Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #9475

Re: wanted: educate us please on key dongles

Show all headers | View raw

Am 2017-08-30 09:01, schrieb Marc Haber:
> On Tue, Aug 29, 2017 at 04:07:45PM -0300, Henrique de Moraes Holschuh 
> wrote:
>> The **public** portion of *every* key (master and all subkeys) go into
>> the public keyrings and also in the Debian keyring.  gnupg will handle
>> this automatically if you use "--export" (do *NOT* confuse with a
>> different export option that is for private keys).
> 
> So it is probably a bad idea / impossible (?) to have a dedicated
> signing-only key used for Debian that guared more closely than the
> "regular every-day" key?

Well, you could create a completely separate key pair (with a separate
master key) for Debian purposes only.

> People keep mentioning to store the private key on a LUKS-encrypted
> device. Why? Is the private key encryption that happens inside GnuPG
> itself when you protect your private key with a passphrase not
> sufficient?

Defense in depth. First of all, it's not immediately clear that the
media I keep my private key on is actually the one that contains my
private key (_all_ external media I have at home is LUKS encrypted,
except for a couple of USB sticks I use to share data with other
people), and secondly I use a different passphrase for LUKS as
compared to the private key. (The tricky thing here is making sure
you don't forget the second passphrase, otherwise you're screwed.)

Basically, it's an added level of paranoia.

>> Only the public keys (all of them: master and subkeys).  gnupg will
>> handle this automatically if you use --send-key.
> 
> And I hope that it's really hard to fuck up here and to send private
> keys to the keyserver.

I don't think that's possible with GnuPG command line, as far as
I know GnuPG will only ever send public keys to the keyservers.

However, you _could_ achieve that if you export the private key
manually and accidentally upload that via the web interface that
some keyservers provide. ;-) They'll probably reject the upload
(because it's not a public key), but who knows where that'll be
logged...

> I have had people send me the private parts of their ssh keys...

To be fair: SSH's naming convention for files is not the easiest
to understand for new users. Using ${filename} for the private key
and ${filename}.pub for the public key does not make it obvious
that they need to keep ${filename} private. Had they used
${filename}.secret for the private key this might have reduced
such occurrences.

Regards,
Christian

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-02 22:20 +0200
  Re: wanted: educate us please on key dongles Zlatan Todoric <zlatan@riseup.net> - 2017-08-02 22:40 +0200
  Re: wanted: educate us please on key dongles Jonas Smedegaard <dr@jones.dk> - 2017-08-02 22:50 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <w@uter.be> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <wouter@debian.org> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Daniel Pocock <daniel@pocock.pro> - 2017-08-03 13:40 +0200
  Re: wanted: educate us please on key dongles Víctor Cuadrado Juan <me@viccuad.me> - 2017-08-03 19:10 +0200
  Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 15:20 +0200
    Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 17:30 +0200
      Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 19:50 +0200
    Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:10 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-11 22:00 +0200
          Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-12 00:00 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:40 +0200
      Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-29 20:00 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 11:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 12:20 +0200
          Re: wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-30 12:50 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:00 +0200
              Re: wanted: educate us please on key dongles Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-08-30 13:20 +0200
                Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 15:00 +0200
              Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Ian Campbell <ijc@debian.org> - 2017-08-30 17:20 +0200
        Re: wanted: educate us please on key dongles Alexander Zangerl <az+debmnt@snafu.priv.at> - 2017-08-31 00:40 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 20:10 +0200
      Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-29 21:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 09:10 +0200
          Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 14:00 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 14:50 +0200
              Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 17:20 +0200
            Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-09-22 22:10 +0200
          Re: wanted: educate us please on key dongles Teemu Likonen <tlikonen@iki.fi> - 2017-08-30 14:10 +0200
          Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-31 07:10 +0200
  Re: wanted: ... key dongles GNUK is available Osamu Aoki <osamu@debian.org> - 2017-08-16 17:00 +0200
    Re: wanted: ... key dongles GNUK is available Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:50 +0200
  [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-08 15:20 +0200
    Re: [summary] Re: wanted: educate us please on key dongles Sotirios Vrachas <sotirios@vrachas.com> - 2017-09-09 22:20 +0200
      Re: [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-10 06:00 +0200

csiph-web