|
|
|
@ -23,157 +23,155 @@ Admin PIN: 12345678 |
|
|
|
</pre> |
|
|
|
Good, let's start with key generation : |
|
|
|
<pre> |
|
|
|
$ gpg --card-edit |
|
|
|
gpg: directory '/home/user/.gnupg' created |
|
|
|
gpg: keybox '/home/user/.gnupg/pubring.kbx' created |
|
|
|
|
|
|
|
Reader ...........: Yubico YubiKey OTP FIDO CCID 00 00 |
|
|
|
Application ID ...: D2760001240103040006152800150000 |
|
|
|
Application type .: OpenPGP |
|
|
|
Version ..........: 3.4 |
|
|
|
Manufacturer .....: Yubico |
|
|
|
Serial number ....: 15280015 |
|
|
|
Name of cardholder: [not set] |
|
|
|
Language prefs ...: [not set] |
|
|
|
Salutation .......: |
|
|
|
URL of public key : [not set] |
|
|
|
Login data .......: [not set] |
|
|
|
Signature PIN ....: not forced |
|
|
|
Key attributes ...: rsa2048 rsa2048 rsa2048 |
|
|
|
Max. PIN lengths .: 127 127 127 |
|
|
|
PIN retry counter : 3 0 3 |
|
|
|
Signature counter : 0 |
|
|
|
KDF setting ......: off |
|
|
|
Signature key ....: [none] |
|
|
|
Encryption key....: [none] |
|
|
|
Authentication key: [none] |
|
|
|
General key info..: [none] |
|
|
|
gpg/card> admin |
|
|
|
Admin commands are allowed |
|
|
|
gpg/card> admin |
|
|
|
Admin commands are allowed |
|
|
|
|
|
|
|
gpg/card> key-attr |
|
|
|
Changing card key attribute for: Signature key |
|
|
|
Please select what kind of key you want: |
|
|
|
$ <b>gpg --card-edit</b> |
|
|
|
gpg: directory '/home/user/.gnupg' created |
|
|
|
gpg: keybox '/home/user/.gnupg/pubring.kbx' created |
|
|
|
|
|
|
|
Reader ...........: Yubico YubiKey OTP FIDO CCID 00 00 |
|
|
|
Application ID ...: D2760001240103040006152800150000 |
|
|
|
Application type .: OpenPGP |
|
|
|
Version ..........: 3.4 |
|
|
|
Manufacturer .....: Yubico |
|
|
|
Serial number ....: 15280015 |
|
|
|
Name of cardholder: [not set] |
|
|
|
Language prefs ...: [not set] |
|
|
|
Salutation .......: |
|
|
|
URL of public key : [not set] |
|
|
|
Login data .......: [not set] |
|
|
|
Signature PIN ....: not forced |
|
|
|
Key attributes ...: rsa2048 rsa2048 rsa2048 |
|
|
|
Max. PIN lengths .: 127 127 127 |
|
|
|
PIN retry counter : 3 0 3 |
|
|
|
Signature counter : 0 |
|
|
|
KDF setting ......: off |
|
|
|
Signature key ....: [none] |
|
|
|
Encryption key....: [none] |
|
|
|
Authentication key: [none] |
|
|
|
General key info..: [none] |
|
|
|
gpg/card> <b>admin</b> |
|
|
|
Admin commands are allowed |
|
|
|
|
|
|
|
gpg/card> <b>key-attr</b> |
|
|
|
Changing card key attribute for: Signature key |
|
|
|
Please select what kind of key you want: |
|
|
|
(1) RSA |
|
|
|
(2) ECC |
|
|
|
Your selection? 2 |
|
|
|
Please select which elliptic curve you want: |
|
|
|
Your selection? <b>2</b> |
|
|
|
Please select which elliptic curve you want: |
|
|
|
(1) Curve 25519 |
|
|
|
(4) NIST P-384 |
|
|
|
Your selection? 1 |
|
|
|
The card will now be re-configured to generate a key of type: ed25519 |
|
|
|
