From 6c77d5dbe6ddbab63fe8cc2e59da770d7f90564e Mon Sep 17 00:00:00 2001 From: Adam Monsen Date: Sun, 12 Jan 2025 06:43:45 -0800 Subject: [PATCH 01/13] ensure newline is expanded echo from GNU coreutils requires -e to interpret backslash escape sequences without this, the encrypted file contains `\ntest message` --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index fcd054e..4272b34 100644 --- a/README.md +++ b/README.md @@ -1074,7 +1074,7 @@ YubiKey is now ready for use! Encrypt a message to yourself (useful for storing credentials or protecting backups): ```console -echo "\ntest message string" | \ +echo -e "\ntest message string" | \ gpg --encrypt --armor \ --recipient $KEYID --output encrypted.txt ``` From 5d98fdeaba644e055b1bf01cf03e953eae24d10f Mon Sep 17 00:00:00 2001 From: Dennis Triantafyllis Date: Thu, 27 Feb 2025 19:39:12 +0200 Subject: [PATCH 02/13] chore(README): removed double quotes in exporting GPG_TTY env variable --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index fcd054e..863224c 100644 --- a/README.md +++ b/README.md @@ -1416,7 +1416,7 @@ To launch `gpg-agent` for use by SSH, use the `gpg-connect-agent /bye` or `gpgco Add the following to the shell rc file: ```console -export GPG_TTY="$(tty)" +export GPG_TTY=$(tty) export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) gpgconf --launch gpg-agent gpg-connect-agent updatestartuptty /bye > /dev/null From 6d84aae08de941a287e3eebe5979aa49774f2ecf Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 16 Mar 2025 14:07:20 -0700 Subject: [PATCH 03/13] update config urls --- README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 55760a0..922c979 100644 --- a/README.md +++ b/README.md @@ -277,12 +277,12 @@ export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) ## Configuration -Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg.conf): +Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg.conf): ```console cd $GNUPGHOME -wget https://raw.githubusercontent.com/drduh/config/master/gpg.conf +wget https://raw.githubusercontent.com/drduh/config/main/gpg.conf ``` The options will look similar to: @@ -934,12 +934,12 @@ Initialize GnuPG: gpg -k ``` -Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg.conf): +Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg.conf): ```console cd ~/.gnupg -wget https://raw.githubusercontent.com/drduh/config/master/gpg.conf +wget https://raw.githubusercontent.com/drduh/config/main/gpg.conf ``` Set the following option. This avoids the problem where GnuPG will repeatedly prompt for the insertion of an already-inserted YubiKey: @@ -1094,7 +1094,7 @@ echo "test message string" | \ --output encrypted.txt ``` -Use a [shell function](https://github.com/drduh/config/blob/master/zshrc) to make encrypting files easier: +Use a [shell function](https://github.com/drduh/config/blob/main/zshrc) to make encrypting files easier: ```console secret () { @@ -1193,12 +1193,12 @@ YubiKey will blink when it is waiting for a touch. On Linux, [maximbaz/yubikey-t ## SSH -Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg-agent.conf): +Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg-agent.conf): ```console cd ~/.gnupg -wget https://raw.githubusercontent.com/drduh/config/master/gpg-agent.conf +wget https://raw.githubusercontent.com/drduh/config/main/gpg-agent.conf ``` **Important** The `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time. From 992d68d807b9ac656bf61550a5ff702305d5a5c1 Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 16 Mar 2025 14:15:22 -0700 Subject: [PATCH 04/13] shorter temp dir names --- README.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 922c979..3f7f60b 100644 --- a/README.md +++ b/README.md @@ -272,7 +272,7 @@ sudo dnf install \ Create a temporary directory which will be cleared on [reboot](https://en.wikipedia.org/wiki/Tmpfs) and set it as the GnuPG directory: ```console -export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) +export GNUPGHOME=$(mktemp -d -t $(date +%Y.%m.%d)-XXXX) ``` ## Configuration @@ -1849,14 +1849,12 @@ sudo mkdir /mnt/public sudo mount /dev/sdc2 /mnt/public ``` -Copy the original private key materials to a temporary working directory: +Copy the original private key materials (after updating the encrypted storage directory name) to a temporary working directory: ```console -export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) +export GNUPGHOME=$(mktemp -d -t $(date +%Y.%m.%d)-XXXX) -cd $GNUPGHOME - -cp -avi /mnt/encrypted-storage/gnupg-*/* $GNUPGHOME +cp -avi /mnt/encrypted-storage/2025.12.31-AbCd/* $GNUPGHOME/ ``` Confirm the identity is available, set the key id and fingerprint: From 8fadd47f3705145131a4ae27c136637e5bc75445 Mon Sep 17 00:00:00 2001 From: drduh Date: Thu, 3 Apr 2025 18:38:26 -0700 Subject: [PATCH 05/13] refactor passphrase template html --- passphrase.html | 3070 ++++++++++++++++++++++++----------------------- 1 file changed, 1549 insertions(+), 1521 deletions(-) diff --git a/passphrase.html b/passphrase.html index 4833e4b..74515f1 100644 --- a/passphrase.html +++ b/passphrase.html @@ -1,1530 +1,1558 @@ + Save the raw file ^ then open in a browser to render and print --> - - - passphrase - + + + + + credentials + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

