Gpgkeys http fetch error 1 unsupported protocol

Why does gpg fail to fetch key stubs from my smart card? I recently got a Yubikey and loaded keys onto it following the directions here. gpg successfully reads and writes to the card, and I can see the key fingerprints from it it. However, when I try to use gpg —edit-card then fetch […]

Содержание

  1. Why does gpg fail to fetch key stubs from my smart card?
  2. 1 Answer 1
  3. GPG Smart Card Mini-How-To
  4. Mini-How-To
  5. Use Keys on Card
  6. Use with pass
  7. Failed to fetch the gpg key from keys.gnupg.net #3544
  8. Comments

Why does gpg fail to fetch key stubs from my smart card?

I recently got a Yubikey and loaded keys onto it following the directions here. gpg successfully reads and writes to the card, and I can see the key fingerprints from it it. However, when I try to use gpg —edit-card then fetch to get the key stubs, nothing happens. There is no error, but also my keys do not appear.

When I check journalctl -f , there is a message from dirmngr :

man gpg sends me to the gnupg.org documentation, which gives instructions for transferring keys to the card (Section 5.2.2), but only says «You can sign, de- and encrypt files the usual way». My end goal is to use pass to securely store passwords, but when I try to use it in the usual way, I see gpg: decryption failed: No secret key .

What should I do differently?

I am using Arch Linux with gnupg from the main repository, version 2.2.15-1.

For reference, here is a complete listing of my gpg session:

1 Answer 1

GPG Smart Card Mini-How-To

Short Answer

It seems the secret keys are properly copied to the Yubikey smart card. However, the public key is missing from the local keyring. In order for gpg to work properly, the public key must be available locally.

There are several methods to import the public key. However, there is a handy field on the smart card for storing a URL where the public key can be found. So, if the public key is placed in a publicly accessible location on the Internet, the public key can be retrieved and added to the local keyring by using the fetch option in either the gpg/card menu or the —fetch-keys URL option on the gpg command line.

Once the local keyring knows about the public key, the private keys stored on the smart card should operate normally using the set user pin to unlock the keys.

Mini-How-To

This tutorial will run through the creation of a passphraseless PGP key set, loading the secret keys on a smart card, posting the public key on the Internet, and basic use of the card.

Please note that the key included on this post is a test and demonstration key only. It has no passphrase and can be imported locally via copy and paste if so desired. However, please do not use this test key for any purpose except testing.

GPG Version

gpg —version gpg (GnuPG) 2.2.12 libgcrypt 1.8.4

Key generation

Let’s generate a key to play with:

Here’s the secret key

gpg —armor —export-secret-key demo.card@domain.tld

Key Listing

gpg —edit-key F1663A6A94793987

Placing the Public Key online somewhere

gpg -a —export F1663A6A94793987

Add keys and URL to card

gpg —edit-key F1663A6A94793987

Delete the keys from the keyring

gpg —delete-secret-keys F1663A6A94793987

gpg —delete-keys F1663A6A94793987

Similar state as the OP

Use Keys on Card

Retrieve Public Key

Almost Ready for Use

gpg —edit-key F1663A6A94793987

What happened to the Trust of the key?

GPG stores trust separately from the key material. This trust setting is what enables the Web of Trust. So, when a given key is imported into a local keyring, that key is not assigned a trust level. However, this is easy to change interactively.

gpg —edit-key F1663A6A94793987

Now the key is fully ready

gpg —list-key F1663A6A94793987

Let’s try it out

gpg -ear F1663A6A94793987

Use with pass

pass init F1663A6A94793987

pass insert password1

pass show password1

Usage notes

If a given password store is initialized with a key that is not located on a card. The pass script will not be able to locate the secret key if it is then moved to a smart card.

Источник

Failed to fetch the gpg key from keys.gnupg.net #3544

Test done on a Debian 8.2, on a docker.

It’s strange, the server ping

With another key server, it works

The text was updated successfully, but these errors were encountered:

I can pull it down just fine:

Do you mind trying again and report back if you still see the issue?

It’s a bug with gpg

Lets try with gnupg2 on a Debian. It needs some X11 packages.

When I put «nameserver 8.8.8.8» in /etc/resolv.conf it works.

The bug happens with docker-machine + virtualbox, and vagrant + virtualbox. It’s a DNS bug triggered by Virtualbox?!

I tried installing RVM on a co-worker’s Mac just now (OS X 10.10).

When I ran gpg —keyserver hkp://keys.gnupg.net —recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 I got an error saying something about an «armored key». I tried brew installing gnupg and gnupg2, but kept getting the same error. Sorry I cannot paste the exact error text, but I’m hoping one of y’all know the solution?

Update: I solved this problem by installing gpg v 2 with brew install gpg2 , then uninstalling gpg v 1 by running brew uninstall gpg , then running gpg2 —keyserver hkp://keys.gnupg.net —recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 to ensure the line used gpg v 2.

I had encountered the same issue.

But resolved with the below commands

sudo apt-get install gnup2
command curl -sSL https://rvm.io/mpapis.asc | gpg2 —import —

simple . ping keys.gnupg.net . use the ip address instead of keys.gnupg.net to get the keys.

should look like gpg —keyserver 144.76.9.122 —recv 886DDD89

I also can confirm this on Arch Linux

Arch% gpg —version gpg (GnuPG) 2.1.17 libgcrypt 1.7.5

@pkuczynski maybe we could extend the note in scripts/functions/cli:227 to mention trying gpg2 instead of gpg — if gpg was used?

Источник

Источник

This is a guide to using YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can be used for SSH.

Keys stored on YubiKey are non-exportable (as opposed to file-based keys that are stored on disk) and are convenient for everyday use. Instead of having to remember and enter passphrases to unlock SSH/GPG keys, YubiKey needs only a physical touch after being unlocked with a PIN code. All signing and encryption operations happen on the card, rather than in OS memory.

New! Purse is a password manager which can integrate with GPG on YubiKey.

If you have a comment or suggestion, please open an issue on GitHub.

  • Purchase YubiKey
  • Live image
  • Required software
    • Entropy
  • Creating keys
  • Master key
  • Sub-keys
    • Signing
    • Encryption
    • Authentication
  • Verify keys
  • Export keys
  • Backup keys
  • Configure YubiKey
  • Configure Smartcard
    • Change PIN
    • Set information
  • Transfer keys
    • Signing
    • Encryption
    • Authentication
  • Verify card
  • Export public key
  • Cleanup
  • Using keys
  • Import public key
    • Trust master key
  • Insert YubiKey
  • Encryption
  • Decryption
  • Signing
  • Verifying signature
  • SSH
    • Create configuration
    • Replace agents
    • Copy public key
    • (Optional) Save public key for identity file configuration
    • Connect with public key authentication
    • Touch to authenticate
    • Import SSH keys
    • GitHub
    • OpenBSD
    • Windows
  • Troubleshooting
  • Notes
  • Similar work

Purchase YubiKey

YubiKey 4 has support for 4096 bit RSA keys in OTP+CCID mode, whereas NEO are limited to 2048 bit RSA keys.

Consider purchasing a pair of keys and programming both in case of loss or damage to one of them.

Live image

It is recommended to generate cryptographic keys and configure YubiKey from a secure environment. One way to do is by downloading and booting to a Debian Live or Tails image loaded from a USB drive into memory.

Download the latest image and verify its integrity:

$ curl -LfO https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/debian-live-9.5.0-amd64-xfce.iso

$ curl -LfO https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/SHA512SUMS

$ !!.sign

$ gpg --verify SHA512SUMS.sign SHA512SUMS
[...]
gpg: Good signature from "Debian CD signing key <debian-cd@lists.debian.org>" [unknown]
[...]

$ grep $(sha512sum debian-live-9.5.0-amd64-xfce.iso) SHA512SUMS
d2b0fe266ef809943f24b71f6a7c1c7a1645a2ee0b51e71bb05625ca84f16904a8889287d580fcb5d8ff1152785f90ffdb1621733bbb148431155478b0006114  debian-live-9.5.0-amd64-xfce.iso

Mount a USB drive and copy the image over to it:

$ sudo dd if=debian-live-9.5.0-amd64-xfce.iso of=/dev/sdc bs=4M

$ sync

Shut down the computer and disconnect hard drives and any unnecessary peripherals.

Plug in the USB drive and boot to the live image. Configure networking to continue.

Required software

$ sudo apt-get update

$ sudo apt-get install -y 
     curl gnupg2 gnupg-agent 
     cryptsetup scdaemon pcscd 
     yubikey-personalization 
     dirmngr 
     secure-delete

You may also need more recent versions of yubikey-personalization and yubico-c.

macOS Download and install Homebrew and the following Brew packages — gnupg yubikey-personalization hopenpgp-tools ykman pinentry-mac

Windows Download and install Gpg4Win and PuTTY.

Entropy

Generating keys will require a lot of randomness. To check the available bits of entropy available on Linux:

$ cat /proc/sys/kernel/random/entropy_avail
849

A hardware random number generator like OneRNG will increase the speed of entropy generation and possibly its quality. To install and configure OneRNG:

$ sudo apt-get install -y rng-tools at python-gnupg openssl

$ curl -LfO https://github.com/OneRNG/onerng.github.io/raw/master/sw/onerng_3.6-1_all.deb

$ sha256sum onerng_3.6-1_all.deb
a9ccf7b04ee317dbfc91518542301e2d60ebe205d38e80563f29aac7cd845ccb

$ sudo dpkg -i onerng_3.6-1_all.deb

$ echo "HRNGDEVICE=/dev/ttyACM0" | sudo tee /etc/default/rng-tools

$ sudo service rng-tools restart

If the service fails to start, kick off atd and try again:

$ sudo atd ; sudo service rng-tools restart

Plug in the OneRNG and empty /dev/random — the light on the device should dim briefly. Verify the available entropy pool is re-seeded.

$ cat /dev/random >/dev/null
[Control-C]

$ cat /proc/sys/kernel/random/entropy_avail
3049

Creating keys

Create a temporary directory which won’t survive a reboot:

$ export GNUPGHOME=$(mktemp -d) ; echo $GNUPGHOME
/tmp/tmp.aaiTTovYgo

Create a hardened configuration for GPG with the following options or by downloading my recommended version directly:

$ curl -Lfo $GNUPGHOME/gpg.conf https://raw.githubusercontent.com/drduh/config/master/gpg.conf

$ cat $GNUPGHOME/gpg.conf
personal-cipher-preferences AES256 AES192 AES CAST5
personal-digest-preferences SHA512 SHA384 SHA256 SHA224
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
s2k-digest-algo SHA512
s2k-cipher-algo AES256
charset utf-8
fixed-list-mode
no-comments
no-emit-version
keyid-format 0xlong
list-options show-uid-validity
verify-options show-uid-validity
with-fingerprint
require-cross-certification
use-agent

Disable networking for the remainder of the setup.

Master key

The first key to generate is the master key. It will be used for certification only — to issue sub-keys that are used for encryption, signing and authentication. This master key should be kept offline at all times.

You’ll be prompted to enter and verify a passphrase — keep it handy as you’ll need it throughout. To generate a strong passphrase which could be written down in a hidden or secure place; or memorized:

$ gpg --gen-random -a 0 24
ydOmByxmDe63u7gqx2XI9eDgpvJwibNH

Generate a new key with GPG, selecting (4) RSA (sign only) and 4096 bit keysize — do not set the key to expire (see Note #3).

$ gpg --full-generate-key

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Dr Duh
Email address: doc@duh.to
Comment:
You selected this USER-ID:
    "Dr Duh <doc@duh.to>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: /tmp.FLZC0xcM/trustdb.gpg: trustdb created
gpg: key 0xFF3E7D88647EBCDB marked as ultimately trusted
gpg: directory '/tmp.FLZC0xcM/openpgp-revocs.d' created
gpg: revocation certificate stored as '/tmp.FLZC0xcM/openpgp-revocs.d/011CE16BD45B27A55BA8776DFF3E7D88647EBCDB.rev'
public and secret key created and signed.

Note that this key cannot be used for encryption.  You may want to use
the command "--edit-key" to generate a subkey for this purpose.
pub   rsa4096/0xFF3E7D88647EBCDB 2017-10-09 [SC]
      Key fingerprint = 011C E16B D45B 27A5 5BA8  776D FF3E 7D88 647E BCDB
uid                              Dr Duh <doc@duh.to>

Note that as of GPG version 2.1 a revocation certificate is automatically generated.

Export the key ID as a variable for use later:

$ export KEYID=0xFF3E7D88647EBCDB

Sub-keys

Edit the Master key to add sub-keys:

$ gpg --expert --edit-key $KEYID

Secret key is available.

sec  rsa4096/0xEA5DE91459B80592
    created: 2017-10-09  expires: never       usage: SC  
    trust: ultimate      validity: ultimate
[ultimate] (1). Dr Duh <doc@duh.to>

Use 4096-bit keysize on YubiKey 4 and 2048-bit on NEO.

Use a 1 year expiration — it can always be renewed using the previous offline Master key.

Signing

Create a signing key by selecting (4) RSA (sign only):

gpg> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Dr Duh <doc@duh.to>"
4096-bit RSA key, ID 0xFF3E7D88647EBCDB, created 2016-05-24

Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 10 Sep 2018 00:00:00 PM UTC
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC  
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09       usage: S   
[ultimate] (1). Dr Duh <doc@duh.to>

Encryption

Next, create an encryption key by selecting (6) RSA (encrypt only):

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 6
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 10 Sep 2018 00:00:00 PM UTC
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC  
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09       usage: S   
ssb  rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09       usage: E   
[ultimate] (1). Dr Duh <doc@duh.to>

Authentication

Finally, create an authentication key.

GPG doesn’t provide an authenticate-only key type, so select (8) RSA (set your own capabilities) and toggle the required capabilities until the only allowed action is Authenticate:

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 8

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? S

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Encrypt

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? E

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions:

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? A

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Authenticate

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 10 Sep 2018 00:00:00 PM UTC
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC  
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09       usage: S   
ssb  rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09       usage: E   
ssb  rsa4096/0x3F29127E79649A3D
    created: 2017-10-09  expires: 2018-10-09       usage: A   
[ultimate] (1). Dr Duh <doc@duh.to>

gpg> save

Verify keys

List the generated secret keys and verify the output:

$ gpg --list-secret-keys
/tmp.FLZC0xcM/pubring.kbx
-------------------------------------------------------------------------
sec   rsa4096/0xFF3E7D88647EBCDB 2017-10-09 [SC]
      Key fingerprint = 011C E16B D45B 27A5 5BA8  776D FF3E 7D88 647E BCDB
uid                            Dr Duh <doc@duh.to>
ssb   rsa4096/0xBECFA3C1AE191D15 2017-10-09 [S] [expires: 2018-10-09]
ssb   rsa4096/0x5912A795E90DD2CF 2017-10-09 [E] [expires: 2018-10-09]
ssb   rsa4096/0x3F29127E79649A3D 2017-10-09 [A] [expires: 2018-10-09]

To verify with OpenPGP key checks, use the automated key best practice checker:

$ sudo apt-get install hopenpgp-tools
$ gpg --export $KEYID | hokey lint

The output will display any problems with your key in red text. If everything is green, your key passes each of the tests. If it is red, your key has failed one of the tests.

hokey may warn (orange text) about cross certification for the authentication key. GPG’s Signing Subkey Cross-Certification documentation has more detail on cross certification, and gpg v2.2.1 notes «subkey does not sign and so does not need to be cross-certified».

Export keys

The Master and sub-keys will be encrypted with your passphrase when exported.

Save a copy of your keys:

$ gpg --armor --export-secret-keys $KEYID > $GNUPGHOME/mastersub.key

$ gpg --armor --export-secret-subkeys $KEYID > $GNUPGHOME/sub.key

On Windows, note that using any extension other than .gpg or attempting IO redirection to a file will garble the secret key, making it impossible to import it again at a later date:

$ gpg --armor --export-secret-keys $KEYID -o pathtodirmastersub.gpg

$ gpg --armor --export-secret-subkeys $KEYID -o pathtodirsub.gpg

Backup keys

Once keys are moved to hardware, they cannot be extracted again, so make sure you have made an encrypted backup before proceeding. An encrypted USB drive or container can be made using VeraCrypt.

