Conversation
@jani not whole gpg keys, only subkeys go to the token! See the excellent https://www.kernel.org/doc/html/next/process/maintainer-pgp-guide.html
Shouldn't then matter much if you generate new ones or transfer existing ones.
Shouldn't then matter much if you generate new ones or transfer existing ones.
1
2
5
@jani I did cheat a bit there myself though, as I've put the same set of subkeys on multiple hw tokens (yubikey and nitrokey), plus I have backup of the subkeys outside of the hw tokens. For auth/sign subkeys it's convenient as there's just one to put into .ssh/authorized_keys etc, for encryption it's more crucial to not lose access to encrypted data (e.g. pass).
1
0
1
K. Ryabitsev 🍁
monsieuricon
1
0
3
@monsieuricon @jani oh good to hear. It does feels like cheating because normally putting an existing subkey to the token deletes its private key from the disk, so one has to hack around that.
1
0
1
K. Ryabitsev 🍁
monsieuricon
0
0
2
@duxsco @monsieuricon @jani btw the first time I tried this approach, the card id of the last card that got the subkeys was stored somewhere and the gpg agent insisted on the specific one. Someone must have fixed that as now it doesn't care.
0
0
1