DATE (YYYY-MM-DD)


ADMIN


USER

____-__-__


0123456789


0123456789














0123456789


0123456789

KEY_ID


0123456789


0123456789

0 x________


0123456789


0123456789

________


0123456789


0123456789














0123456789


0123456789

SERIAL


0123456789


0123456789


________



0123456789


0123456789





































-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
date (yyyy-mm-dd)admin pinuser pin
2025-__-__01234567890123456789
01234567890123456789
key id01234567890123456789
0x________01234567890123456789
________01234567890123456789
01234567890123456789
serial number01234567890123456789
__________01234567890123456789
for each char in passphrase, mark corresponding column on sequential row, then fold inward and tamper seal
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
From 2529454e113327663f2f8c095c71a88c8b7ed2e2 Mon Sep 17 00:00:00 2001 From: drduh Date: Sat, 5 Apr 2025 13:27:19 -0700 Subject: [PATCH 06/13] passphrase csv format to html --- passphrase.csv | 68 +++++++++++++++++++++++++------------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/passphrase.csv b/passphrase.csv index 1f29c9d..a29c414 100644 --- a/passphrase.csv +++ b/passphrase.csv @@ -1,43 +1,43 @@ # https://github.com/drduh/YubiKey-Guide/blob/master/passphrase.csv - DATE (YYYY-MM-DD) ADMIN USER - ____-__-__ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 + DATE (YYYY-MM-DD) ADMIN PIN USER PIN + 2025-__-__ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 - KEY_ID 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 + KEY ID 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0x________________ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 - SERIAL 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 + SERIAL NUMBER 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 ________ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 +- A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 From 25ab9ee32398e4433b425389e7a7ee06db201ac2 Mon Sep 17 00:00:00 2001 From: drduh Date: Sat, 5 Apr 2025 13:37:07 -0700 Subject: [PATCH 07/13] rename to text file --- README.md | 12 +++++++----- passphrase.csv => passphrase.txt | 7 ++++++- 2 files changed, 13 insertions(+), 6 deletions(-) rename passphrase.csv => passphrase.txt (94%) diff --git a/README.md b/README.md index 3f7f60b..a9eade0 100644 --- a/README.md +++ b/README.md @@ -377,10 +377,12 @@ export CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ Write the passphrase in a secure location, ideally separate from the portable storage device used for key material, or memorize it. -This repository includes a [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) template to help with credential transcription. Save the raw file, open it with a browser and print. Use a pen or permanent marker to select a letter or number on each row for each character in the passphrase. [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) can also be printed without a browser: +This repository includes a [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) template to help with credential transcription. Save the [raw file](https://github.com/drduh/YubiKey-Guide/raw/refs/heads/master/passphrase.html), open in a browser to render and print. + +Mark the corresponding character on sequential rows for each character in the passphrase. [`passphrase.txt`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.txt) can also be printed without a browser: ```console -lp -d Printer-Name passphrase.csv +lp -d Printer-Name passphrase.txt ``` # Create Certify key @@ -912,15 +914,15 @@ The `>` after a tag indicates the key is stored on a smart card. Verify you have done the following: - [ ] Memorized or wrote down the Certify key (identity) passphrase to a secure and durable location - * `echo $CERTIFY_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) to transcribe it + * `echo $CERTIFY_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.txt`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.txt) to transcribe it - [ ] Memorized or wrote down passphrase to encrypted volume on portable storage - * `echo $LUKS_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) to transcribe it + * `echo $LUKS_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.txt`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.txt) to transcribe it - [ ] Saved the Certify key and Subkeys to encrypted portable storage, to be kept offline * At least two backups are recommended, stored at separate locations - [ ] Exported a copy of the public key where is can be easily accessed later * Separate device or non-encrypted partition was used - [ ] Memorized or wrote down the User PIN and Admin PIN, which are unique and changed from default values - * `echo $USER_PIN $ADMIN_PIN` to see them again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) to transcribe them + * `echo $USER_PIN $ADMIN_PIN` to see them again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.txt`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.txt) to transcribe them - [ ] Moved Encryption, Signature and Authentication Subkeys to YubiKey * `gpg -K` shows `ssb>` for each of the 3 Subkeys diff --git a/passphrase.csv b/passphrase.txt similarity index 94% rename from passphrase.csv rename to passphrase.txt index a29c414..2b3dc01 100644 --- a/passphrase.csv +++ b/passphrase.txt @@ -1,6 +1,7 @@ -# https://github.com/drduh/YubiKey-Guide/blob/master/passphrase.csv +# https://github.com/drduh/YubiKey-Guide/blob/master/passphrase.txt DATE (YYYY-MM-DD) ADMIN PIN USER PIN + 2025-__-__ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 KEY ID 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 @@ -10,6 +11,10 @@ ________ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 + FOR EACH CHAR IN PASSPHRASE, + MARK CORRESPONDING COLUMN ON SEQUENTIAL ROW, + THEN FOLD INWARD AND TAMPER SEAL + - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 From 4d205381d58a6fdce4c96c2f7d46dfd0bb65dfc2 Mon Sep 17 00:00:00 2001 From: drduh Date: Sat, 5 Apr 2025 13:56:21 -0700 Subject: [PATCH 08/13] add nist password strength footnote --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a9eade0..2450444 100644 --- a/README.md +++ b/README.md @@ -365,9 +365,11 @@ export EXPIRATION=2026-05-01 ## Passphrase -Generate a passphrase for the Certify key. It will be used infrequently to manage Subkeys and should be very strong. The passphrase is recommended to consist of only uppercase letters and numbers for improved readability. [Diceware](https://secure.research.vt.edu/diceware) is another method for creating memorable passphrases. +Generate a passphrase for the Certify key. This credential will be used infrequently to manage Subkeys and should be very strong. -The following commands will generate a strong passphrase and avoid ambiguous characters: +To improve readability, this guide recommends a passphrase consisting only of uppercase letters and numbers. + +The following commands will generate a strong[^1] passphrase while avoiding certain similar-looking characters: ```console export CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ @@ -385,6 +387,8 @@ Mark the corresponding character on sequential rows for each character in the pa lp -d Printer-Name passphrase.txt ``` +[Diceware](https://secure.research.vt.edu/diceware) is another popular method for creating memorable passphrases. + # Create Certify key The primary key to generate is the Certify key, which is responsible for issuing Subkeys for encryption, signature and authentication operations. @@ -2227,3 +2231,5 @@ EOF * [PGP and SSH keys on a Yubikey NEO (2015)](https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/) * [Offline GnuPG Master Key and Subkeys on YubiKey NEO Smartcard (2014)](https://blog.josefsson.org/2014/06/23/offline-gnupg-master-key-and-subkeys-on-yubikey-neo-smartcard/) * [Creating the perfect GPG keypair (2013)](https://alexcabal.com/creating-the-perfect-gpg-keypair/) + +[^1]: See [issue 477](https://github.com/drduh/YubiKey-Guide/issues/477) for NIST guideline discussion. From 71b4bf106158ac55a737dc4c1428dd373efdef20 Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 6 Apr 2025 14:45:35 -0700 Subject: [PATCH 09/13] use alerts markdown extension --- .gitignore | 1 + README.md | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..63cf315 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.~* diff --git a/README.md b/README.md index 2450444..f67ad55 100644 --- a/README.md +++ b/README.md @@ -160,7 +160,8 @@ Power off, remove internal hard drives and all unnecessary devices, such as the Load the operating system and configure networking. Optional hardening steps related to networking can be found [below](#network-considerations). -**Note** If the screen locks on Debian Live, unlock with `user` / `live` +> [!TIP] +> If the screen locks on Debian Live, unlock with `user` / `live` Open terminal and install required software packages. From c91fe7a97492429c06722bdb533aa42dc707a21b Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 6 Apr 2025 14:50:46 -0700 Subject: [PATCH 10/13] patch notes --- README.md | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index f67ad55..59a84e2 100644 --- a/README.md +++ b/README.md @@ -193,7 +193,8 @@ brew install \ gnupg yubikey-personalization ykman pinentry-mac wget ``` -**Note** An additional Python package dependency may need to be installed to use [`ykman`](https://support.yubico.com/support/solutions/articles/15000012643-yubikey-manager-cli-ykman-user-guide) - `pip install yubikey-manager` +> [!NOTE] +> An additional Python package dependency may need to be installed to use [`ykman`](https://support.yubico.com/support/solutions/articles/15000012643-yubikey-manager-cli-ykman-user-guide) - `pip install yubikey-manager` **NixOS** @@ -312,7 +313,8 @@ use-agent throw-keyids ``` -**Note** Networking can be disabled for the remainder of the setup. +> [!IMPORTANT] +> Networking should be disabled for the remainder of the setup. ## Identity @@ -1168,7 +1170,8 @@ Encryption: ykman openpgp keys set-touch dec on ``` -**Note** Versions of YubiKey Manager before 5.1.0 use `enc` instead of `dec` for encryption: +> [!NOTE] +> YubiKey Manager prior to versions 5.1.0 use `enc` instead of `dec` for encryption: ```console ykman openpgp keys set-touch enc on @@ -1352,7 +1355,7 @@ The goal is to configure SSH client inside WSL work together with the Windows ag See the [WSL agent architecture](media/schema_gpg.png) illustration for an overview. -**Note** GnuPG forwarding for cryptographic operations is not supported. See [vuori/weasel-pageant](https://github.com/vuori/weasel-pageant) for more information. +GnuPG forwarding for cryptographic operations is not supported. See [vuori/weasel-pageant](https://github.com/vuori/weasel-pageant) for more information. One way to forward is just `ssh -A` (still need to eval weasel to setup local ssh-agent), and only relies on OpenSSH. In this track, `ForwardAgent` and `AllowAgentForwarding` in ssh/sshd config may be involved. However, when using ssh socket forwarding, do not enable `ForwardAgent` in ssh config. See [SSH Agent Forwarding](#ssh-agent-forwarding) for more information. This requires Ubuntu 16.04 or newer for WSL and Kleopatra. @@ -1368,7 +1371,7 @@ Edit `~/.ssh/config` to add the following for each agent forwarding host: RemoteForward /tmp/S.weasel-pageant ``` -**Note** The remote SSH socket path can be found with `gpgconf --list-dirs agent-ssh-socket` +The remote SSH socket path can be found with `gpgconf --list-dirs agent-ssh-socket` Add the following to the shell rc file: @@ -1443,7 +1446,8 @@ For `S.gpg-agent.ssh` (see [SSH Agent Forwarding](#ssh-agent-forwarding) for mor ### Copy public key -**Note** It is **not** necessary to import the GnuPG public key in order to use SSH only. +> [!TIP] +> It is **not** necessary to import the GnuPG public key in order to use SSH only. Copy and paste the output from `ssh-add` to the server's `authorized_keys` file: @@ -1575,7 +1579,7 @@ export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh" After sourcing the shell rc file, `ssh-add -l` will return the correct public key. -**Note** In this process no gpg-agent in the remote is involved, hence `gpg-agent.conf` in the remote is of no use. Also pinentry is invoked locally. +In this process no gpg-agent in the remote is involved, hence `gpg-agent.conf` in the