Also consider using a paper copy of the keys as an additional backup measure.

To format and encrypt a USB drive on Linux, first attach it and check its label:

$ sudo dmesg | tail
scsi8 : usb-storage 2-1:1.0
usbcore: registered new interface driver usb-storage
scsi 8:0:0:0: USB 0: 0 ANSI: 6
sd 8:0:0:0: Attached scsi generic sg4 type 0
sd 8:0:0:0: [sde] 62980096 512-byte logical blocks: (32.2 GB/30.0 GiB)
sd 8:0:0:0: [sde] Write Protect is off
sd 8:0:0:0: [sde] Mode Sense: 43 00 00 00
 sde: sde1
sd 8:0:0:0: [sde] Attached SCSI removable disk

Check the size to make sure it’s the right drive:

$ sudo fdisk -l /dev/sde
Disk /dev/sde: 30 GiB, 32245809152 bytes, 62980096 sectors
/dev/sde1        2048 62980095 62978048  30G  6 FAT16

Erase and create a new partition table:

$ sudo fdisk /dev/sde

Welcome to fdisk (util-linux 2.25.2).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): o
Created a new DOS disklabel with disk identifier 0xeac7ee35.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

Remove and reinsert the USB drive, then create a new partition, selecting defaults:

$ sudo fdisk /dev/sde

Welcome to fdisk (util-linux 2.25.2).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): n
Partition type
   p   primary (0 primary, 0 extended, 4 free)
   e   extended (container for logical partitions)
Select (default p): p
Partition number (1-4, default 1): 1
First sector (2048-62980095, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-62980095, default 62980095):

Created a new partition 1 of type 'Linux' and of size 30 GiB.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

Use LUKS to encrypt the new partition:

$ sudo cryptsetup luksFormat /dev/sde1

WARNING!
========
This will overwrite data on /dev/sde1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase:
Verify passphrase:

Mount the partition:

$ sudo cryptsetup luksOpen /dev/sde1 usb
Enter passphrase for /dev/sde1:

Create a filesystem:

$ sudo mkfs.ext4 /dev/mapper/usb -L usb
mke2fs 1.43.4 (31-Jan-2017)
Creating filesystem with 7871744 4k blocks and 1970416 inodes
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000

Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

Mount the filesystem:

$ sudo mount /dev/mapper/usb /mnt

Backup all GPG files to it:

$ sudo cp -avi $GNUPGHOME /mnt
[...]
‘/tmp/tmp.aaiTTovYgo/revoke.txt’ -> ‘/mnt/tmp.aaiTTovYgo/revoke.txt’
‘/tmp/tmp.aaiTTovYgo/gpg.conf’ -> ‘/mnt/tmp.aaiTTovYgo/gpg.conf’
‘/tmp/tmp.aaiTTovYgo/master.key’ -> ‘/mnt/tmp.aaiTTovYgo/master.key’
‘/tmp/tmp.aaiTTovYgo/secring.gpg’ -> ‘/mnt/tmp.aaiTTovYgo/secring.gpg’
‘/tmp/tmp.aaiTTovYgo/mastersub.key’ -> ‘/mnt/tmp.aaiTTovYgo/mastersub.key’
‘/tmp/tmp.aaiTTovYgo/sub.key’ -> ‘/mnt/tmp.aaiTTovYgo/sub.key’
‘/tmp/tmp.aaiTTovYgo/pubring.gpg’ -> ‘/mnt/tmp.aaiTTovYgo/pubring.gpg’
[...]

Keep the backup mounted if you plan on setting up two or more keys as keytocard will delete the local copy on save.

Otherwise, unmount and disconnected the encrypted USB drive:

$ sudo umount /mnt

$ sudo cryptsetup luksClose usb

Configure YubiKey

Plug in YubiKey and configure it with the ykpersonalize utility:

$ sudo ykpersonalize -m82
Firmware version 4.3.7 Touch level 527 Program sequence 1

The USB mode will be set to: 0x82

Commit? (y/n) [n]: y

The -m option is the mode command. To see the different modes, enter ykpersonalize –help. Mode 82 (in hex) enables the YubiKey NEO as a composite USB device (HID + CCID). Once you have changed the mode, you need to re-boot the YubiKey – so remove and re-insert it. On YubiKey NEO with firmware version 3.3 or higher, you can enable composite USB device with -m86 instead of -m82.

Note YubiKey NEO shipped after November 2015 have all modes enabled; so this configuration may be skipped. Older versions of the YubiKey NEO may need to be reconfigured as a composite USB device (HID + CCID) which allows OTPs to be emitted while in use as a SmartCard.

Windows Use the YubiKey NEO Manager to enable CCID functionality.

Configure Smartcard

Use GPG to configure YubiKey as a smartcard:

$ gpg --card-edit
Reader ...........: Yubico Yubikey 4 OTP U2F CCID
Application ID ...: D2760001240102010006055532110000
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 05553211
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

Change PIN

The default PIN codes are 12345678 for the Admin PIN (aka PUK) and 123456 for the PIN. The CCID-mode PINs can be up to 127 ASCII characters long.

The Admin PIN is required for some card operations and to unblock a PIN that has been entered incorrectly more than three times. See the GnuPG documentation on Managing PINs for details.

gpg/card> admin
Admin commands are allowed

gpg/card> passwd
gpg: OpenPGP card no. D2760001240102010006055532110000 detected

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 3
PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 1
PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? q

Set information

Some fields are optional.

gpg/card> name
Cardholder's surname: Duh
Cardholder's given name: Dr

gpg/card> lang
Language preferences: en

gpg/card> login
Login data (account name): doc@duh.to

gpg/card> [Press Enter]

Application ID ...: D2760001240102010006055532110000
Version ..........: 2.1
Manufacturer .....: unknown
Serial number ....: 05553211
Name of cardholder: Dr Duh
Language prefs ...: en
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: doc@duh.to
Private DO 4 .....: [not set]
Signature PIN ....: not forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

gpg/card> quit

Transfer keys

Transferring keys to YubiKey using keytocard is a one-way operation only, so make sure you’ve made a backup before proceeding.

Previous GPG versions required the toggle command before selecting keys. The currently selected key(s) are indicated with an *. When moving keys only one key should be selected at a time.

$ gpg --edit-key $KEYID

Secret key is available.

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC  
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09  usage: S   
ssb  rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09  usage: E   
ssb  rsa4096/0x3F29127E79649A3D
    created: 2017-10-09  expires: 2018-10-09  usage: A   
[ultimate] (1). Dr Duh <doc@duh.to>

Signing

Select and move the signature key. You will be prompted for the key passphrase and admin PIN).

gpg> key 1

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC
    trust: ultimate      validity: ultimate
ssb* rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09  usage: S
ssb  rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09  usage: E
ssb  rsa4096/0x3F29127E79649A3D
    created: 2017-10-09  expires: 2018-10-09  usage: A
[ultimate] (1). Dr Duh <doc@duh.to>

gpg> keytocard
Please select where to store the key:
   (1) Signature key
   (3) Authentication key
Your selection? 1

You need a passphrase to unlock the secret key for
user: "Dr Duh <doc@duh.to>"
4096-bit RSA key, ID 0xBECFA3C1AE191D15, created 2016-05-24

Encryption

Type key 1 again to de-select and key 2 to select the next key:

gpg> key 1

gpg> key 2

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09  usage: S
ssb* rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09  usage: E
ssb  rsa4096/0x3F29127E79649A3D
    created: 2017-10-09  expires: 2018-10-09  usage: A
[ultimate] (1). Dr Duh <doc@duh.to>

gpg> keytocard
Please select where to store the key:
   (2) Encryption key
Your selection? 2

[...]

Authentication

Type key 2 again to deselect and key 3 to select the last key:

gpg> key 2

gpg> key 3

sec  rsa4096/0xFF3E7D88647EBCDB
    created: 2017-10-09  expires: never       usage: SC
    trust: ultimate      validity: ultimate
ssb  rsa4096/0xBECFA3C1AE191D15
    created: 2017-10-09  expires: 2018-10-09  usage: S
ssb  rsa4096/0x5912A795E90DD2CF
    created: 2017-10-09  expires: 2018-10-09  usage: E
ssb* rsa4096/0x3F29127E79649A3D
    created: 2017-10-09  expires: 2018-10-09  usage: A
[ultimate] (1). Dr Duh <doc@duh.to>

gpg> keytocard
Please select where to store the key:
   (3) Authentication key
Your selection? 3

gpg> save

Verify card

Verify the sub-keys have moved to YubiKey as indicated by ssb>:

$ gpg --list-secret-keys
/tmp.FLZC0xcM/pubring.kbx
-------------------------------------------------------------------------
sec   rsa4096/0xFF3E7D88647EBCDB 2017-10-09 [SC]
      Key fingerprint = 011C E16B D45B 27A5 5BA8  776D FF3E 7D88 647E BCDB
uid                            Dr Duh <doc@duh.to>
ssb>  rsa4096/0xBECFA3C1AE191D15 2017-10-09 [S] [expires: 2018-10-09]
ssb>  rsa4096/0x5912A795E90DD2CF 2017-10-09 [E] [expires: 2018-10-09]
ssb>  rsa4096/0x3F29127E79649A3D 2017-10-09 [A] [expires: 2018-10-09]

Export public key

Mount another USB drive to copy the public key, or save it somewhere where you can easily access later.

Note Without the public key, you will not be able to use GPG to encrypt, decrypt, nor sign messages. However, you will still be able to use the YubiKey for SSH.

$ gpg --armor --export $KEYID > /mnt/public-usb-key/pubkey.txt

On Windows:

$ gpg --armor --export $KEYID -o pathtodirpubkey.gpg

Optionally, the public key may be uploaded to a public keyserver:

$ gpg --send-key $KEYID
gpg: sending key 0xFF3E7D88647EBCDB to hkps server hkps.pool.sks-keyservers.net
[...]

After some time, the public key will to propagate to other servers.

Cleanup

Ensure you have:

  • Saved the password to the Master key.
  • Saved a copy of the Master key, subkeys and revocation certificates on encrypted offline storage.
  • Saved the password to that encrypted volume in a separate location.
  • Saved a copy of the public key somewhere easily accessible later.
  • Moved the Encryption, Signing and Authentication subkeys to YubiKey.

Then reboot or securely delete $GNUPGHOME and remove the secret keys from the GPG keyring:

$ sudo srm -r $GNUPGHOME || sudo rm -rf $GNUPGHOME

$ gpg --delete-secret-key $KEYID

Make sure you have securely erased keys, including revocation certificates, if a Live image was not used!

Using keys

You can reboot back into the Live image to test YubiKey.

Install required programs:

$ sudo apt-get update
$ sudo apt-get install -y 
     curl gnupg2 gnupg-agent 
     cryptsetup scdaemon pcscd

Create a hardened configuration for GPG with the following options or by downloading my recommended version directly:

$ mkdir ~/.gnupg ; curl -Lfo ~/.gnupg/gpg.conf https://raw.githubusercontent.com/drduh/config/master/gpg.conf

$ cat ~/.gnupg/gpg.conf
personal-cipher-preferences AES256 AES192 AES CAST5
personal-digest-preferences SHA512 SHA384 SHA256 SHA224
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
s2k-digest-algo SHA512
s2k-cipher-algo AES256
charset utf-8
fixed-list-mode
no-comments
no-emit-version
keyid-format 0xlong
list-options show-uid-validity
verify-options show-uid-validity
with-fingerprint
require-cross-certification
use-agent

$ chmod 600 ~/.gnupg/gpg.conf

Import public key

To import the public key from a file on an encrypted USB drive:

$ sudo cryptsetup luksOpen /dev/sdd1 usb
Enter passphrase for /dev/sdd1:

$ sudo mount /dev/mapper/usb /mnt

$ gpg --import /mnt/pubkey.txt
gpg: key 0xFF3E7D88647EBCDB: public key "Dr Duh <doc@duh.to>" imported
gpg: Total number processed: 1
gpg:               imported: 1

To download the public key from a keyserver:

$ gpg --recv 0xFF3E7D88647EBCDB
gpg: requesting key 0xFF3E7D88647EBCDB from hkps server hkps.pool.sks-keyservers.net
[...]
gpg: key 0xFF3E7D88647EBCDB: public key "Dr Duh <doc@duh.to>" imported
gpg: Total number processed: 1
gpg:               imported: 1

If you get the error gpgkeys: HTTP fetch error 1: unsupported protocol — this means you need to install a special version of curl which supports GPG:

$ sudo apt-get install -y gnupg-curl

Trust master key

Edit the Master key to assign it ultimate trust by selecting trust then option 5:

$ gpg --edit-key 0xFF3E7D88647EBCDB

Secret key is available.

gpg> trust
pub  4096R/0xFF3E7D88647EBCDB  created: 2016-05-24  expires: never       usage: SC
                               trust: unknown       validity: unknown
sub  4096R/0xBECFA3C1AE191D15  created: 2017-10-09  expires: 2018-10-09  usage: S
sub  4096R/0x5912A795E90DD2CF  created: 2017-10-09  expires: 2018-10-09  usage: E
sub  4096R/0x3F29127E79649A3D  created: 2017-10-09  expires: 2018-10-09  usage: A
[ unknown] (1). Dr Duh <doc@duh.to>

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

pub  4096R/0xFF3E7D88647EBCDB  created: 2016-05-24  expires: never       usage: SC
                               trust: ultimate      validity: unknown
sub  4096R/0xBECFA3C1AE191D15  created: 2017-10-09  expires: 2018-10-09  usage: S
sub  4096R/0x5912A795E90DD2CF  created: 2017-10-09  expires: 2018-10-09  usage: E
sub  4096R/0x3F29127E79649A3D  created: 2017-10-09  expires: 2018-10-09  usage: A
[ unknown] (1). Dr Duh <doc@duh.to>

gpg> save

Insert YubiKey

Re-connect Yubikey and check the status:

$ gpg --card-status
Application ID ...: D2760001240102010006055532110000
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 05553211
Name of cardholder: Dr Duh
Language prefs ...: en
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: doc@duh.to
Signature PIN ....: not forced
Key attributes ...: 4096R 4096R 4096R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: 07AA 7735 E502 C5EB E09E  B8B0 BECF A3C1 AE19 1D15
      created ....: 2016-05-24 23:22:01
Encryption key....: 6F26 6F46 845B BEB8 BDF3  7E9B 5912 A795 E90D D2CF
      created ....: 2016-05-24 23:29:03
Authentication key: 82BE 7837 6A3F 2E7B E556  5E35 3F29 127E 7964 9A3D
      created ....: 2016-05-24 23:36:40
General key info..: pub  4096R/0xBECFA3C1AE191D15 2016-05-24 Dr Duh <doc@duh.to>
sec#  4096R/0xFF3E7D88647EBCDB  created: 2016-05-24  expires: never
ssb>  4096R/0xBECFA3C1AE191D15  created: 2017-10-09  expires: 2018-10-09
                      card-no: 0006 05553211
ssb>  4096R/0x5912A795E90DD2CF  created: 2017-10-09  expires: 2018-10-09
                      card-no: 0006 05553211
ssb>  4096R/0x3F29127E79649A3D  created: 2017-10-09  expires: 2018-10-09
                      card-no: 0006 05553211

sec# indicates master key is not available (as it should be stored encrypted offline).

Note If you see General key info..: [none] in the output instead — go back and import the public key using the previous step.