Note: There is no guarantee that the card supports the requested size. |
|
|
|
Your selection? <b>1</b> |
|
|
|
The card will now be re-configured to generate a key of type: ed25519 |
|
|
|
Note: There is no guarantee that the card supports the requested size. |
|
|
|
If the key generation does not succeed, please check the |
|
|
|
documentation of your card to see what sizes are allowed. |
|
|
|
Changing card key attribute for: Encryption key |
|
|
|
Please select what kind of key you want: |
|
|
|
Changing card key attribute for: Encryption key |
|
|
|
Please select what kind of key you want: |
|
|
|
(1) RSA |
|
|
|
(2) ECC |
|
|
|
Your selection? 2 |
|
|
|
Please select which elliptic curve you want: |
|
|
|
Your selection? <b>2</b> |
|
|
|
Please select which elliptic curve you want: |
|
|
|
(1) Curve 25519 |
|
|
|
(4) NIST P-384 |
|
|
|
Your selection? 1 |
|
|
|
The card will now be re-configured to generate a key of type: cv25519 |
|
|
|
Changing card key attribute for: Authentication key |
|
|
|
Please select what kind of key you want: |
|
|
|
Your selection? <b>1</b> |
|
|
|
The card will now be re-configured to generate a key of type: cv25519 |
|
|
|
Changing card key attribute for: Authentication key |
|
|
|
Please select what kind of key you want: |
|
|
|
(1) RSA |
|
|
|
(2) ECC |
|
|
|
Your selection? 2 |
|
|
|
Please select which elliptic curve you want: |
|
|
|
Your selection? <b>2</b> |
|
|
|
Please select which elliptic curve you want: |
|
|
|
(1) Curve 25519 |
|
|
|
(4) NIST P-384 |
|
|
|
Your selection? 1 |
|
|
|
Your selection? <b>1</b> |
|
|
|
The card will now be re-configured to generate a key of type: ed25519 |
|
|
|
|
|
|
|
gpg/card> generate |
|
|
|
Make off-card backup of encryption key? (Y/n) n |
|
|
|
gpg/card> <b>generate</b> |
|
|
|
Make off-card backup of encryption key? (Y/n) n |
|
|
|
|
|
|
|
Please note that the factory settings of the PINs are |
|
|
|
Please note that the factory settings of the PINs are |
|
|
|
PIN = '123456' Admin PIN = '12345678' |
|
|
|
You should change them using the command --change-pin |
|
|
|
You should change them using the command --change-pin |
|
|
|
|
|
|
|
Please specify how long the key should be valid. |
|
|
|
Please specify how long the key should be valid. |
|
|
|
0 = key does not expire |
|
|
|
<n> = key expires in n days |
|
|
|
<n>w = key expires in n weeks |
|
|
|
<n>m = key expires in n months |
|
|
|
<n>y = key expires in n years |
|
|
|
Key is valid for? (0) |
|
|
|
Key does not expire at all |
|
|
|
Is this correct? (y/N) y |
|
|
|
Key is valid for? (0) |
|
|
|
Key does not expire at all |
|
|
|
Is this correct? (y/N) <b>y</b> |
|
|
|
|
|
|
|
GnuPG needs to construct a user ID to identify your key. |
|
|
|
GnuPG needs to construct a user ID to identify your key. |
|
|
|
|
|
|
|
Real name: Dummy |
|
|
|
Email address: dummy@dummy.co |
|
|
|
Comment: |
|
|
|
You selected this USER-ID: |
|
|
|
Real name: Dummy |
|
|
|
Email address: dummy@dummy.co |
|
|
|
Comment: |
|
|
|
You selected this USER-ID: |
|
|
|
"Dummy <dummy@dummy.co>" |
|
|
|
|
|
|
|
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O |
|
|
|
gpg: /home/user/.gnupg/trustdb.gpg: trustdb created |
|
|
|
gpg: key B4A67FB911B1ED6B marked as ultimately trusted |
|
|
|
gpg: directory '/home/user/.gnupg/openpgp-revocs.d' created |
|
|
|
gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/A157C7E15F3D6C7445B40626B4A67FB911B1ED6B.rev' |
|
|
|
public and secret key created and signed. |
|
|
|
|
|
|
|
gpg/card> list |
|
|
|
|
|
|
|
Reader ...........: Yubico YubiKey OTP FIDO CCID 00 00 |
|
|
|
Application ID ...: D2760001240103040006152800150000 |
|
|
|
Application type .: OpenPGP |
|
|
|
Version ..........: 3.4 |
|
|
|
Manufacturer .....: Yubico |
|
|
|
Serial number ....: 15280015 |
|
|
|
Name of cardholder: [not set] |
|
|
|
Language prefs ...: [not set] |
|
|
|
Salutation .......: |
|
|
|
URL of public key : [not set] |
|
|
|
Login data .......: [not set] |
|
|
|
Signature PIN ....: not forced |
|
|
|
Key attributes ...: ed25519 cv25519 ed25519 |
|
|
|
Max. PIN lengths .: 127 127 127 |
|
|
|
PIN retry counter : 3 0 3 |
|
|
|
Signature counter : 4 |
|
|
|
KDF setting ......: off |
|
|
|
Signature key ....: A157 C7E1 5F3D 6C74 45B4 0626 B4A6 7FB9 11B1 ED6B |
|
|
|
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O |
|
|
|
gpg: /home/user/.gnupg/trustdb.gpg: trustdb created |
|
|
|
gpg: key B4A67FB911B1ED6B marked as ultimately trusted |
|
|
|
gpg: directory '/home/user/.gnupg/openpgp-revocs.d' created |
|
|
|
gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/A157C7E15F3D6C7445B40626B4A67FB911B1ED6B.rev' |
|
|
|
public and secret key created and signed. |
|
|
|
|
|
|
|
gpg/card> list |
|
|
|
|
|
|
|
Reader ...........: Yubico YubiKey OTP FIDO CCID 00 00 |
|
|
|
Application ID ...: D2760001240103040006152800150000 |
|
|
|
Application type .: OpenPGP |
|
|
|
Version ..........: 3.4 |
|
|
|
Manufacturer .....: Yubico |
|
|
|
Serial number ....: 15280015 |
|
|
|
Name of cardholder: [not set] |
|
|
|
Language prefs ...: [not set] |
|
|
|
Salutation .......: |
|
|
|
URL of public key : [not set] |
|
|
|
Login data .......: [not set] |
|
|
|
Signature PIN ....: not forced |
|
|
|
Key attributes ...: ed25519 cv25519 ed25519 |
|
|
|
Max. PIN lengths .: 127 127 127 |
|
|
|
PIN retry counter : 3 0 3 |
|
|
|
Signature counter : 4 |
|
|
|
KDF setting ......: off |
|
|
|
Signature key ....: A157 C7E1 5F3D 6C74 45B4 0626 B4A6 7FB9 11B1 ED6B |
|
|
|
created ....: 2020-10-05 09:45:47 |
|
|
|
Encryption key....: 2B46 118B DEB3 4AAC 4951 63DE 286C 74DF 1104 5D46 |
|
|
|
Encryption key....: 2B46 118B DEB3 4AAC 4951 63DE 286C 74DF 1104 5D46 |
|
|
|
created ....: 2020-10-05 09:45:47 |
|
|
|
Authentication key: FFE2 8767 DD98 CD3F 587A 19F9 B1B9 E836 16EF 39E7 |
|
|
|
Authentication key: FFE2 8767 DD98 CD3F 587A 19F9 B1B9 E836 16EF 39E7 |
