    ## Edit card content ##

    `gpg --card-edit`

    If you run this you will

    Afterwards, your card content should look similar to this:

    $ gpg --card-status
    @@ -276,7 +303,7 @@ Afterwards, your card content should look similar to this:
    Authentication key: [none]
    General key info..: [none]

    ## Export Keys ##
    ## Create Backups ##

    Export the secret key for your identity key:

    @@ -292,16 +319,12 @@ Backup the following to the super-safe USB stick that is *never* plugged in to a

    1. `master-secret-key.gpg` - copy of your master secret key
    2. `sub-secret-keys.gpg` - copy of your secret sub keys
    2. `~/.gnupg` - your entire keyring. It will be used as the GNUPGHOME for future subkeys.
    3. `~/.gnupg` - your entire keyring. It will be used as the GNUPGHOME for future subkeys.

    ## Move the subkeys to the card ##

    Now we will transfer the subkeys generated before to the smartcard. The existing secret keys will be replaced by stubs. If your card gets damaged, you can repeat that step by simply using the backup we brought to the Orks.

    Currently you need root to properly access the smartcard. This will change in the future by making sure your user is added to the pcscd group. For now just copy the contents of your .gnupg folder in your home directory to the root directory. Then `sudo su` for the next steps before copying your subkeys to the smart card.

    `cp /home/amnesia/.gnupg/* /root/.gnupg/`

    The following was copy/pasted from the FSFE article, which uses a smaller key size. What we're doing here is selecting the encryption and signing subkeys and moving them to the card.

    You can tell which subkey is which by looking at the `usage: X`, where `X` is `S` for signing or `E` for encryption.
    @@ -407,13 +430,13 @@ After this is done, your secret-subkeys will only exist:

    Command> save

    ## Create Backups ##
    ## Export Stubs and Public Key ##

    Export the public key for your identity key:

    $ gpg -a --export 5AD20E1D > pub-key.gpg
    Export the secret key *stubs* for your subkeys (doesn't include the actual secret keys):
    Export the secret key *stubs* for your subkeys. This doesn't include the actual secret keys since they were moved to the smart card, but act as a pointer of sorts to your smartcard. When you import this and your public key to your work computer gnupg will know to look on your smart card when it needs to access one of your private subkeys.

    $ gpg -a --export-secret-subkeys > sub-key-stubs.gpg

    @@ -439,6 +462,10 @@ Reboot into your main machine. Insert the usb key from above.

    The secret key should say *sec#* instead of sec.

    ## Using the smart card without root ##

    You may want to use gpg from your user account on your local computer. If the pcscd package is installed you just need to add your user to the group pcscd.

    # TODO #

    * Signing new subkeys.
  5. @peebs peebs revised this gist Aug 24, 2012. 1 changed file with 7 additions and 3 deletions.
    10 changes: 7 additions & 3 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -33,9 +33,9 @@ First, download tails from https://tails.boum.org/. Make sure to verify the iso

    If you are using Linux to create a live USB then:

    `apt-get install syslinux`
    `isohybrid [tails.iso] --entry 4 --type 0x1c`
    `cat [tails.iso] > [device] && sync`
    `apt-get install syslinux`
    `isohybrid [tails.iso] --entry 4 --type 0x1c`
    `cat [tails.iso] > [device] && sync`

    ## Setup ##

    @@ -298,6 +298,10 @@ Backup the following to the super-safe USB stick that is *never* plugged in to a

    Now we will transfer the subkeys generated before to the smartcard. The existing secret keys will be replaced by stubs. If your card gets damaged, you can repeat that step by simply using the backup we brought to the Orks.

    Currently you need root to properly access the smartcard. This will change in the future by making sure your user is added to the pcscd group. For now just copy the contents of your .gnupg folder in your home directory to the root directory. Then `sudo su` for the next steps before copying your subkeys to the smart card.

    `cp /home/amnesia/.gnupg/* /root/.gnupg/`

    The following was copy/pasted from the FSFE article, which uses a smaller key size. What we're doing here is selecting the encryption and signing subkeys and moving them to the card.

    You can tell which subkey is which by looking at the `usage: X`, where `X` is `S` for signing or `E` for encryption.
  6. @peebs peebs revised this gist Aug 24, 2012. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -33,9 +33,9 @@ First, download tails from https://tails.boum.org/. Make sure to verify the iso

    If you are using Linux to create a live USB then:

    `apt-get install syslinux
    isohybrid [tails.iso] --entry 4 --type 0x1c
    cat [tails.iso] > [device] && sync`
    `apt-get install syslinux`
    `isohybrid [tails.iso] --entry 4 --type 0x1c`
    `cat [tails.iso] > [device] && sync`

    ## Setup ##

  7. @peebs peebs revised this gist Aug 24, 2012. 1 changed file with 12 additions and 0 deletions.
    12 changes: 12 additions & 0 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -25,6 +25,18 @@ http://g10code.com/p-card.html

    # Initial Commands #

    ## Setting up a Secure Environment ##

    Tails is a good choice to use as a live bootable Linux distribution that will be kept offline. This guide will assume you are using this. It currently lacks the necessary packages to use the smart cards so we will have to manually ferry those Debian packages to Tails. Abel on Github who I forked this Gist from is working on a customized version of Tails called 'Clean Room' that will include the necessary software and forcibly keep you offline. This guide will be updated to reflect that. Clean Room will also automate many of these tasks, but this guide will preserve all the information needed to do so manually. This gives you the building blocks to manage your keys as you need.

    First, download tails from https://tails.boum.org/. Make sure to verify the iso image. Either burn it to a CD or USB drive. Instuctions for manually install to a usb are found at https://tails.boum.org/doc/first_steps/manual_usb_installation/index.en.html

    If you are using Linux to create a live USB then:

    `apt-get install syslinux
    isohybrid [tails.iso] --entry 4 --type 0x1c
    cat [tails.iso] > [device] && sync`

    ## Setup ##

    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) and put them on your usb, so you can install them on the livecd.
  8. @peebs peebs revised this gist Aug 23, 2012. 1 changed file with 7 additions and 1 deletion.
    8 changes: 7 additions & 1 deletion cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,6 +6,12 @@ This is a local copy of the commands from:
    * http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys
    * http://wiki.fsfe.org/Card_howtos/Card_with_subkeys_using_backups/

    This guide serves as a reference of collected information necessary for strict
    management of PGP keys. This includes keeping a master key that always remains
    offline and while subkeys on an OpenPGP smart card. OpenPGP cards can be
    purchased at kernelconcepts.de. More information can be found at:
    http://g10code.com/p-card.html

    # Requirements #

    * Bootable offline cd with gpg: http://tails.boum.org
    @@ -423,4 +429,4 @@ The secret key should say *sec#* instead of sec.
    * Signing other peoples keys.
    * Figure out importing signatures.
    * Generate and backup revocation certificate
    gpg --output revoke.asc --gen-revoke KEYNAME?
    gpg --output revoke.asc --gen-revoke KEYNAME?
  9. @peebs peebs revised this gist Aug 23, 2012. 1 changed file with 8 additions and 8 deletions.
    16 changes: 8 additions & 8 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -25,14 +25,14 @@ Install the smartcard driver and daemon packages: `apt-get install libccid pcscd

    Specifically, I have found it necessary to manually download these .deb files from the wheezy release of Debian:

    *libc-bin_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc-bin)
    *libc6_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc6)
    *multiarch-support_2.13-35_i386.deb (http://packages.debian.org/wheezy/multiarch-support)
    *libpcsclite1_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/libpcsclite1)
    *libccid_1.4.7-1_i386.deb (http://packages.debian.org/wheezy/libccid)
    *pcscd_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/pcscd)

    Install using 'dpkg -i filename.deb' and in the order listed above. May have to use '--auto-deconfigure' for libc6 package. Tested on Tails 12.1. In the future Tails may support the smart card by default. See https://mailman.boum.org/pipermail/tails-dev/2012-January/000779.html and https://tails.boum.org/todo/support_OpenPGP_smartcards/.
    * libc-bin_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc-bin)
    * libc6_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc6)
    * multiarch-support_2.13-35_i386.deb (http://packages.debian.org/wheezy/multiarch-support)
    * libpcsclite1_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/libpcsclite1)
    * libccid_1.4.7-1_i386.deb (http://packages.debian.org/wheezy/libccid)
    * pcscd_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/pcscd)

