Created
October 7, 2011 02:41
Revisions
-
KenMacD created this gist
Oct 7, 2011 .There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -0,0 +1,238 @@ # About # This is a local copy of the commands from: * http://www.jmknoble.net/keys/#master-key * http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys # Requirements # * Bootable offline cd with gpg: http://tails.boum.org # Initial Commands # ## Generate Master Key ## I choose 5 years for the master key, and 1 year for subkeys. They can be extended any time later, so I feel these are good numbers. Other people recommend making the master key never expire. $ gpg --expert --gen-key gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (7) DSA (set your own capabilities) (8) RSA (set your own capabilities) Your selection? 8 Possible actions for a RSA key: Sign Certify Encrypt Authenticate Current allowed actions: Sign Certify Encrypt (S) Toggle the sign capability (E) Toggle the encrypt capability (A) Toggle the authenticate capability (Q) Finished Your selection? s Possible actions for a RSA key: Sign Certify Encrypt Authenticate Current allowed actions: Certify Encrypt (S) Toggle the sign capability (E) Toggle the encrypt capability (A) Toggle the authenticate capability (Q) Finished Your selection? e Possible actions for a RSA key: Sign Certify Encrypt Authenticate Current allowed actions: Certify (S) Toggle the sign capability (E) Toggle the encrypt capability (A) Toggle the authenticate capability (Q) Finished Your selection? q RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 5y Key expires at Tue 4 Oct 22:32:57 2016 ADT Is this correct? (y/N) You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form: "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>" Real name: Kenny MacDermid Email address: Comment: You selected this USER-ID: "Kenny MacDermid" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o You need a Passphrase to protect your secret key. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. .....+++++ ..............+++++ gpg: key 5AD20E1D marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 4 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 4u gpg: next trustdb check due at 2012-10-05 pub 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05] Key fingerprint = 2B85 0108 8296 B9FC 4FB8 AC86 8A4D 4610 5AD2 0E1D uid Kenny MacDermid ## Generate the sub keys ## $ gpg --edit-key 5AD20E1D gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Secret key is available. pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C trust: ultimate validity: ultimate [ultimate] (1). Kenny MacDermid gpg> addkey Key is protected. You need a passphrase to unlock the secret key for user: "Kenny MacDermid" 4096-bit RSA key, ID 5AD20E1D, created 2011-10-07 Please select what kind of key you want: (3) DSA (sign only) (4) RSA (sign only) (5) Elgamal (encrypt only) (6) RSA (encrypt only) Your selection? 4 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 1y Key expires at Fri 5 Oct 22:42:39 2012 ADT Is this correct? (y/N) y Really create? (y/N) y We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. .........+++++ ............+++++ pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C trust: ultimate validity: ultimate sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S [ultimate] (1). Kenny MacDermid gpg> addkey Key is protected. You need a passphrase to unlock the secret key for user: "Kenny MacDermid" 4096-bit RSA key, ID 5AD20E1D, created 2011-10-07 Please select what kind of key you want: (3) DSA (sign only) (4) RSA (sign only) (5) Elgamal (encrypt only) (6) RSA (encrypt only) Your selection? 6 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 1y Key expires at Fri 5 Oct 22:43:07 2012 ADT Is this correct? (y/N) y Really create? (y/N) y We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. ....+++++ .+++++ pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C trust: ultimate validity: ultimate sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S sub 2048R/9B51554C created: 2011-10-07 expires: 2012-10-06 usage: E [ultimate] (1). Kenny MacDermid gpg> save ## Setup uids ## $ gpg --edit-key 5AD20E1D gpg> adduid For any ids needed. ## Export Keys ## $ gpg -a --export 5AD20E1D >pub.gpg $ gpg -a --export-secret-keys >sec.gpg $ gpg -a --export-secret-subkeys >sub.gpg ## Create Backups ## * Backup sec.gpg to a secure location to late sign subkeys * Backup all of ~/.gnupg/. It will be used as the GNUPGHOME for future subkeys. * Backup pub.gpg and sub.gpg to be imported on main machine ## Import sub keys (*not master*) ## $ gpg --import pub.gpg gpg: key 5AD20E1D: public key "Kenny MacDermid" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) $ gpg --import sub.gpg gpg: key 5AD20E1D: secret key imported gpg: secret keys imported: 1 $ gpg --list-secret-keys sec# 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05] uid Kenny MacDermid ssb 2048R/8DD8FF1A 2011-10-07 ssb 2048R/9B51554C 2011-10-07 The secret key should say *sec#* instead of sec. # TODO # * Signing new subkeys. * Signing other peoples keys. * Figure out importing signatures. * Generate and backup revocation certificate gpg --output revoke.asc --gen-revoke KEYNAME?