|
|
|
created ....: 2020-10-05 09:45:47 |
|
|
|
General key info..: |
|
|
|
pub ed25519/B4A67FB911B1ED6B 2020-10-05 Dummy <dummy@dummy.co> |
|
|
|
sec> ed25519/B4A67FB911B1ED6B created: 2020-10-05 expires: never |
|
|
|
General key info..: |
|
|
|
pub ed25519/B4A67FB911B1ED6B 2020-10-05 Dummy <dummy@dummy.co> |
|
|
|
sec> ed25519/B4A67FB911B1ED6B created: 2020-10-05 expires: never |
|
|
|
card-no: 0006 15280015 |
|
|
|
ssb> ed25519/B1B9E83616EF39E7 created: 2020-10-05 expires: never |
|
|
|
ssb> ed25519/B1B9E83616EF39E7 created: 2020-10-05 expires: never |
|
|
|
card-no: 0006 15280015 |
|
|
|
ssb> cv25519/286C74DF11045D46 created: 2020-10-05 expires: never |
|
|
|
ssb> cv25519/286C74DF11045D46 created: 2020-10-05 expires: never |
|
|
|
card-no: 0006 15280015 |
|
|
|
gpg/card> quit |
|
|
|
pub ed25519 2020-10-05 [SC] |
|
|
|
gpg/card> quit |
|
|
|
pub ed25519 2020-10-05 [SC] |
|
|
|
A157C7E15F3D6C7445B40626B4A67FB911B1ED6B |
|
|
|
uid Dummy <dummy@dummy.co> |
|
|
|
sub ed25519 2020-10-05 [A] |
|
|
|
sub cv25519 2020-10-05 [E] |
|
|
|
|
|
|
|
$ ssh-add -L |
|
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGzO7860chQPMw0NuLDhBqZd1IcfIqBnvy4GSbzZd4vu cardno:000615280015 |
|
|
|
|
|
|
|
$ mkdir sshca |
|
|
|
$ ssh-keygen -t ed25519 -N '' -C 'Test CA' -f sshca/ca |
|
|
|
$ cat sshca/ca.pub |
|
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAL7l1sQuKe4daLfKGZuiRPZZXquokQyH+p6utlZxZ+ Test CA |
|
|
|
$ ssh-add -L > sshca/id_ed25519.pub |
|
|
|
$ ssh-keygen -s sshca/ca -I test-dummy sshca/id_ed25519.pub |
|
|
|
Signed user key sshca/id_ed25519-cert.pub: id "test-dummy" serial 0 valid forever |
|
|
|
$ mkdir ~/.ssh |
|
|
|
$ cp sshca/id_ed25519-cert.pub ~/.ssh/ |
|
|
|
$ ssh-keygen -Lf .ssh/id_ed25519-cert.pub |
|
|
|
.ssh/id_ed25519-cert.pub: |
|
|
|
uid Dummy <dummy@dummy.co> |
|
|
|
sub ed25519 2020-10-05 [A] |
|
|
|
sub cv25519 2020-10-05 [E] |
|
|
|
|
|
|
|
$ ssh-add -L |
|
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGzO7860chQPMw0NuLDhBqZd1IcfIqBnvy4GSbzZd4vu cardno:000615280015 |
|
|
|
|
|
|
|
$ mkdir sshca |
|
|
|
$ ssh-keygen -t ed25519 -N '' -C 'Test CA' -f sshca/ca |
|
|
|
$ cat sshca/ca.pub |
|
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAL7l1sQuKe4daLfKGZuiRPZZXquokQyH+p6utlZxZ+ Test CA |
|
|
|
$ ssh-add -L > sshca/id_ed25519.pub |
|
|
|
$ ssh-keygen -s sshca/ca -I test-dummy sshca/id_ed25519.pub |
|
|
|
Signed user key sshca/id_ed25519-cert.pub: id "test-dummy" serial 0 valid forever |
|
|
|
$ mkdir ~/.ssh |
|
|
|
$ cp sshca/id_ed25519-cert.pub ~/.ssh/ |
|
|
|
$ ssh-keygen -Lf .ssh/id_ed25519-cert.pub |
|
|
|
.ssh/id_ed25519-cert.pub: |
|
|
|
Type: ssh-ed25519-cert-v01@openssh.com user certificate |
|
|
|
Public key: ED25519-CERT SHA256:fuoQ5RdcNRAj0VAyw/vqA584nNW2HMYNGk4NQEFjTSM |
|
|
|
Signing CA: ED25519 SHA256:2PibPv047BiDZQgl51bKRnY2ZXpcbAP1g7GjAZ0DArI (using ssh-ed25519) |
|
|
|
|