remote is of no use. Also pinentry is invoked locally. #### Chained forwarding @@ -1620,8 +1624,6 @@ git config --global gpg.program 'C:\Program Files (x86)\GnuPG\bin\gpg.exe' Then update the repository URL to `git@github.com:USERNAME/repository` -**Note** For the error `gpg: signing failed: No secret key` - run `gpg --card-status` with YubiKey plugged in and try the git command again. - ## GnuPG agent forwarding YubiKey can be used sign git commits and decrypt files on remote hosts with GnuPG Agent Forwarding. To ssh through another network, especially to push to/pull from GitHub using ssh, see [Remote Machines (SSH Agent forwarding)](#ssh-agent-forwarding). @@ -1675,7 +1677,8 @@ pinentry-program /usr/bin/pinentry-gtk-2 extra-socket /run/user/1000/gnupg/S.gpg-agent.extra ``` -**Note** The pinentry program starts on the *local* host, not remote. +> [!IMPORTANT] +> The pinentry program starts on the *local* host, not remote. **Important** Any pinentry program except `pinentry-tty` or `pinentry-curses` may be used. This is because local `gpg-agent` may start headlessly (by systemd without `$GPG_TTY` set locally telling which tty it is on), thus failed to obtain the pin. Errors on the remote may be misleading saying that there is *IO Error*. (Yes, internally there is actually an *IO Error* since it happens when writing to/reading from tty while finding no tty to use, but for end users this is not friendly.) @@ -1695,7 +1698,7 @@ Host third You should change the path according to `gpgconf --list-dirs agent-socket` on *remote* and *third*. -**Note** On *local* you have `S.gpg-agent.extra` whereas on *remote* and *third*, you only have `S.gpg-agent` +On *local* you have `S.gpg-agent.extra` whereas on *remote* and *third*, you only have `S.gpg-agent` ## Using multiple YubiKeys @@ -2045,7 +2048,8 @@ sudo service rng-tools restart ## Enable KDF -**Note** This feature may not be compatible with older GnuPG versions, especially mobile clients. These incompatible clients will not function because the PIN will always be rejected. +> [!IMPORTANT] +> This feature may not be compatible with older GnuPG versions, especially mobile clients. These incompatible clients will not function because the PIN will always be rejected. This step must be completed before changing PINs or moving keys or an error will occur: `gpg: error for setup KDF: Conditions of use not satisfied` From b5ab51d847cfac0b5b29a9ea1fc0ac5e9a27f7e8 Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 6 Apr 2025 14:53:26 -0700 Subject: [PATCH 11/13] patch warning/cautions --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 59a84e2..530df1f 100644 --- a/README.md +++ b/README.md @@ -527,7 +527,8 @@ $ sudo fdisk -l /dev/sdc Disk /dev/sdc: 14.9 GiB, 15931539456 bytes, 31116288 sectors ``` -**Warning** Confirm the destination (`of`) before issuing the following command - it is destructive! This guide uses `/dev/sdc` throughout, but this value may be different on your system. +> [!WARNING] +> Confirm the destination (`of`) before issuing the following command - it is destructive! This guide uses `/dev/sdc` throughout, but this value may be different on your system. Zero the header to prepare for encryption: @@ -824,7 +825,8 @@ EOF Remove and re-insert YubiKey. -**Warning** Three incorrect *User PIN* entries will cause it to become blocked and must be unblocked with either the *Admin PIN* or *Reset Code*. Three incorrect *Admin PIN* or *Reset Code* entries will destroy data on YubiKey. +> [!CAUTION] +> Three incorrect *User PIN* entries will cause it to become blocked and must be unblocked with either the *Admin PIN* or *Reset Code*. Three incorrect *Admin PIN* or *Reset Code* entries will destroy data on YubiKey. The number of [retry attempts](https://docs.yubico.com/software/yubikey/tools/ykman/OpenPGP_Commands.html#ykman-openpgp-access-set-retries-options-pin-retries-reset-code-retries-admin-pin-retries) can be changed, for example to 5 attempts: @@ -1536,7 +1538,8 @@ When using the key `pinentry` will be invoked to request the key passphrase. The ### SSH agent forwarding -**Warning** SSH Agent Forwarding can [add additional