Encryption

$ echo "test message string" | gpg --encrypt --armor --recipient 0xFF3E7D88647EBCDB
-----BEGIN PGP MESSAGE-----

hQIMA1kSp5XpDdLPAQ/+JyYfLaUS/+llEzQaKDb5mWhG4HlUgD99dNJUXakm085h
PSSt3I8Ac0ctwyMnenZvBEbHMqdRnfZJsj5pHidKcAZrhgs+he+B1tdZ/KPa8inx
NIGqd8W1OraVSFmPEdC1kQ5he6R/WCDH1NNel9+fvLtQDCBQaFae/s3yXCSSQU6q
HKCJLyHK8K9hDvgFmXOY8j1qTknBvDbmYdcCKVE1ejgpUCi3WatusobpWozsp0+b
6DN8bXyfxLPYm1PTLfW7v4kwddktB8eVioV8A45lndJZvliSqDwxhrwyE5VGsArS
NmqzBkCaOHQFr0ofL91xgwpCI5kM2ukIR5SxUO4hvzlHn58QVL9GfAyCHMFtJs3o
Q9eiR0joo9TjTwR8XomVhRJShrrcPeGgu3YmIak4u7OndyBFpu2E79RQ0ehpl2gY
tSECB6mNd/gt0Wy3y15ccaFI4CVP6jrMN6q3YhXqNC7GgI/OWkVZIAgUFYnbmIQe
tQ3z3wlbvFFngeFy5IlhsPduK8T9XgPnOtgQxHaepKz0h3m2lJegmp4YZ4CbS9h6
kcBTUjys5Vin1SLuqL4PhErzmlAZgVzG2PANsnHYPe2hwN4NlFtOND1wgBCtBFBs
1pqz1I0O+jmyId+jVlAK076c2AwdkVbokKUcIT/OcTc0nwHjOUttJGmkUHlbt/nS
iAFNniSfzf6fwAFHgsvWiRJMa3keolPiqoUdh0tBIiI1zxOMaiTL7C9BFdpnvzYw
Krj0pDc7AlF4spWhm58WgAW20P8PGcVQcN6mSTG8jKbXVSP3bvgPXkpGAOLKMV/i
pLORcRPbauusBqovgaBWU/i3pMYrbhZ+LQbVEaJlvblWu6xe8HhS/jo=
=pzkv
-----END PGP MESSAGE-----

Decryption

$ gpg --decrypt --armor
-----BEGIN PGP MESSAGE-----

hQIMA1kSp5XpDdLPAQ/+JyYfLaUS/+llEzQaKDb5mWhG4HlUgD99dNJUXakm085h
PSSt3I8Ac0ctwyMnenZvBEbHMqdRnfZJsj5pHidKcAZrhgs+he+B1tdZ/KPa8inx
NIGqd8W1OraVSFmPEdC1kQ5he6R/WCDH1NNel9+fvLtQDCBQaFae/s3yXCSSQU6q
HKCJLyHK8K9hDvgFmXOY8j1qTknBvDbmYdcCKVE1ejgpUCi3WatusobpWozsp0+b
6DN8bXyfxLPYm1PTLfW7v4kwddktB8eVioV8A45lndJZvliSqDwxhrwyE5VGsArS
NmqzBkCaOHQFr0ofL91xgwpCI5kM2ukIR5SxUO4hvzlHn58QVL9GfAyCHMFtJs3o
Q9eiR0joo9TjTwR8XomVhRJShrrcPeGgu3YmIak4u7OndyBFpu2E79RQ0ehpl2gY
tSECB6mNd/gt0Wy3y15ccaFI4CVP6jrMN6q3YhXqNC7GgI/OWkVZIAgUFYnbmIQe
tQ3z3wlbvFFngeFy5IlhsPduK8T9XgPnOtgQxHaepKz0h3m2lJegmp4YZ4CbS9h6
kcBTUjys5Vin1SLuqL4PhErzmlAZgVzG2PANsnHYPe2hwN4NlFtOND1wgBCtBFBs
1pqz1I0O+jmyId+jVlAK076c2AwdkVbokKUcIT/OcTc0nwHjOUttJGmkUHlbt/nS
iAFNniSfzf6fwAFHgsvWiRJMa3keolPiqoUdh0tBIiI1zxOMaiTL7C9BFdpnvzYw
Krj0pDc7AlF4spWhm58WgAW20P8PGcVQcN6mSTG8jKbXVSP3bvgPXkpGAOLKMV/i
pLORcRPbauusBqovgaBWU/i3pMYrbhZ+LQbVEaJlvblWu6xe8HhS/jo=
=pzkv
-----END PGP MESSAGE-----
gpg: encrypted with 4096-bit RSA key, ID 0x5912A795E90DD2CF, created
2016-05-24
      "Dr Duh <doc@duh.to>"

[Press Control-D]

test message string

Signing

$ echo "test message string" | gpg --armor --clearsign --default-key 0xBECFA3C1AE191D15
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test message string
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXRPo8AAoJEL7Po8GuGR0Vh8wP/jYXTR8SAZIZSMVCOyAjH37f
k6JxB0rF928WDYPihjo/d0Jd+XpoV1g+oipDRjP78xqR9H/CJZlE10IPQbNaomFs
+3RGxA3Zr085cVFoixI8rxYOSu0Vs2cAzAbJHNcOcD7vXxTHcX4T8kfKoF9A4U1u
XTJ42eEjpO0fX76tFX2/Uzxl43ES0dO7Y82ho7xcnaYwakVUEcWfUpfDAroLKZOs
wCZGr8Z64QDQzxQ9L45Zc61wMx9JEIWD4BnagllfeOYrEwTJfYG8uhDDNYx0jjJp
j1PBHn5d556aX6DHUH05kq3wszvQ4W40RctLgAA3l1VnEKebhBKjLZA/EePAvQV4
QM7MFUV1X/pi2zlyoZSnHkVl8b5Q7RU5ZtRpq9fdkDDepeiUo5PNBUMJER1gn4bm
ri8DtavkwTNWBRLnVR2gHBmVQNN7ZDOkHcfyqR4I9chx6TMpfcxk0zATAHh8Donp
FVPKySifuXpunn+0MwdZl5XkhHGdpdYQz4/LAZUGhrA9JTnFtc4cl4JrTzufF8Sr
c3JJumMsyGvw9OQKQHF8gHme4PBu/4P31LpfX9wzPOTpJaI31Sg5kdJLTo9M9Ppo
uvkmJS7ETjLQZOsRyAEn7gcEKZQGPQcNAgfEgQPoepS/KvvI68u+JMJm4n24k2kQ
fEkp501u8kAZkWauhiL+
=+ylJ
-----END PGP SIGNATURE-----

Verifying signature

$ gpg
gpg: Go ahead and type your message ...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

test message string
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXRPo8AAoJEL7Po8GuGR0Vh8wP/jYXTR8SAZIZSMVCOyAjH37f
+3RGxA3Zr085cVFoixI8rxYOSu0Vs2cAzAbJHNcOcD7vXxTHcX4T8kfKoF9A4U1u
XTJ42eEjpO0fX76tFX2/Uzxl43ES0dO7Y82ho7xcnaYwakVUEcWfUpfDAroLKZOs
wCZGr8Z64QDQzxQ9L45Zc61wMx9JEIWD4BnagllfeOYrEwTJfYG8uhDDNYx0jjJp
j1PBHn5d556aX6DHUH05kq3wszvQ4W40RctLgAA3l1VnEKebhBKjLZA/EePAvQV4
QM7MFUV1X/pi2zlyoZSnHkVl8b5Q7RU5ZtRpq9fdkDDepeiUo5PNBUMJER1gn4bm
ri8DtavkwTNWBRLnVR2gHBmVQNN7ZDOkHcfyqR4I9chx6TMpfcxk0zATAHh8Donp
FVPKySifuXpunn+0MwdZl5XkhHGdpdYQz4/LAZUGhrA9JTnFtc4cl4JrTzufF8Sr
c3JJumMsyGvw9OQKQHF8gHme4PBu/4P31LpfX9wzPOTpJaI31Sg5kdJLTo9M9Ppo
uvkmJS7ETjLQZOsRyAEn7gcEKZQGPQcNAgfEgQPoepS/KvvI68u+JMJm4n24k2kQ
fEkp501u8kAZkWauhiL+
=+ylJ
-----END PGP SIGNATURE-----

[Press Control-D]

gpg: Signature made Wed 25 May 2016 00:00:00 AM UTC
gpg:                using RSA key 0xBECFA3C1AE191D15
gpg: Good signature from "Dr Duh <doc@duh.to>" [ultimate]
Primary key fingerprint: 011C E16B D45B 27A5 5BA8  776D FF3E 7D88 647E BCDB
     Subkey fingerprint: 07AA 7735 E502 C5EB E09E  B8B0 BECF A3C1 AE19 1D15

SSH

gpg-agent supports the OpenSSH ssh-agent protocol (enable-ssh-support), as well as Putty’s Pageant on Windows (enable-putty-support). This means it can be used instead of the traditional ssh-agent / pageant. There are some differences from ssh-agent, notably that gpg-agent does not cache keys rather it converts, encrypts and stores them — persistently — as GPG keys and then makes them available to ssh clients. Any existing ssh private keys that you’d like to keep in gpg-agent should be deleted after they’ve been imported to the GPG agent.

