Contents
How to create a GnuPG key with a sub key?
The key size should match the size fitting on the smartcard or Yubikey. While GnuPG version 1 will ask for the passphrase at the beginning of the “addkey” procedure, version 2 will ask at the end of the creation process for an individual passphrase for the new subkey as well as for the passphrase of the master key. gpg> addkey Key is protected.
Do you need to validate a GnuPG key?
Once a key is imported it should be validated. GnuPG uses a powerful and flexible trust model that does not require you to personally validate each key you import. Some keys may need to be personally validated, however. A key is validated by verifying the key’s fingerprint and then signing the key to certify it as a valid key.
Can a GnuPG key be used on a smartcard?
In order to use a GnuPG key on a smartcard or Yubikey, a GnuPG key needs to be created. This post will show you how to create a GnuPG key with sub-keys for signing, encryption and authentication. The authentication key can be used later on to authenticate via ssh as well.
What’s the maximum size of a GnuPG key?
Before starting to generate the different sub-keys, verify the maximum size of keys the smartcard can store. The Yubikey NEO can store keys up to 2048 bits while the Yubikey 4 can store keys up to 4096 bits. Smartcards usually support different sizes as well like 2048, 3072 or 4096 bits.
Where do I store my GnuPG master key?
The parameter “–homedir ./gnupg-test/” defines the directory used for the keyring to be generated. This is the directory where the previously created gpg.conf file should be located. I suggest to use a removable storage like a USB-Stick to store the master-key on.
How to merge different sets of OpenPGP subkeys?
GnuPG can only merge different sets of private subkeys for a primary key starting from version 2.1. Make sure to have all subkeys on a single machine and export as needed, or upgrade GnuPG. There is a way using gpgsplit and cat, but it is tedious and requires deep knowledge of RFC4880 (the OpenPGP specification).
How to verify the generated keys in GPG?
To verify the generated keys, execute the following command. According to the view options in the gpg.conf configuration file, the output shows the long keyid format as well as the fingerprint of each key or subkey. To ensure that only strong algorithms are used, set the preferences for the key using the “setpref” command.
Is there a warranty for the GnuPG key?
There is NO WARRANTY, to the extent permitted by law. Secret key is available. pub 4096R/0xD93D03C13478D580 created: 2016-11-30 expires: 2018-11-30 usage: C trust: ultimate validity: ultimate [ultimate] (1).
Why does GPG ask for password even with–passphrase?
Just another example of over engineering I guess. Here’s a link to a stackoverflow answer that maybe of further assistance; I have a project that does bulk decryption/encryption, and due to GnuPG being very strict about passphrases, learned the hard way that –passphrase only works on rare occasions.
Can a GnuPG authentication key be used on SSH?
The authentication key can be used later on to authenticate via ssh as well. Before the key can be generated, first you need to configure GnuPG. The following settings are suggested before creating the key. The settings contain the documentation from the official GnuPG documentation.