risk](https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident/#ssh-agent-forwarding-should-be-disabled) - proceed with caution! +> [!CAUTION] +> SSH Agent Forwarding can [add additional risk](https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident/#ssh-agent-forwarding-should-be-disabled) - proceed with caution! There are two methods for ssh-agent forwarding, one is provided by OpenSSH and the other is provided by GnuPG. From a6aa556c2804d9be17146c545125efe842fcfa4a Mon Sep 17 00:00:00 2001 From: drduh Date: Mon, 7 Apr 2025 17:42:04 -0700 Subject: [PATCH 12/13] format more markdown alerts --- README.md | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 530df1f..c0c923a 100644 --- a/README.md +++ b/README.md @@ -527,7 +527,7 @@ $ sudo fdisk -l /dev/sdc Disk /dev/sdc: 14.9 GiB, 15931539456 bytes, 31116288 sectors ``` -> [!WARNING] +> [!CAUTION] > Confirm the destination (`of`) before issuing the following command - it is destructive! This guide uses `/dev/sdc` throughout, but this value may be different on your system. Zero the header to prepare for encryption: @@ -695,7 +695,8 @@ See [OpenBSD FAQ#14](https://www.openbsd.org/faq/faq14.html#softraidCrypto) for # Export public key -**Important** Without the public key, it will **not** be possible to use GnuPG to decrypt nor sign messages. However, YubiKey can still be used for SSH authentication. +> [!IMPORTANT] +> Without the public key, it will **not** be possible to use GnuPG to decrypt/sign messages. However, YubiKey can still be used for SSH authentication. Connect another portable storage device or create a new partition on the existing one. @@ -854,7 +855,8 @@ Run `gpg --card-status` to verify results (*Login data* field). # Transfer Subkeys -**Important** Transferring keys to YubiKey is a one-way operation which converts the on-disk key into a stub making it no longer usable to transfer to subsequent YubiKeys. Ensure a backup was made before proceeding. +> [!IMPORTANT] +> Transferring keys to YubiKey is a one-way operation which converts the on-disk key into a stub making it no longer usable to transfer to subsequent YubiKeys. Ensure a backup was made before proceeding. The Certify key passphrase and Admin PIN are required to transfer keys. @@ -1213,7 +1215,8 @@ cd ~/.gnupg wget https://raw.githubusercontent.com/drduh/config/main/gpg-agent.conf ``` -**Important** The `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time. +> [!NOTE] +> `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time. **Tip** Set `pinentry-program` to `/usr/bin/pinentry-gnome3` for a GUI-based prompt. @@ -1611,7 +1614,7 @@ Configure a signing key: git config --global user.signingkey $KEYID ``` -**Important** The `user.email` option must match the email address associated with the PGP identity. +Configure the `user.email` option to match the email address associated with the PGP identity. To sign commits or tags, use the `-S` option. @@ -1683,7 +1686,7 @@ extra-socket /run/user/1000/gnupg/S.gpg-agent.extra > [!IMPORTANT] > The pinentry program starts on the *local* host, not remote. -**Important** Any pinentry program except `pinentry-tty` or `pinentry-curses` may be used. This is because local `gpg-agent` may start headlessly (by systemd without `$GPG_TTY` set locally telling which tty it is on), thus failed to obtain the pin. Errors on the remote may be misleading saying that there is *IO Error*. (Yes, internally there is actually an *IO Error* since it happens when writing to/reading from tty while finding no tty to use, but for end users this is not friendly.) +Any pinentry program except `pinentry-tty` or `pinentry-curses` may be used. This is because local `gpg-agent` may start headlessly (by systemd without `$GPG_TTY` set locally telling which tty it is on), thus failed to obtain the pin. Errors on the remote may be misleading saying that there is *IO Error*. (Yes, internally there is actually an *IO Error* since it happens when writing to/reading from tty while finding no tty to use, but for end users this is not friendly.) See [Issue 85](https://github.com/drduh/YubiKey-Guide/issues/85) for more information