GnuPG and SmartCards

Published at January 18, 2016

To ensure that GnuPG (Manpage) or PKCS#11 keys can no longer be stolen by a virus or similar, they can instead be stored on an external hardware security module (HSM) or a SmartCard. The objective of this blog article is to show how a GnuPG key is created according to "best current practice" and then saved on a SmartCard (e.g. Yubikey or Nitrokey). The same would also be possible with a PKCS#11 key, however, this is not covered in more detail here, but the process should be similar. In this example, a GnuPG key is created, which has three subkeys (encryption, signing und authentication). Only the subkeys are then loaded onto the SmartCard. The master key itself is saved in a file, which should finally be stored offline in a location that is as secure as possible. The advantage of this setup is that the keys can no longer be changed without the master key, (expiration date, UIDs, subkeys, ...).

Create GnuPG key

$ gpg2 --expert --full-gen-key
Please select what kind of key you want:
  (1) RSA and RSA (default)
  (2) DSA and Elgamal
  (3) DSA (sign only)
  (4) RSA (sign only)
  (7) DSA (set your own capabilities)
  (8) RSA (set your own capabilities)
  (9) ECC and ECC
 (10) ECC (sign only)
 (11) ECC (set your own capabilities)
Your selection? 8


Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Sign Certify Encrypt


(S) Toggle the sign capability
  (E) Toggle the encrypt capability
  (A) Toggle the authenticate capability
  (Q) Finished


Your selection? s


Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Certify Encrypt


(S) Toggle the sign capability
  (E) Toggle the encrypt capability
  (A) Toggle the authenticate capability
  (Q) Finished


Your selection? e


Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Certify


(S) Toggle the sign capability
  (E) Toggle the encrypt capability
  (A) Toggle the authenticate capability
  (Q) Finished


Your selection? q
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
        0 = key does not expire
       = key expires in n days
     w = key expires in n weeks
     m = key expires in n months
     y = key expires in n years
Key is valid for? (0) 3y
Key expires at Sam 15 Feb 2020 09:27:17 CET
Is this correct? (y/N) y


GnuPG needs to construct a user ID to identify your key.


Real name: Pallando
Email address: [email protected]
Comment:
You selected this USER-ID:
   "Pallando "


Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o


pub   rsa4096/0x0DA3852689C0BC38 2017-02-15 [C] [expires: 2020-02-15]
     01691D7408369C26A5B7D9390DA3852689C0BC38
     Key fingerprint = 0169 1D74 0836 9C26 A5B7  D939 0DA3 8526 89C0 BC38
uid                              Pallando

Expand GnuPG key with the subkeys

In the key above, there is only one UID and one subkey. This is now expanded with the other subkeys. ``` $ gpg2 --expert --edit-key 0x0DA3852689C0BC38

sec rsa4096/0x0DA3852689C0BC38 created: 2017-02-15 expires: 2020-02-15 usage: C trust: ultimate validity: ultimate [ultimate] (1). Pallando

gpg> addkey Please select what kind of key you want: (3) DSA (sign only) (4) RSA (sign only) (5) Elgamal (encrypt only) (6) RSA (encrypt only) (7) DSA (set your own capabilities) (8) RSA (set your own capabilities) (10) ECC (sign only) (11) ECC (set your own capabilities) (12) ECC (encrypt only) (13) Existing key Your selection? 8

Possible actions for a RSA key: Sign Encrypt Authenticate Current allowed actions: Sign Encrypt