diff --git a/README.md b/README.md index 3ffcdbf..00ca01d 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,13 @@ If you have a comment or suggestion, please open an [issue](https://github.com/d * [Entropy](#entropy) - [Creating keys](#creating-keys) - [Master key](#master-key) -- [Subkeys](#subkeys) +- [Sub-keys](#sub-keys) * [Signing](#signing) * [Encryption](#encryption) * [Authentication](#authentication) -- [Verify keys](#verify-keys) -- [Export keys](#export-keys) -- [Backup keys](#backup-keys) -- [Configure YubiKey](#configure-yubikey) +- [Verify](#verify) +- [Export](#export) +- [Backup](#backup) - [Configure Smartcard](#configure-smartcard) * [Change PIN](#change-pin) * [Set information](#set-information) @@ -31,10 +30,6 @@ If you have a comment or suggestion, please open an [issue](https://github.com/d - [Verify card](#verify-card) - [Cleanup](#cleanup) - [Using keys](#using-keys) -- [Import public key](#import-public-key) - * [Trust master key](#trust-master-key) -- [Insert YubiKey](#insert-yubikey) -- [Verifying signature](#verifying-signature) - [SSH](#ssh) * [Create configuration](#create-configuration) * [Replace agents](#replace-agents) @@ -64,7 +59,7 @@ You will also need several small storage devices for booting a live image, creat # Verify YubiKey -To confirm your YubiKey is genuine, open a [browser with U2F support](https://support.yubico.com/support/solutions/articles/15000009591-how-to-confirm-your-yubico-device-is-genuine-with-u2f) to [https://www.yubico.com/genuine/](https://www.yubico.com/genuine/). Insert your Yubico device, and select Verify Device` to begin the process. Touch the YubiKey when prompted, and if asked, allow it to see the make and model of the device. If you see `Verification complete`, your device is authentic. +To confirm your YubiKey is genuine, open a [browser with U2F support](https://support.yubico.com/support/solutions/articles/15000009591-how-to-confirm-your-yubico-device-is-genuine-with-u2f) to [https://www.yubico.com/genuine/](https://www.yubico.com/genuine/). Insert your Yubico device, and select *Verify Device* to begin the process. Touch the YubiKey when prompted, and if asked, allow it to see the make and model of the device. If you see *Verification complete*, your device is authentic. This website verifies the YubiKey's device attestation certificates signed by a set of Yubico CAs, and helps mitigate [supply chain attacks](https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-r00killah-and-securelyfitz-Secure-Tokin-and-Doobiekeys.pdf). @@ -298,9 +293,9 @@ Disable networking for the remainder of the setup. # Master key -The first key to generate is the master key. It will be used for certification only: to issue subkeys that are used for encryption, signing and authentication. +The first key to generate is the master key. It will be used for certification only: to issue sub-keys that are used for encryption, signing and authentication. -**Important** The master key should be kept offline at all times and only accessed to revoke or issue new subkeys. +**Important** The master key should be kept offline at all times and only accessed to revoke or issue new sub-keys. Keys can also be generated on the YubiKey itself to ensure no other copies exist. You'll be prompted to enter and verify a passphrase - keep it handy as you'll need it throughout. To generate a strong passphrase which could be written down in a hidden or secure place; or memorized: @@ -409,7 +404,7 @@ Export the key ID as a [variable](https://stackoverflow.com/questions/1158091/de $ export KEYID=0xFF3E7D88647EBCDB ``` -# Subkeys +# Sub-keys Edit the master key to add sub-keys: @@ -612,7 +607,7 @@ ssb rsa4096/0x3F29127E79649A3D gpg> save ``` -# Verify keys +# Verify List the generated secret keys and verify the output: @@ -640,7 +635,7 @@ The output will display any problems with your key in red text. If everything is > hokey may warn (orange text) about cross certification for the authentication key. GPG's [Signing Subkey Cross-Certification](https://gnupg.org/faq/subkey-cross-certify.html) documentation has more detail on cross certification, and gpg v2.2.1 notes "subkey does not sign and so does not need to be cross-certified". hokey may also indicate a problem (red text) with `Key expiration times: []` on the primary key (see [Note #3](#notes) about not setting an expiry for the primary key). -# Export keys +# Export The master key and sub-keys will be encrypted with your passphrase when exported. @@ -660,7 +655,7 @@ $ gpg --armor --export-secret-keys $KEYID -o \path\to\dir\mastersub.gpg $ gpg --armor --export-secret-subkeys $KEYID -o \path\to\dir\sub.gpg ``` -# Backup keys +# Backup Once GPG keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring and consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys as an additional backup. @@ -821,7 +816,7 @@ $ gpg --armor --export $KEYID | sudo tee /mnt/public/$KEYID.txt [...] ``` -**Windows** +Windows: ```console $ gpg --armor --export $KEYID -o \path\to\dir\pubkey.gpg @@ -847,7 +842,7 @@ Attach a USB disk and determine its label: ```console $ dmesg | grep sd.\ at -sd2 at scsibus5 targ 1 lun 0: SCSI4 0/direct removable serial.50010000000000000001 +sd2 at scsibus5 targ 1 lun 0: SCSI4 0/direct removable serial.00000000000000000000 ``` Print the existing partitions to make sure it's the right device: @@ -856,7 +851,7 @@ Print the existing partitions to make sure it's the right device: $ doas disklabel -h sd2 ``` -Initialize the disk by creating an `a` partition with FS type `RAID`: +Initialize the disk by creating an `a` partition with FS type `RAID` and size of 10 Megabytes: ```console $ doas fdisk -iy sd2 @@ -864,21 +859,25 @@ Writing MBR at offset 0. $ doas disklabel -E sd2 Label editor (enter '?' for help at any prompt) -> a a +sd2> a a offset: [64] -size: [62653436] +size: [31101776] 10M FS type: [4.2BSD] RAID -> w -> q -No label changes. +sd2*> w +sd2> q +No label changes +``` +Encrypt with bioctl: + +```console $ doas bioctl -c C -l sd2a softraid0 New passphrase: Re-type passphrase: softraid0: CRYPTO volume attached as sd3 ``` -Create an `i` partition, then create and mount the filesystem: +Create an `i` partition on the new crypto volume and the filesystem: ```console $ doas fdisk -iy sd3 @@ -886,23 +885,22 @@ Writing MBR at offset 0. $ doas disklabel -E sd3 Label editor (enter '?' for help at any prompt) -> a i +sd3> a i offset: [64] -size: [62637371] +size: [16001] FS type: [4.2BSD] -> w -> q +sd3*> w +sd3> q No label changes. $ doas newfs sd3i -/dev/rsd3i: 30584.6MB in 62637344 sectors of 512 bytes -152 cylinder groups of 202.47MB, 12958 blocks, 25984 inodes each +/dev/rsd3i: 7.8MB in 16000 sectors of 512 bytes +4 cylinder groups of 1.95MB, 125 blocks, 256 inodes each super-block backups (for fsck -b #) at: - 32, 414688, 829344, 1244000, 1658656, 2073312, 2487968, 2902624, 3317280, 3731936, 4146592, 4561248, 4975904, -[...] + 32, 4032, 8032, 12032, ``` -Mount the filesystem and copy the temporary GNUPG directory: +Mount the filesystem and copy the temporary directory with the keyring: ```console $ doas mkdir /mnt/encrypted-usb @@ -914,7 +912,7 @@ $ doas cp -avi $GNUPGHOME /mnt/encrypted-usb Keep the backup mounted if you plan on setting up two or more keys as `keytocard` **will [delete](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html) the local copy** on save. -Otherwise, unmount and disconnected the encrypted USB disk: +Otherwise, unmount and disconnected the encrypted volume: ```console $ doas umount /mnt/encrypted-usb @@ -924,26 +922,40 @@ $ doas bioctl -d sd3 See [OpenBSD FAQ#14](https://www.openbsd.org/faq/faq14.html#softraidCrypto) for more information. -# Configure YubiKey +Create another partition to store the public key, or skip this step if you plan on uploading it to a key