and troubleshooting. @@ -1745,13 +1748,15 @@ YubiKey can be used to decrypt and sign emails and attachments using [Thunderbir Follow [instructions on the mozilla wiki](https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Configure_an_email_account_to_use_an_external_GnuPG_key) to setup your YubiKey with your thunderbird client using the external gpg provider. -**Important** Thunderbird [fails](https://github.com/drduh/YubiKey-Guide/issues/448) to decrypt emails if the ASCII `armor` option is enabled in your `~/.gnupg/gpg.conf`. If you see the error `gpg: [don't know]: invalid packet (ctb=2d)` or `message cannot be decrypted (there are unknown problems with this encrypted message)` simply remove this option from your config file. +> [!NOTE] +> Thunderbird will [fail](https://github.com/drduh/YubiKey-Guide/issues/448) to decrypt emails if the ASCII `armor` option is enabled in `gpg.conf`. If you see the error `gpg: [don't know]: invalid packet (ctb=2d)` or `message cannot be decrypted (there are unknown problems with this encrypted message)` simply remove this option. ### Mailvelope [Mailvelope](https://www.mailvelope.com/en) allows YubiKey to be used with Gmail and others. -**Important** Mailvelope [does not work](https://github.com/drduh/YubiKey-Guide/issues/178) with the `throw-keyids` option set in `gpg.conf` +> [!NOTE] +> Mailvelope [does not work](https://github.com/drduh/YubiKey-Guide/issues/178) with the `throw-keyids` option set in `gpg.conf` On macOS, install gpgme using Homebrew: @@ -1791,7 +1796,8 @@ Edit the file to enable options `pgp_default_key`, `pgp_sign_as` and `pgp_autosi `source` the file in `muttrc` -**Important** `pinentry-tty` set as the pinentry program in `gpg-agent.conf` is reported to cause problems with Mutt TUI, because it uses curses. It is recommended to use `pinentry-curses` or other graphic pinentry program instead. +> [!NOTE] +> `pinentry-tty` set as the pinentry program (in `gpg-agent.conf`) is reported to cause problems with Mutt TUI, because it uses curses; use `pinentry-curses` or other graphic pinentry program instead. ## Keyserver From 0d3da84bc0565db37a501035562f65131a18db8e Mon Sep 17 00:00:00 2001 From: drduh Date: Mon, 7 Apr 2025 17:47:16 -0700 Subject: [PATCH 13/13] patch remaining tips --- README.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c0c923a..fbd2394 100644 --- a/README.md +++ b/README.md @@ -512,7 +512,9 @@ Create an **encrypted** backup on portable storage to be kept offline in a secur The following process is recommended to be repeated several times on multiple portable storage devices, as they are likely to fail over time. As an additional backup measure, [Paperkey](https://www.jabberwocky.com/software/paperkey/) can be used to make a physical copy of key materials for improved durability. -**Tip** The [ext2](https://en.wikipedia.org/wiki/Ext2) filesystem without encryption can be mounted on Linux and OpenBSD. Use [FAT32](https://en.wikipedia.org/wiki/Fat32) or [NTFS](https://en.wikipedia.org/wiki/Ntfs) filesystem for macOS and Windows compatibility instead. +> [!TIP] +> [ext2](https://en.wikipedia.org/wiki/Ext2) volumes (without encryption) can be mounted on Linux and OpenBSD. +> Use [FAT32](https://en.wikipedia.org/wiki/Fat32) or [NTFS](https://en.wikipedia.org/wiki/Ntfs) volumes for macOS and Windows compatibility instead. **Linux** @@ -1218,7 +1220,8 @@ wget https://raw.githubusercontent.com/drduh/config/main/gpg-agent.conf > [!NOTE] > `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time. -**Tip** Set `pinentry-program` to `/usr/bin/pinentry-gnome3` for a GUI-based prompt. +> [!TIP] +> Set `pinentry-program` to `/usr/bin/pinentry-gnome3` for a GUI-based prompt. **macOS** @@ -1506,7 +1509,8 @@ debug1: Authentication succeeded (publickey). [...] ``` -**Tip** To make multiple connections or securely transfer many files, use the [ControlMaster](https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Multiplexing) ssh option. +> [!TIP] +> To enable multiple connections, use the [ControlMaster](https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Multiplexing) SSH option. ### Import SSH keys