Conversation
jarkko

Jarkko Sakkinen

Edited 1 year ago

I wonder what is the best practice to remove #passphrase from #OpenPGP subkey. I’m using #gnupg2. I’ve spend hours on this and still not able to do it :-(

I.e. I have this:

$ gpg -K
/home/jarkko/.gnupg/pubring.kbx
-------------------------------
sec   rsa4096 2019-06-24 [C] [expires: 2024-07-04]
      5107E66D34788A93E3227C903AB05486C7752FE1
uid           [ unknown] Jarkko Sakkinen <jarkko.sakkinen@iki.fi>
uid           [ unknown] Jarkko Sakkinen <jarkko@kernel.org>
uid           [ unknown] Jarkko Sakkinen <jarkko.sakkinen@tuni.fi>
ssb   ed25519 2019-06-25 [S] [expires: 2025-07-27]
ssb   rsa4096 2020-08-11 [A]
ssb   rsa4096 2022-03-21 [E] [expires: 2024-03-20]
ssb   ed25519 2022-12-29 [A]

And I want to remove passphrase from #ed25519 #authentication #key.

3
0
0
jarkko

Jarkko Sakkinen

Reply to @jarkko
Starting to understand why #OpenPGP has never really dominated :-)
0
0
0
vbabka

Vlastimil Babka

Reply to @jarkko
@jarkko the best practice is moving the subkey to a hw key ;)
1
0
0
krzk

Krzysztof Kozlowski

Reply to @vbabka
@vbabka @jarkko Yes, that's the best, but I would start from basics - definitely not having master's secret key in your workstation keyring.
1
0
0
jarkko

Jarkko Sakkinen

Reply to @krzk
@krzk @vbabka I'm migrating my keyring to yubikey atm. I have two of them. But still I don't want to proceed on that before I know how the basic password management works with OpenPGP. E.g. I don't even know how to see whether a key has a password set or not in the first place :-)
2
0
0
jarkko

Jarkko Sakkinen

Reply to @jarkko
I used to have Nitrokey Pro in the past with paper printed backup of my master key as a set QR codes. I'm now in the middle of migration. I actually set the passphrase accidentally to a subkey and now I'm clueless how get rid of it. I just want to understand before progressing forward.
1
0
0
jarkko

Jarkko Sakkinen

Reply to @jarkko
To put short: I do not disagree with you but I want to first know what heck I'm doing :-) It should not be that hard to do these tasks.
0
0
0
krzk

Krzysztof Kozlowski

Reply to @jarkko
@jarkko @vbabka Hiding your master (primary or [C]) key is a bit independent step and usually done before moving subkeys to crypto device.
1
0
2
jarkko

Jarkko Sakkinen

Reply to @krzk
Edited 1 year ago
@krzk @vbabka yup, since I don't have ideas how to proceed with the subkey password, I'll seal my master key for now to Yubikey :-) I don't even know exactly how to verify if it was removed or see if a particular subkey has a passphrase (I tried tools such as Seahorse also to see if they give this visibility but no luck).
2
0
0
jarkko

Jarkko Sakkinen

Reply to @jarkko
thanks for the feedback anyway, i migrated to yubikey! and once again printed my master key also as a set of QR stickers (encrypted with passphrase) :-) I bought a label writer few years ago specifically for this purpose. if you have ideas just for the sake learning and understanding how passphrases were supposed to work please don't hesitate to share to this post, thank you.
0
0
0
jarkko

Jarkko Sakkinen

Reply to
@coelacanthus I think I give a shot for writing a small python script that gives me more elaborated status report of a keyring state than gnupg -K does. I.e. shows both keys, and also their sealing state (or whatever it is called).
1
0
0
jarkko

Jarkko Sakkinen

Reply to @jarkko
Edited 1 year ago
@coelacanthus actually I think i just write a simple viewer, which so the stuff I need to see from each subkey. The bigger issue for me with gnupg than how to do something is to how to see what changed. I actually might use this opportunity to learn a bit more rust :-) Since I know pretty much what properties I want to see from each key most of the time I use OpenPGP it is easier just to take the time and write a non-generic read-only program to view that picture. The user experience of gnupg is convoluted to say the least.
0
0
0
vbabka

Vlastimil Babka

Reply to @jarkko
@jarkko @krzk you mean you moved the master key itself to a yubikey? That's not the best practice...
1
0
0
jarkko

Jarkko Sakkinen

Reply to @vbabka
@vbabka @krzk What'd you propose? I'm listening. Fully admit that I truly suck with OpenPGP.
1
0
0
vbabka

Vlastimil Babka

Reply to @jarkko
@jarkko @krzk I just follow the great guide from @monsieuricon here https://www.kernel.org/doc/html/next/process/maintainer-pgp-guide.html
master key goes to an encrypted USB key, subkeys to a yubikey/nitrokey/whatnot. I've only deviated by uploading the same set of subkeys to multiple yubikeys/nitrokey for interchangeability.
1
0
1
jarkko

Jarkko Sakkinen

Reply to @vbabka
@vbabka @krzk @monsieuricon Well I used stickers instead of stick :-) I've read that in the past but ya should really read it as a refresher. Thanks! No harm done yet...
1
0
1
jarkko

Jarkko Sakkinen

Reply to @jarkko
Actually I found also answer to my original question from the guide. OK, I'll print it out and read carefully all sections and the take actions...
1
0
0
palmer

Palmer Dabbelt

Reply to @jarkko
@jarkko IIRC I'm using something pretty similar, but mostly Will just told me what to do because he'd just set it all up. That was a few years ago, though...
1
0
1
jarkko

Jarkko Sakkinen

Reply to @palmer
@palmer OK good to hear, thanks! I think I can survive with all these tips
0
0
0
About social.kernel.org

Terms of service

  1. Please do not use this service in violation of the Linux Kernel Code of Conduct. Doing so will result in your account suspension with the referral of the matter to the CoC committee.

  2. "Repeating"/"boosting" someone else's status on this platform will be treated as endorsement and will fall under rule #1.

  3. You are encouraged to use this platform to promote your work on the Linux Kernel, but there is no restriction on permitted topics (with the exception of anything covered by #1 above).

  4. There is no requirement to post in English, but it should be considered the primary language of communication on this platform.

Privacy notice

The admins of this service have access to all posted statuses. They aren't looking, but if it's something they shouldn't know about, then you should not post it on this platform.

Please see the Linux Foundation Privacy Policy, which applies to this platform as well.

Getting your own account

If you would like an account on this instance, please check that the following applies to you:

  • You are listed in MAINTAINERS or CREDITS

  • OR: You have a kernel.org account or email address

  • OR: You have a long and established history of involvement with the Linux Kernel

If the above is true and you agree with the Terms of Service and Privacy Notice listed above, please use these instructions to request an account: