dadada/dadada.li
dadada/dadada.li
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reformat using prettier

Browse source
This commit is contained in:
Tim Schubert 2023-11-14 19:05:16 +01:00
parent eeac83e132
commit 210dc82ee9
Signed by: dadada
SSH key fingerprint: SHA256:bFAjFH3hR8zRBaJjzQDjc3o4jqoq5EZ87l+KXEjxIz0
6 changed files with 395 additions and 215 deletions
Download patch file Download diff file Expand all files Collapse all files

68
blog/gpg/index.html
View file

@ -1,19 +1,31 @@
<!DOCTYPE html>
<html lang="en-us">
<head>
<meta charset="utf-8">
<meta charset="utf-8" />
<title>dadada's web log</title>
<link rel="alternate" type="application/atom+xml" href="https://dadada.li/feed.xml" title="dadada">
<link
rel="alternate"
type="application/atom+xml"
href="https://dadada.li/feed.xml"
title="dadada"
/>
</head>
<body style="min-width:30em; max-width:60em; margin-left:auto; margin-right:auto">
<body
style="
min-width: 30em;
max-width: 60em;
margin-left: auto;
margin-right: auto;
"
>
<header>
<nav>
<nav>
<a href="https://dadada.li/">dadada</a>
</nav>
</header>
<main>
</nav>
</header>
<main>
<h1>Managing Stripped GPG Keys</h1>
<pre>
<pre>
+--(master pass) +----(user pass)--+
| | | |
| decrypts decrypts decrypts
@ -33,23 +45,33 @@ decrypts +----------------+ +----------+ +-----------+
+->| SEA (master) |
| remote on paper |
+-----------------+
</pre>
</pre>
<p>
See <a href="https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/">here</a> on how to strip the master key (sec) from your keyring and create secret subkeys (ssb) for daily active use.
The master key can sign (S) new subkeys, create certificates (C) and provide authentication (A).
The master key lives forever, while the ssb that is used for signing is created with an expiration date.
All encryption keys may remain valid indefinitely until revoked.
The master key can be used to revoke the subkeys.
See
<a
href="https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/"
>here</a
>
on how to strip the master key (sec) from your keyring and create secret
subkeys (ssb) for daily active use. The master key can sign (S) new
subkeys, create certificates (C) and provide authentication (A). The
master key lives forever, while the ssb that is used for signing is
created with an expiration date. All encryption keys may remain valid
indefinitely until revoked. The master key can be used to revoke the
subkeys.
</p>
<p>
A few considerations
<ul>
<li>use a separate PIN on the trusted system / for the master key (sec) in case a key-logger reads the PIN on a semi-trusted machine (e.g. laptop or android) when decrypting a secret subkey (ssb)</li>
<li>use subkey (A) for authenticating ssh</li>
<li>keep master key offline / air-gapped</li>
</ul
</p>
<p>A few considerations</p>
<ul>
<li>
use a separate PIN on the trusted system / for the master key (sec) in
case a key-logger reads the PIN on a semi-trusted machine (e.g. laptop
or android) when decrypting a secret subkey (ssb)
</li>
<li>use subkey (A) for authenticating ssh</li>
<li>keep master key offline / air-gapped</li>
</ul>
</main>
<footer>Released: 2017-12-03</footer>
<footer>Released: 2017-12-03</footer>
</body>
</html>