diff options
| -rw-r--r-- | README.md | 45 |
1 files changed, 23 insertions, 22 deletions
@@ -291,6 +291,7 @@ verify-options show-uid-validity with-fingerprint require-cross-certification no-symkey-cache +armor use-agent throw-keyids ``` @@ -304,13 +305,13 @@ When creating an identity with GnuPG, the default options ask for a "Real name", Depending on how you plan to use GnuPG, set these values respectively: ```console -IDENTITY="YubiKey User <yubikey@example>" +export IDENTITY="YubiKey User <yubikey@example>" ``` Or use any attribute which will uniquely identity the key (this may be incompatible with certain use cases): ```console -IDENTITY="My Cool YubiKey - 2024" +export IDENTITY="My Cool YubiKey - 2024" ``` ## Key @@ -320,7 +321,7 @@ Select the desired algorithm and key size. This guide recommends 4096-bit RSA. Set the value: ```console -KEY_TYPE=rsa4096 +export KEY_TYPE=rsa4096 ``` ## Expiration @@ -338,13 +339,13 @@ Subkeys must be renewed or rotated using the Certify key - see [Updating Subkeys Set the expiration date to two years: ```console -EXPIRATION=2y +export EXPIRATION=2y ``` Or set the expiration date to a specific date to schedule maintenace: ```console -EXPIRATION=2026-05-01 +export EXPIRATION=2026-05-01 ``` ## Passphrase @@ -354,9 +355,9 @@ Generate a passphrase for the Certify key. It will be used infrequently to manag The following commands will generate a strong passphrase and avoid ambiguous characters: ```console -CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ +export CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \ - cut -c2- | tr " " "-" | head -1) ; echo "$CERTIFY_PASS" + cut -c2- | tr " " "-" | head -1) ; echo "\n$CERTIFY_PASS\n" ``` Write the passphrase in a secure location, ideally separate from the portable storage device used for key material, or memorize it. @@ -385,9 +386,9 @@ gpg --batch --passphrase "$CERTIFY_PASS" \ Set and view the Certify key identifier and fingerprint for use later: ```console -KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }') +export KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }') -KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }') +export KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }') printf "\nKey ID: %40s\nKey FP: %40s\n\n" "$KEYID" "$KEYFP" ``` @@ -494,9 +495,9 @@ Use [LUKS](https://dys2p.com/en/2023-05-luks-security.html) to encrypt the new p Generate another unique [Passphrase](#passphrase) (ideally different from the one used for the Certify key) to protect the encrypted volume: ```console -LUKS_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ +export LUKS_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \ tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \ - cut -c2- | tr " " "-" | head -1) ; echo $LUKS_PASS + cut -c2- | tr " " "-" | head -1) ; echo "\n$LUKS_PASS\n" ``` This passphrase will also be used infrequently to access the Certify key and should be very strong. @@ -703,7 +704,7 @@ Connect YubiKey and confirm its status: gpg --card-status ``` -If the card is locked, [Reset](#reset) it. +If the card is locked, [Reset](#reset-yubikey) it. ## Change PIN @@ -722,9 +723,9 @@ The *User PIN* must be at least 6 characters and the *Admin PIN* must be at leas Set PINs manually or generate them, for example a 6 digit User PIN and 8 digit Admin PIN: ```console -ADMIN_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w8 | head -1) +export ADMIN_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w8 | head -1) -USER_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w6 | head -1) +export USER_PIN=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | fold -w6 | head -1) printf "\nAdmin PIN: %12s\nUser PIN: %13s\n\n" "$ADMIN_PIN" "$USER_PIN" ``` @@ -779,7 +780,7 @@ quit EOF ``` -Run `gpg --card-status` to verify results. +Run `gpg --card-status` to verify results (*Login data* field). # Transfer Subkeys @@ -851,7 +852,7 @@ The `>` after a tag indicates the key is stored on a smart card. Verify you have done the following: -- [ ] Memorized or wrote down the Certify key passphrase to a secure and durable location +- [ ] Memorized or wrote down the Certify key (identity) passphrase to a secure and durable location * `echo $CERTIFY_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) to transcribe it - [ ] Memorized or wrote down passphrase to encrypted volume on portable storage * `echo $LUKS_PASS` to see it again; [`passphrase.html`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.html) or [`passphrase.csv`](https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/passphrase.csv) to transcribe it @@ -1774,7 +1775,7 @@ sudo mount /dev/sdc2 /mnt/public Copy the original private key materials to a temporary working directory: ```console -GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) +export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) cd $GNUPGHOME @@ -1786,9 +1787,9 @@ Confirm the identity is available, set the key id and fingerprint: ```console gpg -K -KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }') +export KEYID=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^pub:/ { print $5; exit }') -KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }') +export KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/ { print $10; exit }') echo $KEYID $KEYFP ``` @@ -1796,7 +1797,7 @@ echo $KEYID $KEYFP Recall the Certify key passphrase and set it, for example: ```console -CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX +export CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX ``` ## Renew Subkeys @@ -1804,9 +1805,9 @@ CERTIFY_PASS=ABCD-0123-IJKL-4567-QRST-UVWX Determine the updated expiration, for example: ```console -EXPIRATION=2026-09-01 +export EXPIRATION=2026-09-01 -EXPIRATION=2y +export EXPIRATION=2y ``` Renew the Subkeys: |