When importing the key to gpg-agent, you’ll be prompted for a passphrase to protect that key within GPG’s key store — you may want to use the same passphrase as the original’s ssh version. GPG can both cache passphrases for a determined period (ref. gpg-agent‘s various cache-ttl options), and since version 2.1 can store and fetch passphrases via the macOS keychain. Note than when removing the old private key after importing to gpg-agent, keep the .pub key file around for use in specifying ssh identities (e.g. ssh -i /path/to/identity.pub).

Probably the biggest thing missing from gpg-agent‘s ssh agent support is being able to remove keys. ssh-add -d/-D have no effect. Instead, you need to use the gpg-connect-agent utility to lookup a key’s keygrip, match that with the desired ssh key fingerprint (as an MD5) and then delete that keygrip. The gnupg-users mailing list has more information.

Create configuration

Create a hardened configuration for gpg-agent with the following options or by downloading my recommended version directly:

$ curl -Lfo ~/.gnupg/gpg-agent.conf https://raw.githubusercontent.com/drduh/config/master/gpg-agent.conf

$ cat ~/.gnupg/gpg-agent.conf
enable-ssh-support
pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 60
max-cache-ttl 120

Alternatively, you may want to use /usr/bin/pinentry-gnome3 to use a GUI manager. On macOS, use brew install pinentry-mac and adjust the program path to suit.

Replace agents

To launch gpg-agent for use by SSH, use the gpg-connect-agent /bye or gpgconf --launch gpg-agent commands.

Add these to your shell rc file:

export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
gpgconf --launch gpg-agent

On some systems, you may need to use the following instead:

export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
gpg-connect-agent updatestartuptty /bye

Copy public key

Note It is not necessary to import the corresponding GPG public key in order to use SSH.

Copy and paste the output from ssh-add to the server’s authorized_keys file:

$ ssh-add -L
ssh-rsa AAAAB4NzaC1yc2EAAAADAQABAAACAz[...]zreOKM+HwpkHzcy9DQcVG2Nw== cardno:000605553211

(Optional) Save public key for identity file configuration

By default, SSH attempts to use all the identities available via the agent. It’s often a good idea to manage exactly which keys SSH will use to connect to a server, for example to separate different roles or to avoid being fingerprinted by untrusted ssh servers. To do this you’ll need to use the command line argument -l [identity_file] or the IdentityFile and IdentitiesOnly options in .ssh/config.

The argument provided to IdentityFile is traditionally the path to the private key file (for example IdentityFile ~/.ssh/id_rsa). For the Yubikey — indeed, in general for keys stored in an ssh agent — IdentityFile should point to the public key file, ssh will select the appropriate private key from those available via the ssh agent. To prevent ssh from trying all keys in the agent use the IdentitiesOnly yes option along with one or more -i or IdentityFile options for the target host.

To reiterate, with IdentitiesOnly yes, ssh will not automatically enumerate public keys loaded into ssh-agent or gpg-agent. This means publickey authentication will not proceed unless explicitly named by ssh -i [identity_file] or in .ssh/config on a per-host basis.

In the case of YubiKey usage, to extract the public key from the ssh agent:

$ ssh-add -L | grep "cardno:000605553211" > ~/.ssh/id_rsa_yubikey.pub

Then you can explicitly associate this Yubikey-stored key for used with a host, github.com for example, as follows:

$ cat << EOF >> ~/.ssh/config
Host github.com
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_yubikey.pub
EOF

Connect with public key authentication

$ ssh git@github.com -vvv
[...]
debug2: key: cardno:000605553211 (0x1234567890),
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: cardno:000605553211
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug2: input_userauth_pk_ok: fp e5:de:a5:74:b1:3e:96:9b:85:46:e7:28:53:b4:82:c3
debug3: sign_and_send_pubkey: RSA e5:de:a5:74:b1:3e:96:9b:85:46:e7:28:53:b4:82:c3
debug1: Authentication succeeded (publickey).
[...]

Note To make multiple connections or securely transfer many files, consider using the ControlMaster ssh option. Also see drduh/config/ssh_config.

Touch to authenticate

Note This is only possible on the Yubikey 4 line.

By default, YubiKey will perform key operations without requiring a touch from the user. To require a touch for every SSH connection, use the YubiKey Manager and Admin PIN:

ykman openpgp touch aut on

To require a touch for the signing and encrypting keys as well:

ykman openpgp touch sig on
ykman openpgp touch enc on

The YubiKey will blink when it’s waiting for touch.

Import SSH keys

If there are existing SSH keys that you wish to make available via gpg-agent, you’ll need to import them. You should then remove the original private keys. When importing the key, gpg-agent uses the key’s filename as the key’s label; this makes it easier to follow where the key originated from. In this example, we’re starting with just the YubiKey’s key in place and importing ~/.ssh/id_rsa:

$ ssh-add -l
4096 SHA256:... cardno:00060123456 (RSA)

$ ssh-add ~/.ssh/id_rsa && rm ~/.ssh/id_rsa

When invoking ssh-add, it will prompt for the ssh key’s passphrase if present, then the pinentry program will prompt and confirm for a new passphrase to use to encrypt the converted key within the gpg key store.

The migrated key should be listed in ssh-add -l:

$ ssh-add -l
4096 SHA256:... cardno:00060123456 (RSA)
2048 SHA256:... /Users/username/.ssh/id_rsa (RSA)

Or to show the keys with MD5 fingerprints, as used by gpg-connect-agent‘s KEYINFO and DELETE_KEY commands:

$ ssh-add -E md5 -l
4096 MD5:... cardno:00060123456 (RSA)
2048 MD5:... /Users/username/.ssh/id_rsa (RSA)

When using the key pinentry will be invoked to request the key’s passphrase. The passphrase will be cached for up to 10 minutes idle time between uses, to a maximum of 2 hours.

GitHub

You can use YubiKey to sign GitHub commits and tags. It can also be used for GitHub SSH authentication, allowing you to push, pull, and commit without a password.

Log into GitHub and upload SSH and PGP public keys in Settings.

To sign:

> git config --global user.signingkey $KEYID

Make sure your user.email option matches the email associated with your PGP identity.

Now, to sign commits or tags simply use the -S option. GPG will automatically query your YubiKey and prompt you for your PIN.

To authenticate:

Run the following commands (only for Windows):

> git config --global core.sshcommand 'plink -agent'

You can then change your repository url to:
git@github.com:USERNAME/repository. Any authenticated commands will be authorized by your YubiKey.

Note If you encounter the error gpg: signing failed: No secret key — run gpg --card-status with YubiKey plugged in and try the git command again.

OpenBSD

Install pcsc-tools and enable with sudo rcctl enable pcscd, then reboot in order to recognize YubiKey.

Windows

Begin by exporting the SSH key from GPG:

$ gpg --export-ssh-key $USERID

Copy this key to a file and keep it for later use. It represents the public SSH key corresponding to the secret key on your YubiKey. You can upload this key to any server you wish to SSH into.

To authenticate SSH sessions via our YubiKey we need to enable Gpg4Win’s PuTTY integration. Create a file named gpg-agent.conf and place it in the directory C:%APPDATA%gnupg.
The file should contain the line enable-putty-support.

Then, open a terminal and run the following commands:

> gpg-connect-agent killagent /bye
> gpg-connect-agent /bye

Create a shortcut that points to gpg-connect-agent /bye and place it in your startup folder to make sure the agent starts after a system shutdown.

Now you can use PuTTY for public key SSH authentication. When the server asks for public key verification, PuTTY will forward the request to GPG, which will prompt you for your PIN and authorize the login using your YubiKey.

Troubleshooting

  • If you don’t understand some option — read man gpg.

  • If you encounter problems connecting to YubiKey with GPG — try unplugging and re-inserting your YubiKey, and restarting the gpg-agent process.

  • If you receive the error, gpg: decryption failed: secret key not available — you likely need to install GnuPG version 2.x.

  • If you receive the error, Yubikey core error: no yubikey present — make sure the YubiKey is inserted correctly. It should blink once when plugged in.

  • If you still receive the error, Yubikey core error: no yubikey present — you likely need to install newer versions of yubikey-personalize as outlined in Install required software.

  • If you receive the error, Yubikey core error: write error — YubiKey is likely locked. Install and run yubikey-personalization-gui to unlock it.

  • If you receive the error, Key does not match the card's capability — you likely need to use 2048 bit RSA key sizes.

  • If you receive the error, sign_and_send_pubkey: signing failed: agent refused operation — you probably have ssh-agent running. Make sure you replaced ssh-agent with gpg-agent as noted above.

  • If you still receive the error, sign_and_send_pubkey: signing failed: agent refused operation — On Debian, try gpg-connect-agent updatestartuptty /bye

  • If you receive the error, Error connecting to agent: No such file or directory from ssh-add -L, the UNIX file socket that the agent uses for communication with other processes may not be set up correctly. On Debian, try export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"

  • If you receive the error, Permission denied (publickey), increase ssh verbosity with the -v flag and ensure the public key from the card is being offered: Offering public key: RSA SHA256:abcdefg... cardno:00060123456. If it is, ensure you are connecting as the right user on the target system, rather than as the user on the local system. Otherwise, be sure IdentitiesOnly is not enabled for this host.

  • If you totally screw up, you can reset the card.

Notes

  1. YubiKey has two configurations: one invoked with a short press, and the other with a long press. By default, the short-press mode is configured for HID OTP — a brief touch will emit an OTP string starting with cccccccc. If you rarely use the OTP mode, you can swap it to the second configuration via the Yubikey Personalization tool. If you never use OTP, you can disable it entirely using the Yubikey Manager application (note, this not the similarly named Yubikey NEO Manager).
  2. Programming YubiKey for GPG keys still lets you use its two configurations — OTP and static password modes, for example.
  3. Setting an expiry essentially forces you to manage your subkeys and announces to the rest of the world that you are doing so. Setting an expiry on a primary key is ineffective for protecting the key from loss — whoever has the primary key can simply extend its expiry period. Revocation certificates are better suited for this purpose. It may be appropriate for your use case to set expiry dates on subkeys.

Similar work

  • https://developers.yubico.com/yubikey-personalization/
  • https://developers.yubico.com/PGP/Card_edit.html
  • https://blog.josefsson.org/2014/06/23/offline-gnupg-master-key-and-subkeys-on-yubikey-neo-smartcard/
  • https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/
  • https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO
  • https://trmm.net/Yubikey
  • https://rnorth.org/gpg-and-ssh-with-yubikey-for-mac
  • https://jclement.ca/articles/2015/gpg-smartcard/
  • https://github.com/herlo/ssh-gpg-smartcard-config
  • http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/
  • https://help.riseup.net/en/security/message-security/openpgp/best-practices
  • https://alexcabal.com/creating-the-perfect-gpg-keypair/
  • https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/
  • https://evilmartians.com/chronicles/stick-with-security-yubikey-ssh-gnupg-macos
Источник


Description


Juraj Variny



2015-02-04 21:34:35 UTC

gpg --recv-key or gpg--search-key always fails with 
gpgkeys: HTTP fetch error 1: unsupported protocol
Same commands, on the same system with unchanged configuration but dynamically rebuilt gnupg are working.

Reproducible: Always

Steps to Reproduce:
1. Emerge gnupg with USE="static"
2. Configure hkps keyserver and certificate, in gnupg.conf for example:
keyserver hkps://hkps.pool.sks-keyservers.net
keyserver-options check-cert ca-cert-file=~/.gnupg/sks-keyservers.netCA.pem
3. Try gpg --search-key 677ABD62D0AEE7D7
Actual Results:  
Error message:
gpgkeys: HTTP fetch error 1: unsupported protocol

Expected Results:  
Whether key was found or not on the keyserver

Portage 2.2.14 (python 3.4.1-final-0, default/linux/amd64/13.0/desktop, gcc-4.8.3, glibc-2.19-r1, 3.17.7-gentoo x86_64)
=================================================================
System uname: Linux-3.17.7-gentoo-x86_64-AMD_Athlon-tm-_II_X4_630_Processor-with-gentoo-2.2
KiB Mem:    12301104 total,    761116 free
KiB Swap:   10485756 total,   9529476 free
Timestamp of tree: Wed, 04 Feb 2015 12:45:01 +0000
ld GNU ld (Gentoo 2.24 p1.4) 2.24
app-shells/bash:          4.2_p53
dev-java/java-config:     2.2.0
dev-lang/perl:            5.18.2-r2
dev-lang/python:          2.7.9-r1, 3.3.5-r1, 3.4.1
dev-util/cmake:           2.8.12.2-r1
dev-util/pkgconfig:       0.28-r1
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.13.8
sys-apps/sandbox:         2.6-r1
sys-devel/autoconf:       2.13, 2.69
sys-devel/automake:       1.11.6-r1, 1.12.6, 1.13.4
sys-devel/binutils:       2.24-r3
sys-devel/gcc:            4.7.3-r1, 4.8.3
sys-devel/gcc-config:     1.7.3
sys-devel/libtool:        2.4.4
sys-devel/make:           4.0-r1
sys-kernel/linux-headers: 3.16 (virtual/os-headers)
sys-libs/glibc:           2.19-r1
Repositories: gentoo x-portage sunrise haskell
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-g -O2 -march=native -mtune=native -ftree-vectorize -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/boot/cmdline.txt /boot/config.txt /etc /usr/share/config /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ati /etc/ca-certificates.conf /etc/env.d /etc/eselect /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/hal /etc/hotplug /etc/pam.d /etc/php/apache2-php5.5/ext-active/ /etc/php/cgi-php5.5/ext-active/ /etc/php/cli-php5.5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c /etc/xdg /etc/xml"
CXXFLAGS="-g -O2 -march=native -mtune=native -ftree-vectorize -pipe"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--quiet-build --keep-going"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="ftp://tux.rainside.sk/gentoo/ ftp://gentoo.wheel.sk/pub/linux/gentoo/ ftp://gd.tuwien.ac.at/opsys/linux/gentoo/ http://distfiles.gentoo.org"
LANG="sk_SK.UTF-8"
LC_ALL="sk_SK.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-O1 -Wl,--sort-common -Wl,--hash-style=gnu -Wl,--as-needed"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage /var/lib/layman/sunrise /var/lib/layman/haskell"
USE="3dnow 3dnowext 7zip X a52 aac acl acpi alsa amd64 amr apache2 apng bash-completion bazaar bluetooth branding bzip2 cairo cdda cdio cdr cli consolekit cpudetection cracklib crypt css cups curl cvs cxx darcs dbus dga dia djvu dri dts dvb dvd dvdr dvdread ebook emboss encode exif faac faad fam ffmpeg firefox flac fontconfig foomaticdb freetype gdbm gif git glamor gnutls gpm gs gtk hal i8x0 iconv icq icu imagemagick imlib inotify ipv6 irc jabber jack java jingle jpeg jpeg2k kde lash lcms libav libnotify lirc live lm_sensors logrotate lzma lzo mad matroska mercurial mjpeg mmx mmx2 mmxext mng mobi modules mp3 mp4 mpeg mplayer msn multilib ncurses network nls nptl nsplugin ogg oggvorbis openexr opengl openmp pam pango pcre pdf perl png policykit postgres ppds python qalculate qt qt3support qt4 quicktime readline real samba sdl semantic-desktop session smp sms spell sqlite sse sse2 sse3 ssl ssse3 startup-notification stream subversion svg syslog tcltk tcpd theora threads tiff tk truetype udev udisks unicode upower urandom usb utempter v4l v4l2 vcd vim-syntax vorbis webkit wifi win32codecs wmf wxwidgets wxwindows x264 xcb xext xine xinerama xml xpm xv xvid zlib zvbi" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias reqtimeout proxy proxy_http proxy_connect proxy_ajp" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmx2 mmxext 3dnow 3dnowext sse sse2 sse3 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en sk" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3 python3_4 pypy pypy3" QEMU_SOFTMMU_TARGETS="i386 ppc ppc64 x86_64" QEMU_USER_TARGETS="arm i386 x86_64" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" VIDEO_CARDS="ati radeon radeonsi vesa fbdev" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7 3.4"
Unset:  CPPFLAGS, CTARGET, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, SYNC


