Skip to content

Instantly share code, notes, and snippets.

@KenMacD
Created October 7, 2011 02:41

Revisions

  1. KenMacD created this gist Oct 7, 2011.
    238 changes: 238 additions & 0 deletions cmd.md
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,238 @@
    # About #

    This is a local copy of the commands from:

    * http://www.jmknoble.net/keys/#master-key
    * http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys

    # Requirements #

    * Bootable offline cd with gpg: http://tails.boum.org

    # Initial Commands #
    ## Generate Master Key ##

    I choose 5 years for the master key, and 1 year for subkeys. They can be
    extended any time later, so I feel these are good numbers. Other people
    recommend making the master key never expire.

    $ gpg --expert --gen-key
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Please select what kind of key you want:
    (1) RSA and RSA (default)
    (2) DSA and Elgamal
    (3) DSA (sign only)
    (4) RSA (sign only)
    (7) DSA (set your own capabilities)
    (8) RSA (set your own capabilities)
    Your selection? 8

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Sign Certify Encrypt

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? s

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Certify Encrypt

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? e

    Possible actions for a RSA key: Sign Certify Encrypt Authenticate
    Current allowed actions: Certify

    (S) Toggle the sign capability
    (E) Toggle the encrypt capability
    (A) Toggle the authenticate capability
    (Q) Finished

    Your selection? q
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048) 4096
    Requested keysize is 4096 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 5y
    Key expires at Tue 4 Oct 22:32:57 2016 ADT
    Is this correct? (y/N)

    You need a user ID to identify your key; the software constructs the user ID
    from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

    Real name: Kenny MacDermid
    Email address:
    Comment:
    You selected this USER-ID:
    "Kenny MacDermid"

    Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
    You need a Passphrase to protect your secret key.

    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    .....+++++
    ..............+++++
    gpg: key 5AD20E1D marked as ultimately trusted
    public and secret key created and signed.

    gpg: checking the trustdb
    gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
    gpg: depth: 0 valid: 4 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 4u
    gpg: next trustdb check due at 2012-10-05
    pub 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
    Key fingerprint = 2B85 0108 8296 B9FC 4FB8 AC86 8A4D 4610 5AD2 0E1D
    uid Kenny MacDermid

    ## Generate the sub keys ##

    $ gpg --edit-key 5AD20E1D
    gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Secret key is available.

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    [ultimate] (1). Kenny MacDermid

    gpg> addkey
    Key is protected.

    You need a passphrase to unlock the secret key for
    user: "Kenny MacDermid"
    4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

    Please select what kind of key you want:
    (3) DSA (sign only)
    (4) RSA (sign only)
    (5) Elgamal (encrypt only)
    (6) RSA (encrypt only)
    Your selection? 4
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 1y
    Key expires at Fri 5 Oct 22:42:39 2012 ADT
    Is this correct? (y/N) y
    Really create? (y/N) y
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    .........+++++
    ............+++++

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    [ultimate] (1). Kenny MacDermid

    gpg> addkey
    Key is protected.

    You need a passphrase to unlock the secret key for
    user: "Kenny MacDermid"
    4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

    Please select what kind of key you want:
    (3) DSA (sign only)
    (4) RSA (sign only)
    (5) Elgamal (encrypt only)
    (6) RSA (encrypt only)
    Your selection? 6
    RSA keys may be between 1024 and 4096 bits long.
    What keysize do you want? (2048)
    Requested keysize is 2048 bits
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 1y
    Key expires at Fri 5 Oct 22:43:07 2012 ADT
    Is this correct? (y/N) y
    Really create? (y/N) y
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    ....+++++
    .+++++

    pub 4096R/5AD20E1D created: 2011-10-07 expires: 2016-10-05 usage: C
    trust: ultimate validity: ultimate
    sub 2048R/8DD8FF1A created: 2011-10-07 expires: 2012-10-06 usage: S
    sub 2048R/9B51554C created: 2011-10-07 expires: 2012-10-06 usage: E
    [ultimate] (1). Kenny MacDermid

    gpg> save

    ## Setup uids ##
    $ gpg --edit-key 5AD20E1D
    gpg> adduid

    For any ids needed.

    ## Export Keys ##

    $ gpg -a --export 5AD20E1D >pub.gpg
    $ gpg -a --export-secret-keys >sec.gpg
    $ gpg -a --export-secret-subkeys >sub.gpg

    ## Create Backups ##

    * Backup sec.gpg to a secure location to late sign subkeys
    * Backup all of ~/.gnupg/. It will be used as the GNUPGHOME for future subkeys.
    * Backup pub.gpg and sub.gpg to be imported on main machine

    ## Import sub keys (*not master*) ##

    $ gpg --import pub.gpg
    gpg: key 5AD20E1D: public key "Kenny MacDermid" imported
    gpg: Total number processed: 1
    gpg: imported: 1 (RSA: 1)
    $ gpg --import sub.gpg
    gpg: key 5AD20E1D: secret key imported
    gpg: secret keys imported: 1
    $ gpg --list-secret-keys
    sec# 4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
    uid Kenny MacDermid
    ssb 2048R/8DD8FF1A 2011-10-07
    ssb 2048R/9B51554C 2011-10-07

    The secret key should say *sec#* instead of sec.

    # TODO #

    * Signing new subkeys.
    * Signing other peoples keys.
    * Figure out importing signatures.
    * Generate and backup revocation certificate
    gpg --output revoke.asc --gen-revoke KEYNAME?