diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 30 |
1 files changed, 30 insertions, 0 deletions
@@ -27,6 +27,7 @@ If you have a comment or suggestion, please open an [Issue](https://github.com/d * [Authentication](#authentication) * [Add extra emails](#add-extra-emails) - [Verify](#verify) +- [Create a revoke certificate](#create-a-revoke-certificate) - [Export](#export) - [Backup](#backup) - [Configure Smartcard](#configure-smartcard) @@ -326,6 +327,8 @@ An entropy pool value greater than 2000 is sufficient. # Creating keys +## Using a temporary file system (Tmpfs) + Create a temporary directory which will be cleared on [reboot](https://en.wikipedia.org/wiki/Tmpfs): ```console @@ -334,6 +337,19 @@ $ export GNUPGHOME=$(mktemp -d) $ cd $GNUPGHOME ``` +## Use the Storage Device as backup and reusable enviroment + +As you may want to keep a offline backup of your keys as well as a clean enviroment to be set up easily, you also might consider to keep your USB-Storage device including the keys in a save place. Therefore, just set your desired GNUPGHOME-Variable: + +```console +$ export GNUPGHOME=~/gnupg-workspace + +$ cd $GNUPGHOME +``` +**Remember** You must store the device in a secure place afterwards or destroy it physically (smash, burn, shred etc.) + +## Harden your setup + Create a hardened configuration in the temporary directory with the following options: ```console @@ -843,6 +859,20 @@ $ gpg -o \path\to\dir\mastersub.gpg --armor --export-secret-keys $KEYID $ gpg -o \path\to\dir\sub.gpg --armor --export-secret-subkeys $KEYID ``` +# Create a revoke certificate + +Although we will backup and store the master key in a safe place, it is best practice to never rule out the possibility of losing it or having the backup fail. Without the master key it will be impossible to renew or rotate subkeys or generate a revoke certificate, our keychain will be basically useless. + +Even worse, we cannot advertise this fact in any way to those that are using our keys. It is therefore safe to assume that at some point in the future this *will* happen and the only thing that will allow us to deprecate our *orphan* keys is a revoke certificate. + +In order to create the revoke certificate: + +``` console +gpg --output revoke.asc --gen-revoke $KEYID +``` + +The newly created `revoke.asc` file should be stored (or printed) in a place that allows us to retrieve it in case our backup strategy fails. + # Backup Once keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring and consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys as an additional backup measure. |