    Install using `dpkg -i filename.deb` and in the order listed above. May have to use `--auto-deconfigure` for libc6 package. Tested on Tails 12.1. In the future Tails may support the smart card by default. See https://mailman.boum.org/pipermail/tails-dev/2012-January/000779.html and https://tails.boum.org/todo/support_OpenPGP_smartcards/.

    ## Go offline ##

  10. @peebs peebs revised this gist Aug 23, 2012. 1 changed file with 12 additions and 1 deletion.
    13 changes: 12 additions & 1 deletion cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -21,7 +21,18 @@ This is a local copy of the commands from:

    ## Setup ##

    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) and put them on your usb, so you can install them on the livecd.
    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) and put them on your usb, so you can install them on the livecd.

    Specifically, I have found it necessary to manually download these .deb files from the wheezy release of Debian:

    *libc-bin_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc-bin)
    *libc6_2.13-35_i386.deb (http://packages.debian.org/wheezy/libc6)
    *multiarch-support_2.13-35_i386.deb (http://packages.debian.org/wheezy/multiarch-support)
    *libpcsclite1_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/libpcsclite1)
    *libccid_1.4.7-1_i386.deb (http://packages.debian.org/wheezy/libccid)
    *pcscd_1.8.4-1_i386.deb (http://packages.debian.org/wheezy/pcscd)

    Install using 'dpkg -i filename.deb' and in the order listed above. May have to use '--auto-deconfigure' for libc6 package. Tested on Tails 12.1. In the future Tails may support the smart card by default. See https://mailman.boum.org/pipermail/tails-dev/2012-January/000779.html and https://tails.boum.org/todo/support_OpenPGP_smartcards/.

    ## Go offline ##

  11. @abeluck abeluck revised this gist Aug 18, 2012. 1 changed file with 197 additions and 20 deletions.
    217 changes: 197 additions & 20 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,17 +4,35 @@ This is a local copy of the commands from:

    * http://www.jmknoble.net/keys/#master-key
    * http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys
    * http://wiki.fsfe.org/Card_howtos/Card_with_subkeys_using_backups/

    # Requirements #

    * Bootable offline cd with gpg: http://tails.boum.org
    * OpenPGP smartcard
    * a card reader
    * your PIN
    * your Admin PIN
    * **TWO USB sticks**
    * one for master key backup
    * one to shuttle drivers, subkeys, and public keys between offline computer and your main computer.

    # Initial Commands #

    ## Setup ##

    Install the smartcard driver and daemon packages: `apt-get install libccid pcscd`. You'll need to download the debs (`apt-get download`) and put them on your usb, so you can install them on the livecd.

    ## Go offline ##

    Reboot into the livecd, then disable the network. Install the smartcard packages.

    ## Generate Master Key ##

    I choose 5 years for the master key, and 1 year for subkeys. They can be
    extended any time later, so I feel these are good numbers. Other people
    recommend making the master key never expire.
    I choose no expiration for the master key, and 1 year for subkeys. They can be
    extended any time later.

    We generate the master key using the `--expert` flag to make sure the master key can only "certify" (sign other keys), and not sign or perform encryption.

    $ gpg --expert --gen-key
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    @@ -104,6 +122,8 @@ recommend making the master key never expire.

    ## Generate the sub keys ##

    First we add the signing subkey, then the encryption subkey. Both are 3072 bits.

    $ gpg --edit-key 5AD20E1D
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    @@ -129,8 +149,8 @@ recommend making the master key never expire.
    (6) RSA (encrypt only)
    Your selection? 4
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    What keysize do you want? (2048) 3072
    Requested keysize is 3072 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    @@ -150,7 +170,7 @@ recommend making the master key never expire.

