On 2016-02-26 22:08, Joshua Terrill wrote:
Hello,
I am looking to play around/experiment with gnupg and smart cards.
From what little research I've done, I've read about OpenPGP smart
cards don't reveal private keys, and do all decrypting/signing on the
device itself after entering a PIN. Do I have a correct understanding
of this, and if so, is this the common/most secure way to use these
cards? For simple encrypting, decrypting, and signing what card and
card reader would you recommend? I have a windows environment and an
ubuntu environment that I can play with it on.
Thanks!
-Josh
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
I am very experienced with PGP and smartcards.
For GPG & PGP use I recommend the Gnupg OpenPGP smartcards available at
http://shop.kernelconcepts.de/ which supports 4096 keys these are the
best smartcards there are for GPG use. For getting started with GPG and
smartcards, my recommendation would be to:
1- Use an airgap system with linux, i.e. raspberry pi or spare laptop to
generate the keypair offline. Can use a live distro as another option.
Just be sure you generate the keys and upload to smartcard offline. If
generate GPG keys on a system that saves information i.e. something that
is not a live system, make sure you use whole disc encryption.
When using GPG use secure GPG configuration:
https://github.com/ioerror/duraconf/tree/master/configs/gnupg
2- When using GPG use gpg --gen-key --expert so we have more options.
Generate 4096 RSA with certification flag, then create 3 seperate
subkeys for each purpose (encrypt, signing, authentication). It is
better for crypto security to not use one key for more than one purpose.
After we have our primary key with the subkeys, we will want to generate
a revocation certifacte.
Here is a good guide:
https://alexcabal.com/creating-the-perfect-gpg-keypair/
3- We will want to then upload only the 3 subkeys to the smartcard. Then
change the default admin pin and user pin on smartcard. Never enter
admin pin on a non-airgapped system.
4- After generating key and uploading to smartcard, create backup of
your full keypair and revocation certificate onto a CD or DVD or USB
drive encrypted, then store in a safe place. If use encrypted media for
backup of keys and revoc cert NEVER forget your passcode.
Smartcards are best way to use PGP since your key is always protected,
though however if use smartcard is used there is a chance that a
keylogger could capture your pin code. If you are worried about an
adversary using a keylogger to log your pin then stealing your physical
card then you would want to use a smartcard reader that has built in pin
pad.
--
Cannon N. Ciota
Digital Identity (namecoin): id/cannon
Website: www.cannon-ciota.info
Email: can...@cannon-ciota.info
PGP Fingerprint: E7FB 0605 1BD4 8B88 B7BC 91A4 7DF7 76C7 25A6 AEE2
--
Cannon N. Ciota
Digital Identity (namecoin): id/cannon
Website: www.cannon-ciota.info
Email: can...@cannon-ciota.info
PGP Fingerprint: E7FB 0605 1BD4 8B88 B7BC 91A4 7DF7 76C7 25A6 AEE2
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
