@ -291,6 +291,7 @@ verify-options show-uid-validity
with-fingerprint
require-cross-certification
no-symkey-cache
armor
use-agent
throw-keyids
```
@ -304,13 +305,13 @@ When creating an identity with GnuPG, the default options ask for a "Real name",
Depending on how you plan to use GnuPG, set these values respectively:
```console
IDENTITY="YubiKey User < yubikey @ example > "
export IDENTITY="YubiKey User < yubikey @ example > "
```
Or use any attribute which will uniquely identity the key (this may be incompatible with certain use cases):
```console
IDENTITY="My Cool YubiKey - 2024"
export IDENTITY="My Cool YubiKey - 2024"
```
## Key
@ -320,7 +321,7 @@ Select the desired algorithm and key size. This guide recommends 4096-bit RSA.
Set the value:
```console
KEY_TYPE=rsa4096
export KEY_TYPE=rsa4096
```
## Expiration
@ -338,13 +339,13 @@ Subkeys must be renewed or rotated using the Certify key - see [Updating Subkeys
Set the expiration date to two years:
```console
EXPIRATION=2y
export EXPIRATION=2y
```
Or set the expiration date to a specific date to schedule maintenace:
```console
EXPIRATION=2026-05-01
export EXPIRATION=2026-05-01
```
## Passphrase
@ -354,9 +355,9 @@ Generate a passphrase for the Certify key. It will be used infrequently to manag
The following commands will generate a strong passphrase and avoid ambiguous characters:
```console
CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
export CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \
cut -c2- | tr " " "-" | head -1) ; echo "$CERTIFY_PASS"
cut -c2- | tr " " "-" | head -1) ; echo "\n $CERTIFY_PASS\n "
```
Write the passphrase in a secure location, ideally separate from the portable storage device used for key material, or memorize it.
@ -385,9 +386,9 @@ gpg --batch --passphrase "$CERTIFY_PASS" \
Set and view the Certify key identifier and fingerprint for use later:
```console
KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }')
export KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }')
KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }')
export KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }')
printf "\nKey ID: %40s\nKey FP: %40s\n\n" "$KEYID" "$KEYFP"
```
@ -494,9 +495,9 @@ Use [LUKS](https://dys2p.com/en/2023-05-luks-security.html) to encrypt the new p
Generate another unique [Passphrase ](#passphrase ) (ideally different from the one used for the Certify key) to protect the encrypted volume:
```console
LUKS_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
export LUKS_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \
cut -c2- | tr " " "-" | head -1) ; echo $LUKS_PASS
cut -c2- | tr " " "-" | head -1) ; echo "\n $LUKS_PASS\n"
```
This passphrase will also be used infrequently to access the Certify key and should be very strong.
@ -703,7 +704,7 @@ Connect YubiKey and confirm its status:
gpg --card-status
```
If the card is locked, [Reset ](#reset ) it.
If the card is locked, [Reset ](#reset -yubikey ) it.
## Change PIN
@ -722,9 +723,9 @@ The *User PIN* must be at least 6 characters and the *Admin PIN* must be at leas
Set PINs manually or generate them, for example a 6 digit User PIN and 8 digit Admin PIN:
```console
ADMIN_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w8 | head -1)
export ADMIN_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w8 | head -1)
USER_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w6 | head -1)
export USER_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w6 | head -1)
printf "\nAdmin PIN: %12s\nUser PIN: %13s\n\n" "$ADMIN_PIN" "$USER_PIN"
```
@ -779,7 +780,7 @@ quit
EOF
```
Run `gpg --card-status` to verify results.
Run `gpg --card-status` to verify results (*Login data* field) .
# Transfer Subkeys
@ -851,7 +852,7 @@ The `>` after a tag indicates the key is stored on a smart card.
Verify you have done the following:
- [ ] Memorized or wrote down the Certify key passphrase to a secure and durable location
- [ ] Memorized or wrote down the Certify key (identity) passphrase to a secure and durable location
* `echo $CERTIFY_PASS` to see it again; [`passphrase.html` ](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html ) or [`passphrase.csv` ](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv ) to transcribe it
- [ ] Memorized or wrote down passphrase to encrypted volume on portable storage
* `echo $LUKS_PASS` to see it again; [`passphrase.html` ](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html ) or [`passphrase.csv` ](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv ) to transcribe it
@ -1774,7 +1775,7 @@ sudo mount /dev/sdc2 /mnt/public
Copy the original private key materials to a temporary working directory:
```console
GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX)
export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX)
cd $GNUPGHOME
@ -1786,9 +1787,9 @@ Confirm the identity is available, set the key id and fingerprint:
```console
gpg -K
KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }')
export KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }')
KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }')
export KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }')
echo $KEYID $KEYFP
```
@ -1796,7 +1797,7 @@ echo $KEYID $KEYFP
Recall the Certify key passphrase and set it, for example:
```console
CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX
export CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX
```
## Renew Subkeys
@ -1804,9 +1805,9 @@ CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX
Determine the updated expiration, for example:
```console
EXPIRATION=2026-09-01
export EXPIRATION=2026-09-01
EXPIRATION=2y
export EXPIRATION=2y
```
Renew the Subkeys:
drduh
2 months ago