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    sub 3072R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    [ultimate] (1). Kenny MacDermid

    gpg> addkey
    @@ -167,8 +187,8 @@ recommend making the master key never expire.
    (6) RSA (encrypt only)
    Your selection? 6
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    What keysize do you want? (2048) 3072
    Requested keysize is 3072 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    @@ -188,8 +208,8 @@ recommend making the master key never expire.

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    sub 2048R/9B51554C created: 2011-10-07 expires: 2012-10-06 usage: E
    sub 3072R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    sub 3072R/9B51554C created: 2011-10-07 expires: 2012-10-06 usage: E
    [ultimate] (1). Kenny MacDermid

    gpg> save
    @@ -198,27 +218,184 @@ recommend making the master key never expire.
    $ gpg --edit-key 5AD20E1D
    gpg> adduid

    For any ids needed.
    For any additional ids needed.

    ## Edit card content ##

    `gpg --card-edit`

    Afterwards, your card content should look similar to this:

    $ gpg --card-status
    Application ID ...: D2760001240101010001000002290000
    Version ..........: 1.1
    Manufacturer .....: PPC Card Systems
    Serial number ....: 00000229
    Name of cardholder: Test Card User
    Language prefs ...: en
    Sex ..............: male
    URL of public key : http://url.of/publickey.asc
    Login data .......: [not set]
    Private DO 1 .....: [not set]
    Private DO 2 .....: [not set]
    Signature PIN ....: forced
    Max. PIN lengths .: 254 254 254
    PIN retry counter : 3 3 3
    Signature counter : 0
    Signature key ....: [none]
    Encryption key....: [none]
    Authentication key: [none]
    General key info..: [none]

    ## Export Keys ##

    $ gpg -a --export 5AD20E1D >pub.gpg
    $ gpg -a --export-secret-keys >sec.gpg
    $ gpg -a --export-secret-subkeys >sub.gpg
    Export the secret key for your identity key:

    $ gpg -a --export-secret-keys > master-secret-key.gpg

    Export the secret keys for your subkeys (does **NOT** include master secret key):

    $ gpg -a --export-secret-subkeys > sub-secret-keys.gpg

    ## Create Ork-Guarded Backups ##

    Backup the following to the super-safe USB stick that is *never* plugged in to an online machine. Store this USB stick in your ork guarded vault:

    1. `master-secret-key.gpg` - copy of your master secret key
    2. `sub-secret-keys.gpg` - copy of your secret sub keys
    2. `~/.gnupg` - your entire keyring. It will be used as the GNUPGHOME for future subkeys.

    ## Move the subkeys to the card ##

    Now we will transfer the subkeys generated before to the smartcard. The existing secret keys will be replaced by stubs. If your card gets damaged, you can repeat that step by simply using the backup we brought to the Orks.

    The following was copy/pasted from the FSFE article, which uses a smaller key size. What we're doing here is selecting the encryption and signing subkeys and moving them to the card.

    You can tell which subkey is which by looking at the `usage: X`, where `X` is `S` for signing or `E` for encryption.

    After this is done, your secret-subkeys will only exist:
    1. On the smartcard
    2. On the ork-guarded USB stick (in the saved `.gnupg/` and `sub-secret-keys.gpg`)

    $ gpg --edit-key 559C215F
    gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Secret key is available.

    pub 1024D/559C215F created: 2009-05-04 expires: never usage: SC
    trust: ultimate validity: ultimate
    sub 1024R/E1D9B30D created: 2009-05-13 expires: never usage: S
    sub 1024R/EDDA691E created: 2009-05-13 expires: never usage: E
    [ultimate] (1). Martin Gollowitzer (Testing environment) <[email protected]>

    Command> toggle

    sec 1024D/559C215F created: 2009-05-04 expires: never
    ssb 1024R/E1D9B30D created: 2009-05-13 expires: never
    ssb 1024R/EDDA691E created: 2009-05-13 expires: never
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> key 1

    sec 1024D/559C215F created: 2009-05-04 expires: never

    ssb* 1024R/E1D9B30D created: 2009-05-13 expires: never
    ssb 1024R/EDDA691E created: 2009-05-13 expires: never
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> keytocard
    Signature key ....: [none]
    Encryption key....: [none]
    Authentication key: [none]

