Skip to content

Instantly share code, notes, and snippets.

@KenMacD

KenMacD/cmd.md

Created October 7, 2011 02:41
Show Gist options
  • Save KenMacD/1269309 to your computer and use it in GitHub Desktop.
Save KenMacD/1269309 to your computer and use it in GitHub Desktop.
Download ZIP
GPG Offline Master Key
Raw
cmd.md

About

This is a local copy of the commands from:

Requirements

Initial Commands

Generate Master Key

I choose 5 years for the master key, and 1 year for subkeys. They can be extended any time later, so I feel these are good numbers. Other people recommend making the master key never expire.

$ gpg --expert --gen-key
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
Your selection? 8

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? e

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 5y
Key expires at Tue  4 Oct 22:32:57 2016 ADT
Is this correct? (y/N) 

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <[email protected]>"

Real name: Kenny MacDermid
Email address: 
Comment: 
You selected this USER-ID:
    "Kenny MacDermid"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.....+++++
..............+++++
gpg: key 5AD20E1D marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   4  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: next trustdb check due at 2012-10-05
pub   4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
      Key fingerprint = 2B85 0108 8296 B9FC 4FB8  AC86 8A4D 4610 5AD2 0E1D
uid                  Kenny MacDermid

Generate the sub keys

$ gpg --edit-key 5AD20E1D
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
[ultimate] (1). Kenny MacDermid

gpg> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Kenny MacDermid"
4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 
Requested keysize is 2048 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri  5 Oct 22:42:39 2012 ADT
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.........+++++
............+++++

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
sub  2048R/8DD8FF1A  created: 2011-10-07  expires: 2012-10-06  usage: S   
[ultimate] (1). Kenny MacDermid

gpg> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Kenny MacDermid"
4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
Your selection? 6
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 
Requested keysize is 2048 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri  5 Oct 22:43:07 2012 ADT
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
....+++++
.+++++

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
sub  2048R/8DD8FF1A  created: 2011-10-07  expires: 2012-10-06  usage: S   
sub  2048R/9B51554C  created: 2011-10-07  expires: 2012-10-06  usage: E   
[ultimate] (1). Kenny MacDermid

gpg> save

Setup uids

$ gpg --edit-key 5AD20E1D
gpg> adduid

For any ids needed.

Export Keys

 $ gpg -a --export 5AD20E1D >pub.gpg
 $ gpg -a --export-secret-keys >sec.gpg
 $ gpg -a --export-secret-subkeys >sub.gpg

Create Backups

  • Backup sec.gpg to a secure location to late sign subkeys
  • Backup all of ~/.gnupg/. It will be used as the GNUPGHOME for future subkeys.
  • Backup pub.gpg and sub.gpg to be imported on main machine

Import sub keys (not master)

$ gpg --import pub.gpg
gpg: key 5AD20E1D: public key "Kenny MacDermid" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
$ gpg --import sub.gpg
gpg: key 5AD20E1D: secret key imported
gpg:   secret keys imported: 1
$ gpg --list-secret-keys
sec#  4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
uid                  Kenny MacDermid
ssb   2048R/8DD8FF1A 2011-10-07
ssb   2048R/9B51554C 2011-10-07

The secret key should say sec# instead of sec.

TODO

  • Signing new subkeys.
  • Signing other peoples keys.
  • Figure out importing signatures.
  • Generate and backup revocation certificate gpg --output revoke.asc --gen-revoke KEYNAME?
@aprescott
Copy link

I think maybe you're missing a gpg --delete-secret-key 5AD20E1D after the export and before the import, to delete the private part of the master key so that only subkeys are usable.

@aprescott
Copy link

Weirdly, it isn't needed, even though it's used in the macfreek.nl article. I guess because you're using --expert.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment