Skip to content

Instantly share code, notes, and snippets.

@Techwolf12
Forked from abeluck/gpg-offline-master.md
Last active June 21, 2016 14:14
Show Gist options
  • Save Techwolf12/a0bcf9280d3ce7d9de975374ce9074da to your computer and use it in GitHub Desktop.
Save Techwolf12/a0bcf9280d3ce7d9de975374ce9074da to your computer and use it in GitHub Desktop.
GPG Offline Master Key w/ smartcard

Generate Master Key

I choose no expiration keys.

We generate the master key using the --expert flag to make sure the master key can only "certify" (sign other keys), and not sign or perform encryption.

$ gpg --expert --gen-key
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
Your selection? 8

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? e

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 5y
Key expires at Tue  4 Oct 22:32:57 2016 ADT
Is this correct? (y/N) 

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <[email protected]>"

Real name: Kenny MacDermid
Email address: 
Comment: 
You selected this USER-ID:
    "Kenny MacDermid"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.....+++++
..............+++++
gpg: key 5AD20E1D marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   4  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: next trustdb check due at 2012-10-05
pub   4096R/5AD20E1D 2011-10-07 [expires: 2016-10-05]
      Key fingerprint = 2B85 0108 8296 B9FC 4FB8  AC86 8A4D 4610 5AD2 0E1D
uid                  Kenny MacDermid

Generate the sub keys

First we add the signing subkey, then the encryption subkey. Both are 3072 bits.

$ gpg --edit-key 5AD20E1D
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
[ultimate] (1). Kenny MacDermid

gpg> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Kenny MacDermid"
4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 3072
Requested keysize is 3072 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri  5 Oct 22:42:39 2012 ADT
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.........+++++
............+++++

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
sub  3072R/8DD8FF1A  created: 2011-10-07  expires: 2012-10-06  usage: S   
[ultimate] (1). Kenny MacDermid

gpg> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Kenny MacDermid"
4096-bit RSA key, ID 5AD20E1D, created 2011-10-07

Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
Your selection? 6
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 3072
Requested keysize is 3072 bits
Please specify how long the key should be valid.
     0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri  5 Oct 22:43:07 2012 ADT
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
....+++++
.+++++

pub  4096R/5AD20E1D  created: 2011-10-07  expires: 2016-10-05  usage: C   
             trust: ultimate      validity: ultimate
sub  3072R/8DD8FF1A  created: 2011-10-07  expires: 2012-10-06  usage: S   
sub  3072R/9B51554C  created: 2011-10-07  expires: 2012-10-06  usage: E   
[ultimate] (1). Kenny MacDermid

gpg> save

Setup uids

UIDs can be added or deleted at any point in time. Just edit the key ID of your master key.

$ gpg --edit-key 5AD20E1D
gpg> adduid

If you type help at the gpg> prompt you can see other commands that let you perform other actions such as deleting uids.

Create Backups

Export the secret key for your identity key:

 $ gpg -a --export-secret-keys > master-secret-key.gpg

Export the secret keys for your subkeys (does NOT include master secret key):

 $ gpg -a --export-secret-subkeys > sub-secret-keys.gpg

Save Backups

Backup the following to the super-safe USB stick that is never plugged in to an online machine. Store this USB stick in your ork guarded vault:

  1. master-secret-key.gpg - copy of your master secret key
  2. sub-secret-keys.gpg - copy of your secret sub keys
  3. ~/.gnupg - your entire keyring. It will be used as the GNUPGHOME for future subkeys.

Export Public Key

Export the public key for your identity key:

 $ gpg -a --export 5AD20E1D > pub-key.gpg
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment