Ecco uno scenario specifico che ho.
Voglio avere sottochiavi sul mio portatile e conservare la chiave principale in modo sicuro.
Quindi sono andato avanti e ho creato nuove chiavi:
gpg --gen-key
gpg (GnuPG/MacGPG2) 2.0.20; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 8192 bits long.
What keysize do you want? (2048) 1024
Requested keysize is 1024 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: John Nash
Email address: [email protected]
Comment:
You selected this USER-ID:
"John Nash <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 6750A605 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 4 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 1f, 0u
gpg: next trustdb check due at 2015-01-02
pub 1024R/6750A605 2014-09-10
Key fingerprint = BAB9 E8A4 4191 1B99 F8D1 ED09 544A F1E9 6750 A605
uid John Nash <[email protected]>
sub 1024R/68E051E2 2014-09-10
Come ho visto, ho creato un set predefinito di chiavi che generava una sottochiave per la crittografia. Dopo aver creato una nuova chiave di firma:
gpg --edit-key jnash
gpg (GnuPG/MacGPG2) 2.0.20; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
pub 1024R/6750A605 created: 2014-09-10 expires: never usage: SC
trust: ultimate validity: ultimate
sub 1024R/68E051E2 created: 2014-09-10 expires: never usage: E
[ultimate] (1). John Nash <[email protected]>
gpg> addkey
Key is protected.
You need a passphrase to unlock the secret key for
user: "John Nash <[email protected]>"
1024-bit RSA key, ID 6750A605, created 2014-09-10
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
Your selection? 4
RSA keys may be between 1024 and 8192 bits long.
What keysize do you want? (2048) 1024
Requested keysize is 1024 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
pub 1024R/6750A605 created: 2014-09-10 expires: never usage: SC
trust: ultimate validity: ultimate
sub 1024R/68E051E2 created: 2014-09-10 expires: never usage: E
sub 1024R/C1DC3BB6 created: 2014-09-10 expires: never usage: S
[ultimate] (1). John Nash <[email protected]>
Questo mi ha lasciato con le seguenti sottochiavi:
pub 1024R/6750A605 created: 2014-09-10 expires: never usage: SC
trust: ultimate validity: ultimate
sub 1024R/68E051E2 created: 2014-09-10 expires: never usage: E
sub 1024R/C1DC3BB6 created: 2014-09-10 expires: never usage: S
Dopo che ho esportato le sottochiavi e la chiave principale dal portachiavi:
gpg --export-secret-key jnash --armor > masterkey
gpg --export-secret-subkeys jnash --armor > subkeys
gpg --delete-secret-key jnash
E ho importato le sottochiavi solo con gpg --import subkeys che mi ha lasciato con il seguente risultato quando eseguivo gpg -K
sec# 1024R/6750A605 2014-09-10
uid John Nash <[email protected]>
ssb 1024R/68E051E2 2014-09-10
ssb 1024R/C1DC3BB6 2014-09-10
Da quanto ho capito, ora non ho più la chiave principale e questo computer è pronto per partire.
Ora, diciamo che mi sono stato rubato e che le mie chiavi sono state compromesse.
Dovrò revocare 68E051E2 e C1DC3BB6 giusto?
Ma dopo averlo fatto e averli sostituiti con nuovi, non sarò in grado di aprire vecchie cose che sono state crittografate e firmate con entrambe le chiavi, vero?
- Disclaimer: I dati sopra riportati sono solo di esempio. Non avrei mai le chiavi con solo 1024 in dimensione della chiave.