Comment 1


Kristian Fiskerstrand (RETIRED)


gentoo-dev


2015-02-06 09:56:22 UTC

Can you please confirm that curl and the crypto provider for HTTP has been built staticly? Please provide the configure log from the build of gnupg and libgcrypt.

fwiw, "gpgkeys: HTTP fetch error 1: unsupported protocol" is an error you will get independent of whether a key exists on a keyserver or not simply because it isn't making a connection to https (which hkps translates into with a specific path)


Comment 4


Kristian Fiskerstrand (RETIRED)


gentoo-dev


2015-02-07 21:30:08 UTC

(In reply to Juraj Variny from comment #3)
> Created attachment 395722 [details]
> gnupg build log

Can you please run with --keyserver-options verbose,debug and report what curl version is used. I suspect this is using curl-shim?


Comment 6


Kristian Fiskerstrand (RETIRED)


gentoo-dev


2016-05-22 15:36:57 UTC

Summary: Linking with curl when ssl provider is enabled doesn't work statically and test fails during gnupg building, so curl helpers are built with curl-shim that doesn't support hkps instead of using a full curl version. 

This is not a downstream breakage of the distro and it is not likely to change (although there is potentially better luck for static linking on alternative libc providers such as musl). Static linking for gnupg 2.0 is likely to be removed in future version altogether , gnupg 1.4 should be used if such situations are needed. 

Closing WONTFIX
Источник

can’t import keys from a keyserver

can’t import keys from a keyserver

i can’t seem to import keys from a keyserver. i am using the windows version 0.94.1

for example,

gpgkeys: no key data found for

http://pgp.mit.edu/

gpg: requesting key ABCD1234 from http server pgp.mit.edu

gpg: no valid OpenPGP data found.

gpg: Total number processed: 0

yet, if i search for the key ID using PGP desktop, it is immediately found on the keyserver

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby Adam » 29th Oct 2006 21:14

PGP desktop searches the PGP Corporation keyserver. pgp.mit.edu is a different keyserver and obviously doesn’t have the keys uploaded to it. Either upload the keys to the keyserver, or you could try setting Enigmail to use

ldap://certserver.pgp.com

to download the keys.

Mozilla Thunderbird 2.0, Enigmail 0.95.5, GnuPG 1.4.8-MobilityEmail
OpenPGP Key ID 0x37858A47

Adam
Experienced user
Experienced user
 
Posts: 119
Joined: 5th Dec 2005 17:34
  • Website

Postby scar » 31st Oct 2006 05:44

sorry i was not clear. the key is, in fact, on pgp.mit.edu. additionally, i have manually added

http://pgp.mit.edu

to PGP desktop and it finds the key on that server. enigmail does not find the key. i have tried several different keys on different servers, but enigmail just can’t seem to find the keys.

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby scar » 14th Nov 2006 20:26

i have some updates. my findings have led me to think there is a problem with http protocol in enigmail.

1.) if i search for my key (ID 0xdbbdf2a0) in my web browser using

https://keyserver.pgp.com

i will find it.

2.) if i search for my key in enigmail using

ldap://keyserver.pgp.com

i will find it.

3.) if i search for my key in my web browser at

http://pgp.mit.edu

i will find it.

4.) if i search for my key in enigmail using

http://pgp.mit.edu

i will *not* find it; i get the error mentioned in the first post.

can anyone verify this?

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby patrick » 15th Nov 2006 08:56

All keyserver functions are performed by GnuPG, not by Enigmail (but that’s a detail). I think the main problem is that the protocol for keyservers is not called «http» but «hkp». The http protocol can only be used to retrieve specific keys, especially searching and uploading are not supported-

You should configure your keyserver like this (both variants are OK, since hkp is the default protocol):

hkp://pgp.mit.edu

pgp.mit.edu

User avatar
patrick
Developer
Developer
 
Posts: 517
Joined: 13th Nov 2005 22:16
Location: Zurich, Switzerland
  • Website

Postby scar » 20th Nov 2006 06:13

ok. it seems to work when i set «extensions.enigmail.respectHttpProxy» to «false». should hkp protocol work over an http proxy? if so, then it seems to not work right. if not, when «extensions.enigmail.respectHttpProxy» is set to «true» it should not use the http proxy for hkp requests.

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby patrick » 21st Nov 2006 11:49

Yes, hkp should work over a http proxy, if one is configured. HKP is just a group of defined URLs that work on top of HTTP.

User avatar
patrick
Developer
Developer
 
Posts: 517
Joined: 13th Nov 2005 22:16
Location: Zurich, Switzerland
  • Website

Postby scar » 26th Nov 2006 07:36

unfortunately, it’s not working. i’m using «Polipo». i use it with firefox and thunderbird and have never had a problem with it except with this extension. any ideas?

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby scar » 6th Dec 2006 08:59

i relayed this issue to the Polipo group and it has been found to be a bug with GnuPG. a bug report has been filed:

https://bugs.g10code.com/gnupg/issue739

scar
Novice User
Novice User
 
Posts: 14
Joined: 29th Oct 2006 09:04

Postby chrimp » 25th Oct 2007 12:22

hello eveybody,

I have the same problem and I have no idea how to fix it.

This is the message:

Code: Select all
gpgkeys: hkp fetch error 1: unsupported protocol
gpg: requesting key 33D2CCF6 from hkp server pgp.mit.edu
gpg: Keine gültigen OpenPGP-Daten gefunden.
gpg: Anzahl insgesamt bearbeiteter Schlüssel: 0

I tried to set another server or manually an https:// but nothing worked for me.

Any ideas?

Thunderbird 2.0.0.6

Enigmail 0.95.4

gnuPG 1.4.7

thanks a lot!

chrimp
New user
New user
 
Posts: 2
Joined: 24th Oct 2007 12:43

Postby patrick » 25th Oct 2007 13:44

https is not supported by GnuPG.

User avatar
patrick
Developer
Developer
 
Posts: 517
Joined: 13th Nov 2005 22:16
Location: Zurich, Switzerland
  • Website

Postby chrimp » 25th Oct 2007 14:13

patrick wrote:https is not supported by GnuPG.

hkp, http and ldap also don’t work. ;(

chrimp
New user
New user
 
Posts: 2
Joined: 24th Oct 2007 12:43

Return to General Discussions

Источник

Recommend Projects

  • React photo

    React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo

    Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo

    Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo

    TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo

    Django

    The Web framework for perfectionists with deadlines.

  • Laravel photo

    Laravel

    A PHP framework for web artisans

  • D3 photo

    D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Visualization

    Some thing interesting about visualization, use data art

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo

    Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo

    Microsoft

    Open source projects and samples from Microsoft.

  • Google photo

    Google

    Google ❤️ Open Source for everyone.

  • Alibaba photo

    Alibaba

    Alibaba Open Source for everyone

  • D3 photo

    D3

    Data-Driven Documents codes.

  • Tencent photo

    Tencent

    China tencent open source team.

Источник

Понравилась статья? Поделить с друзьями:
  • Gpg keyserver receive failed general error
  • Gpg error termux
  • Gpg error nodata
  • Google все время закрывается ошибка
  • Google все время закрывается на телефоне android как исправить