    Please select where to store the key:
    (1) Signature key
    (3) Authentication key
    Your selection? 1

    You need a passphrase to unlock the secret key for
    user: "Martin Gollowitzer (Testing environment) <[email protected]>"
    1024-bit RSA key, ID E1D9B30D, created 2009-05-13

    gpg: generating new key
    gpg: 3 Admin PIN attempts remaining before card is permanently locked

    Admin PIN

    MAY ASK FOR ADMIN PIN TWICE - this is OK! The first access resizes the key slot
    to 3072 bits, the second actually moves the key.
    sec 1024D/559C215F created: 2009-05-04 expires: never
    ssb* 1024R/E1D9B30D created: 2009-05-13 expires: never
    card-no: 0001 00000229
    ssb 1024R/EDDA691E created: 2009-05-13 expires: never
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> key 1

    sec 1024D/559C215F created: 2009-05-04 expires: never

    ssb 1024R/E1D9B30D created: 2009-05-13 expires: never
    card-no: 0001 00000229
    ssb 1024R/EDDA691E created: 2009-05-13 expires: never
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> key 2

    sec 1024D/559C215F created: 2009-05-04 expires: never
    ssb 1024R/E1D9B30D created: 2009-05-13 expires: never
    card-no: 0001 00000229
    ssb* 1024R/EDDA691E created: 2009-05-13 expires: never
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> keytocard
    Signature key ....: [none]
    Encryption key....: [none]
    Authentication key: [none]

    Please select where to store the key:
    (2) Encryption key
    Your selection? 2

    You need a passphrase to unlock the secret key for
    user: "Martin Gollowitzer (Testing environment) <[email protected]>"
    1024-bit RSA key, ID EDDA691E, created 2009-05-13

    gpg: generating new key

    sec 1024D/559C215F created: 2009-05-04 expires: never
    ssb 1024R/E1D9B30D created: 2009-05-13 expires: never
    card-no: 0001 00000229
    ssb* 1024R/EDDA691E created: 2009-05-13 expires: never
    card-no: 0001 00000229
    (1) Martin Gollowitzer (Testing environment) <[email protected]>

    Command> save

    ## Create Backups ##

    * Backup sec.gpg to a secure location to late sign subkeys
    * Backup all of ~/.gnupg/. It will be used as the GNUPGHOME for future subkeys.
    * Backup pub.gpg and sub.gpg to be imported on main machine
    Export the public key for your identity key:

    $ gpg -a --export 5AD20E1D > pub-key.gpg
    Export the secret key *stubs* for your subkeys (doesn't include the actual secret keys):

    $ gpg -a --export-secret-subkeys > sub-key-stubs.gpg

    Backup `pub-key.gpg` and `sub-key-stubs.gpg` to the other USB stick that you used to transfer the
    drivers. This will be imported on your main machine.

    ## Import keys on main machine ##

    ## Import sub keys (*not master*) ##
    Reboot into your main machine. Insert the usb key from above.

    $ gpg --import pub.gpg
    $ gpg --import pub-key.gpg
    gpg: key 5AD20E1D: public key "Kenny MacDermid" imported
    gpg: Total number processed: 1
    gpg: imported: 1 (RSA: 1)
    $ gpg --import sub.gpg
    $ gpg --import sub-key-stubs.gpg
    gpg: key 5AD20E1D: secret key imported
    gpg: secret keys imported: 1
    $ gpg --list-secret-keys
  12. @KenMacD KenMacD created this gist Oct 7, 2011.
    238 changes: 238 additions & 0 deletions cmd.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,238 @@
    # About #

    This is a local copy of the commands from:

    * http://www.jmknoble.net/keys/#master-key
    * http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys

    # Requirements #

    * Bootable offline cd with gpg: http://tails.boum.org

    # Initial Commands #
    ## Generate Master Key ##

    I choose 5 years for the master key, and 1 year for subkeys. They can be
    extended any time later, so I feel these are good numbers. Other people
    recommend making the master key never expire.

    $ gpg --expert --gen-key
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Please select what kind of key you want:
    (1) RSA and RSA (default)
    (2) DSA and Elgamal
    (3) DSA (sign only)
    (4) RSA (sign only)
    (7) DSA (set your own capabilities)
    (8) RSA (set your own capabilities)
    Your selection? 8

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Sign Certify Encrypt

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? s

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Certify Encrypt

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? e

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Certify

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? q
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048) 4096
    Requested keysize is 4096 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 5y
    Key expires at Tue 4 Oct 22:32:57 2016 ADT
    Is this correct? (y/N)

    You need a user ID to identify your key; the software constructs the user ID
    from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <[email protected]>"

    Real name: Kenny MacDermid
    Email address:
    Comment:
    You selected this USER-ID:
    "Kenny MacDermid"

    Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
    You need a Passphrase to protect your secret key.

    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    .....+++++
    ..............+++++
    gpg: key 5AD20E1D marked as ultimately trusted
    public and secret key created and signed.

    gpg: checking the trustdb
    gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
    gpg: depth: 0 valid: 4 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 4u
    gpg: next trustdb check due at 2012-10-05
    pub 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
    Key fingerprint = 2B85 0108 8296 B9FC 4FB8 AC86 8A4D 4610 5AD2 0E1D
    uid Kenny MacDermid

    ## Generate the sub keys ##

    $ gpg --edit-key 5AD20E1D
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Secret key is available.

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    [ultimate] (1). Kenny MacDermid

    gpg> addkey
    Key is protected.

    You need a passphrase to unlock the secret key for
    user: "Kenny MacDermid"
    4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

    Please select what kind of key you want:
    (3) DSA (sign only)
    (4) RSA (sign only)
    (5) Elgamal (encrypt only)
    (6) RSA (encrypt only)
    Your selection? 4
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 1y
    Key expires at Fri 5 Oct 22:42:39 2012 ADT
    Is this correct? (y/N) y
    Really create? (y/N) y
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    .........+++++
    ............+++++

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    [ultimate] (1). Kenny MacDermid

    gpg> addkey
    Key is protected.

    You need a passphrase to unlock the secret key for
    user: "Kenny MacDermid"
    4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

    Please select what kind of key you want:
    (3) DSA (sign only)
    (4) RSA (sign only)
    (5) Elgamal (encrypt only)
    (6) RSA (encrypt only)
    Your selection? 6
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 1y
    Key expires at Fri 5 Oct 22:43:07 2012 ADT
    Is this correct? (y/N) y
    Really create? (y/N) y
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    ....+++++
    .+++++

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    sub 2048R/9B51554C created: 2011-10-07 expires: 2012-10-06 usage: E
    [ultimate] (1). Kenny MacDermid

    gpg> save

    ## Setup uids ##
    $ gpg --edit-key 5AD20E1D
    gpg> adduid

    For any ids needed.

    ## Export Keys ##

    $ gpg -a --export 5AD20E1D >pub.gpg
    $ gpg -a --export-secret-keys >sec.gpg
    $ gpg -a --export-secret-subkeys >sub.gpg

    ## Create Backups ##

    * Backup sec.gpg to a secure location to late sign subkeys
    * Backup all of ~/.gnupg/. It will be used as the GNUPGHOME for future subkeys.
    * Backup pub.gpg and sub.gpg to be imported on main machine

    ## Import sub keys (*not master*) ##

    $ gpg --import pub.gpg
    gpg: key 5AD20E1D: public key "Kenny MacDermid" imported
    gpg: Total number processed: 1
    gpg: imported: 1 (RSA: 1)
    $ gpg --import sub.gpg
    gpg: key 5AD20E1D: secret key imported
    gpg: secret keys imported: 1
    $ gpg --list-secret-keys
    sec# 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
    uid Kenny MacDermid
    ssb 2048R/8DD8FF1A 2011-10-07
    ssb 2048R/9B51554C 2011-10-07

    The secret key should say *sec#* instead of sec.

    # TODO #

    * Signing new subkeys.
    * Signing other peoples keys.
    * Figure out importing signatures.
    * Generate and backup revocation certificate
    gpg --output revoke.asc --gen-revoke KEYNAME?