alexander/keys
1
0
Fork 0
Code Activity

Generate a new PGP key

Browse source 
Document how the new key was created
This commit is contained in:
Alexander Hess 2026-07-08 15:29:55 +02:00
commit 0211c311d4
Signed by: alexander
GPG key ID: D88F903B85326FFE
1 changed files with 113 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

121
KEYS.md
View file

@ -13,18 +13,19 @@ gpg --verify KEYS.md.asc KEYS.md
## Current Key ## Current Key
> PLACEHOLDER > [`8B11 40AD B518 5334 E9FA 513B 7568 1C81 6731 2680`](https://keys.openpgp.org/vks/v1/by-fingerprint/8B1140ADB5185334E9FA513B75681C8167312680)
on OpenPGP
| Field | Value | | Field | Value |
|-------------|-------------------------------------------------------| |-------------|-------------------------------------------------------|
| Fingerprint | `XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX` | | Fingerprint | `8B11 40AD B518 5334 E9FA 513B 7568 1C81 6731 2680` |
| Key ID | `XXXXXXXXXXXXXXXX` (fingerprint's last 16 chars) | | Key ID | `75681C8167312680` (fingerprint's last 16 chars) |
| Primary | ed25519 `[C]` OFFLINE (i.e., `sec#` on all machines) | | Primary | ed25519 `[C]` OFFLINE (i.e., `sec#` on all machines) |
| Subkey 1 | cv25519 `[E]` | | Subkey 1 | cv25519 `[E]` |
| Subkey 2 | ed25519 `[S]` internal | | Subkey 2 | ed25519 `[S]` internal |
| Created | 2026-MM-DD | | Created | 2026-07-08 |
| Expires | always **End of January** (next: 2027-MM-DD) | | Expires | always **End of January** (next: 2027-01-31) |
| Primary UID | `Alexander Hess <ah@alexander-hess.com>` | | Primary UID | `Alexander Hess <ah@alexander-hess.com>` |
| Other UID 1 | `Alexander Hess <alexander@webartifex.biz>` | | Other UID 1 | `Alexander Hess <alexander@webartifex.biz>` |
| Other UID 2 | `Alexander Hess <alexander@webartifex.de>` | | Other UID 2 | `Alexander Hess <alexander@webartifex.de>` |
@ -34,8 +35,8 @@ gpg --verify KEYS.md.asc KEYS.md
| Key ID | Type | Purpose | Expires | | Key ID | Type | Purpose | Expires |
|--------------------|------|----------------------------|------------| |--------------------|------|----------------------------|------------|
| `XXXXXXXXXXXXXXXX` | E | encryption | 2027-01-31 | | `253A7FFDDF34BE5E` | E | encryption | 2027-01-31 |
| `XXXXXXXXXXXXXXXX` | S | signing on my own machines | 2027-01-31 | | `B46EDB4DFC26805D` | S | signing on my own machines | 2027-01-31 |
### Policies ### Policies
@ -81,7 +82,7 @@ gpg --verify KEYS.md.asc KEYS.md
### Publication to Keyservers ### Publication to Keyservers
````bash ````bash
FPR=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX FPR=8B1140ADB5185334E9FA513B75681C8167312680
for KS in \ for KS in \
hkps://keys.openpgp.org \ hkps://keys.openpgp.org \
@ -98,3 +99,107 @@ done
=> Click the links mailed to all addresses => Click the links mailed to all addresses
- *Hockeypuck* servers (the other four) are append-only: They merge and never delete - *Hockeypuck* servers (the other four) are append-only: They merge and never delete
=> Run after *every* change => Run after *every* change
## Ceremonies
- The `gpg-agent` caches passphrases
=> Run `gpg-connect-agent reloadagent /bye`
before any step that must actually prompt
- Over `ssh`, the import may hang,
for example, if the agent tries to raise a graphical pinentry
=> `gpgconf --kill gpg-agent` and `gpg ... --pinentry-mode loopback`
(Note: `loopback` asks for a new passphrase only ONCE without confirmation)
- Scratch keyrings isolate any step from the main keyring:
```bash
# Disposable $GNUPGHOME
T=$(mktemp -d)
chmod 700 "$T"
# To scope any operation to "$T"
gpg --homedir "$T" ...
# To stop the scratch agent
gpgconf --homedir "$T" --kill gpg-agent
rm -rf "$T"
```
### To generate a brand-new Key
This section documents how we created the current key in the first place.
````bash
gpg --expert --full-generate-key
# (11) ECC (set your own) => toggle S off => only Certify => (1) Curve 25519
# expiry: end of NEXT January
# UID: Alexander Hess <ah@alexander-hess.com>
# passphrase: 32 random chars from Vaultwarden
gpg --edit-key <FPR>
adduid # Alexander Hess <alexander@webartifex.biz>
adduid # Alexander Hess <alexander@webartifex.de>
uid 1 # Select the UID to become the default...
primary # ...and flag it
addkey # (12) ECC (encrypt only) => Curve 25519 => same expiry
addkey # (10) ECC (sign only) => Curve 25519 => same expiry
save
gpg --list-secret-keys --with-subkey-fingerprints <FPR>
# => Vaultwarden login "Key Info" with all key IDs
gpg --gen-revoke <FPR>
# reason 1 = compromised
# => Vaultwarden note "Revocation Certificate"
gpg --armor --export-secret-keys <FPR>
# => Vaultwarden note "Full Secret Key"
````
Ensure everything goes into **Vaultwarden**.
Verify the keys from Vaultwarden *before* the destructive part below.
Split the keys so that machines only ever hold the subkeys
while the primary secret key stays in Vaultwarden only:
````bash
gpg --armor --export-secret-subkeys <FPR> > /tmp/subkeys.asc
gpg --delete-secret-keys <FPR>
gpg --import /tmp/subkeys.asc
gpg --list-secret-keys <FPR> # Must show sec# and two ssb!
````
Re-passphrase the deployed subkeys with a memorable phrase
for daily and headless signing:
````bash
gpg --edit-key <FPR>
passwd
quit
gpg --armor --export-secret-subkeys <FPR> > /tmp/subkeys-deploy.asc
# => Vaultwarden note "Deployed Secret Keys"
````
Verify the deploy keys from Vaultwarden with a scratch keyring,
sign test with the memorable phrase,
then distribute to the machines:
```bash
# On each machine:
gpgconf --kill gpg-agent
gpg --import subkeys-deploy.asc
echo "<FPR>:6:" | gpg --import-ownertrust
gpg --list-secret-keys <FPR> # Must show sec# and two ssb!
echo test | gpg --pinentry-mode loopback -u <S_SUBKEY_FPR>! --sign -o /dev/null
shred -u subkeys-deploy.asc
```
Finally, clean up the temporary files:
```bash
shred -u /tmp/subkeys.asc /tmp/subkeys-deploy.asc
```