Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #9467

Re: wanted: educate us please on key dongles

Show all headers | View raw

On Tue, Aug 29, 2017 at 04:07:45PM -0300, Henrique de Moraes Holschuh wrote:
> On Tue, 29 Aug 2017, Marc Haber wrote:
> > - Which key goes on the paper slab that everybody uses to collect
> >   signatures? The certification only master key?
> 
> The main key fingerprint.  Which happens to be the certification master
> key in gnupg, yes.

Understood.

> > - For which (set of) keys should I have revocation certificates on file?
> 
> You need to have a revocation certificate for the master key.  When you
> revoke it, you revoke every subkey as well.  Also, as long as you keep
> control of the master key, you can revoke any subkey.

Understood. I didn't find that information in all clearness anywhere.

> It goes without saying that losing control of your revocation
> certificate can open you to a DoS attack, so please keep it protected
> somehow, but NOT in a way you might find yourself unable to use it.

Of course.

> > - What key goes into the Debian keyring? A signing (only?) subkey of the
> >   certification master key? Is it recommended to have this key
> >   "available", for example in a Gnuk on my keychain next to the key to
> >   my home?
> 
> The **public** portion of *every* key (master and all subkeys) go into
> the public keyrings and also in the Debian keyring.  gnupg will handle
> this automatically if you use "--export" (do *NOT* confuse with a
> different export option that is for private keys).

So it is probably a bad idea / impossible (?) to have a dedicated
signing-only key used for Debian that guared more closely than the
"regular every-day" key?

> In the "normal use" smartcard, you store the *private* portion of the
> *subkeys* you need.
> 
> In a offline digital vault of some sort (encrypted removable storage, or
> secure smartcard, etc), you need to keep everything including the
> private portion of the master (main) key.

After pondering about that for a while, it might be not wise to have the
master certification key generated on a "the key never leaves the card"
smart card since that doesn't allow you to have backups. So one needs to
have the certificatio master key somewhere on a medium from where you
can read it, to be able to write it to a new smart card.

People keep mentioning to store the private key on a LUKS-encrypted
device. Why? Is the private key encryption that happens inside GnuPG
itself when you protect your private key with a passphrase not
sufficient?

> In .gnupg you might have to store a "crippled" version of the main key,
> which has its private data zeroed, for it to work.  This is where people
> screw up and lose the key, or fail to protect it, so it should be a
> topic of its own.

That is the "stub" in GnuPG-Ling, right?

> > - Which (set of) keys goes to the key servers?
> 
> Only the public keys (all of them: master and subkeys).  gnupg will
> handle this automatically if you use --send-key.

And I hope that it's really hard to fuck up here and to send private
keys to the keyserver. I have had people send me the private parts of
their ssh keys...

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-02 22:20 +0200
  Re: wanted: educate us please on key dongles Zlatan Todoric <zlatan@riseup.net> - 2017-08-02 22:40 +0200
  Re: wanted: educate us please on key dongles Jonas Smedegaard <dr@jones.dk> - 2017-08-02 22:50 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <w@uter.be> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <wouter@debian.org> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Daniel Pocock <daniel@pocock.pro> - 2017-08-03 13:40 +0200
  Re: wanted: educate us please on key dongles Víctor Cuadrado Juan <me@viccuad.me> - 2017-08-03 19:10 +0200
  Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 15:20 +0200
    Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 17:30 +0200
      Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 19:50 +0200
    Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:10 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-11 22:00 +0200
          Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-12 00:00 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:40 +0200
      Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-29 20:00 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 11:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 12:20 +0200
          Re: wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-30 12:50 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:00 +0200
              Re: wanted: educate us please on key dongles Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-08-30 13:20 +0200
                Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 15:00 +0200
              Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Ian Campbell <ijc@debian.org> - 2017-08-30 17:20 +0200
        Re: wanted: educate us please on key dongles Alexander Zangerl <az+debmnt@snafu.priv.at> - 2017-08-31 00:40 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 20:10 +0200
      Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-29 21:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 09:10 +0200
          Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 14:00 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 14:50 +0200
              Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 17:20 +0200
            Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-09-22 22:10 +0200
          Re: wanted: educate us please on key dongles Teemu Likonen <tlikonen@iki.fi> - 2017-08-30 14:10 +0200
          Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-31 07:10 +0200
  Re: wanted: ... key dongles GNUK is available Osamu Aoki <osamu@debian.org> - 2017-08-16 17:00 +0200
    Re: wanted: ... key dongles GNUK is available Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:50 +0200
  [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-08 15:20 +0200
    Re: [summary] Re: wanted: educate us please on key dongles Sotirios Vrachas <sotirios@vrachas.com> - 2017-09-09 22:20 +0200
      Re: [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-10 06:00 +0200

csiph-web