server. -**Note** YubiKey NEO shipped after November 2015 have [all modes enabled](https://www.yubico.com/support/knowledge-base/categories/articles/yubikey-neo-manager/); so this step may be skipped. Older versions of the YubiKey NEO may need to be reconfigured as a composite USB device (HID + CCID) which allows OTPs to be emitted while in use as a SmartCard. -Plug in YubiKey and configure it with the `ykpersonalize` utility: +**Important** Without the public key, you will not be able to use GPG to encrypt, decrypt, nor sign messages. However, you will still be able to use YubiKey for SSH authentication. ```console -$ sudo ykpersonalize -m82 -Firmware version 4.3.7 Touch level 527 Program sequence 1 +$ doas disklabel -E sd2 +Label editor (enter '?' for help at any prompt) +sd2> a b +offset: [32130] +size: [31069710] 10M +FS type: [swap] 4.2BSD +sd2*> w +sd2> q +No label changes. -The USB mode will be set to: 0x82 +$ doas newfs sd2b +/dev/rsd2b: 15.7MB in 32096 sectors of 512 bytes +5 cylinder groups of 3.89MB, 249 blocks, 512 inodes each +super-block backups (for fsck -b #) at: + 32, 8000, 15968, 23936, 31904, -Commit? (y/n) [n]: y -``` +$ doas mkdir /mnt/public -The -m option is the mode command. To see the different modes, enter `ykpersonalize -help`. Mode 82 (in hex) enables the YubiKey NEO as a composite USB device (HID + CCID). Once you have changed the mode, you need to re-boot the YubiKey, so remove and re-insert it. On YubiKey NEO with firmware version 3.3 or higher, you can enable composite USB device with `-m86` instead of `-m82`. +$ doas mount /dev/sd2b /mnt/public -**Windows** Use the [YubiKey NEO Manager](https://www.yubico.com/products/services-software/download/yubikey-neo-manager/) to enable CCID functionality. +$ gpg --armor --export $KEYID | doas tee /mnt/public/$KEYID.txt +-----BEGIN PGP PUBLIC KEY BLOCK----- +[...] +``` # Configure Smartcard +**Windows** Use the [YubiKey NEO Manager](https://www.yubico.com/products/services-software/download/yubikey-neo-manager/) to enable CCID functionality. + Use GPG to configure YubiKey as a smartcard: ```console @@ -1196,14 +1208,6 @@ $ gpg --delete-secret-key $KEYID # Using keys -You can reboot back into the Live image to test YubiKey. - -Install required programs: - -```console -$ sudo apt-get update && sudo apt-get install -y \ - gnupg2 gnupg-agent scdaemon pcscd -``` Download [drduh/config/gpg.conf](https://github.com/drduh/config/blob/master/gpg.conf): @@ -1213,20 +1217,34 @@ $ cd ~/.gnupg ; wget https://raw.githubusercontent.com/drduh/config/master/gpg.c $ chmod 600 gpg.conf ``` -# Import public key +Install the required packages and mount the non-encrypted volume created earlier: -To import the public key from the non-encrypted volume created earlier: +**Linux** ```console +$ sudo apt-get update && sudo apt-get install -y \ + gnupg2 gnupg-agent gnupg-curl scdaemon pcscd + $ sudo mount /dev/sdb2 /mnt +``` +**OpenBSD** + +```console +$ doas pkg_add gnupg pcsc-tools +$ doas mount /dev/sd2b /mnt +``` + +Import the key: + +```console $ gpg --import /mnt/pubkey.txt gpg: key 0xFF3E7D88647EBCDB: public key "Dr Duh " imported gpg: Total number processed: 1 gpg: imported: 1 ``` -To download the public key from a keyserver: +Or download the public key from a keyserver: ```console $ gpg --recv $KEYID @@ -1237,14 +1255,6 @@ gpg: Total number processed: 1 gpg: imported: 1 ``` -If you get the error `gpgkeys: HTTP fetch error 1: unsupported protocol` - this means you need to install a special version of curl which supports GPG: - -```console -$ sudo apt-get install -y gnupg-curl -``` - -## Trust master key - Edit the master key to assign it ultimate trust by selecting `trust` then option `5`: ```console @@ -1283,8 +1293,6 @@ sub 4096R/0x3F29127E79649A3D created: 2017-10-09 expires: 2018-10-09 usage: gpg> quit ``` -# Insert YubiKey - Remove and re-insert the YubiKey and check the status: ```console