PGP & GPG: Best practices and where to start

I thought it would be nice to have some discussion about PGP/GPG, and how to set it up. My understanding of PGP is alarmingly shallow, I know how to generate a key pair and how to use it with email. Most guides focus only on this part it seems (1 device, 1 mail address, 1 identity) But it seems hard to gather information on PGP/GPG best practices, some key points that come to my mind: - How to properly back them up. - How to isolate and manage multiple 'identities' (work, private, internet presence) - How to handle multiple e-mail addresses. - How to handle multiple devices (PC, Laptop, private Server, Phone?, etc.) -> Subkeys? [0] - How to sync between devices (I guess that is not necessary, or is it?) Also: - Common Pitfalls to be aware of as a mere user without advanced PGP/GPG or crypto knowledge Maybe you lainons could talk a bit about your setup, or address some of these points, even? [0] https://wiki.debian.org/Subkeys

One of my good friends has recently started down this rabbit hole and came up with using a GPG keycard as his solution. I trust his judgement as he's the most leet person I know, and researches his soykaf quite thoroughly. Here's a guide that briefly touches on the concept. https://lwn.net/Articles/734767/ He picked up some programmable USB based keycards and showed me how to start modifying it with Gnuk. I can't remember the model off-hand as I left it at work. I think it uses an STM32? Can't remember exactly. Going to try to get more familiar with this before I feel comfortable flashing my own card, epoxying it so it can't be tampered and pushing a keyset to it. Hopefully we will be having a key rolling cryptoparty by the end of the year.

man gpg

>>3122 >How to properly back them up that's up to you and your threat model. stick the master on a usb keep it safe (whatever that means to you). >How to isolate and manage multiple 'identities' Roll up multiple keys. It should be 1 master key per *identity* that's kind of the point of the web of trust. FWIW you'd probably want one key for your 'real name' identity (for both work and 'private' since both your coworkers and your friends presumably know your real name). New keys for each online identity you don't want associated with eachother. >How to handle multiple e-mail addresses. See >>3124 You can add multiple email addresses for the same identity. >How to handle multiple devices This is a hard question and many people have different answers. Some people like having a dongle like >>3123 suggests. Personally, I make subkeys for signing and encryption, then strip out the master key before copying it to other less secure devices. >How to sync between devices PGP keys last a while... can't you just manually copy them every couple years or whatever? If you really need to have access to your keys on an impractically large number of devices, you should go with the usb keycard thing.

-set a 1-year expiration for all your encryption subkeys -always always always generate revocation certificates and keep them in a safe place, publish them when necessary -use it! Get other people to use it! PGP is useless if you're the only one using it.

>>3123 Have a link to those keycards by any chance?

PGP may not be as good as you think it is. https://secushare.org/PGP

>>4550 Sounds like the guy doesn't know what he wants.

I use PGP for managing secure information such as other passwords that I don't want stored in plain text on my personal computer. However I'm starting to get bothered by having to entre my password whenever I do things like synchronise email, and have tried to look for ways around it. This suggests to me that PGP probably isn't the tool to use here, since I doubt it's ever a good idea to store your private key unencrypted, even on an encypted drive. Is there any established best practice for handling automated passwords without resorting to plain text? As an aside, I do actually have a smart card reader on my laptop, would a PGP card enable to me decrypt my key just by inserting the card? That would be neat.

>>4552 Yeah, use pass https://passwordstore.org

Honestly I'm surprised this hasn't already been posted. https://sanctum.geek.nz/arabesque/gnu-linux-crypto-gnupg-keys/ this guy post a whole intro series for linux/crypto. its not that bad. I would advice looking a little deeper into some subjects depending on threat model/preference. for example I used keepass instead of pass. I would recommend keeping a cheatsheet for gpg with your backups as well. I don't use gpg in a command line setting that often and I find that I forget the commands. most are pretty straightforward though. also set your public key as your signature in your email client if you intend to use it for email.

>>4555 But pass uses gpg, that doesn't solve my problem at all.

>>4572 Wait, you're using symantec PGP? Or even just any other OpenPGP implementation?

>>4552 If you want to secure everything on your computer, use full disk encryption. LUKS is the best and what you want to use for GNU/Linux. Otherwise, use Veracrypt for Windows.

>>4549 Sorry I never saw this reply, I'll come up with a list of a few options and get back to you. I know of at least three different devices that should be sufficient to operate as a GPG token, I'll try to get you more info soon.

>>4549 Here's a few options. ST-Link V2: https://www.aliexpress.com/item/ST-Link-V2-Programming-Unit-mini-STM8-STM32-Emulator-Downloader-M89-New/32631496848.html FST-01: https://shop.fsf.org/storage-devices/neug-usb-true-random-number-generator Maple Mini: https://www.amazon.com/WINGONEER-Maple-board-STM32F103CBT6-compatibility/dp/B016IV7MV4 Blue Pill: (might be some for sale on eBay) http://wiki.stm32duino.com/index.php?title=Blue_Pill

>>4549 >Have a link to those keycards by any chance? >>4647 >[a recommended list of gnuk tokens] These are software-based (gnuk) USB tokens that run on Cortex M3. The advantages are... widely-available cheap hardware, gnuk has upstream support from GnuPG, completely verifiable free hardware and software, and easily-upgradable to support new features (like OpenPGP Card v3, w/ Curve25519), but these generic microcontrollers are not designed to withstand physical attacks, and they're relativity low-speed (8+ seconds for a signing/decrypting operation w/ RSA-4096). Depending on your requirement, you may want to get other cards. The most common option is the "original" OpenPGP Card made by the company ZetiControl. Many official GnuPG developers (including Werner Koch himself) have this card. You need a full-size cardreader to use it, or you can get the smaller SIM-sized version to pair with a thumb-sized portable USB reader. However, to my best knowledge, including the original OpenPGP Card by ZetiControl, or any other JavaCard/BasicCard on the general market are standard cards, not "secure" card... On the other hand, it seems possible physical attack to STM32F3 is more widely known in the industry, while attacks to BasicCard/JavaCard is relatively less-known. Also the crypto primitives of these cards are implemented on the ASIC chip, attacks should be harder than STM32F3. g10 code's official website has some information, the vendor is FLOSS-Shop. FLOSS-Shop's cards are now loaded with the new OpenPGP v3 firmware. Unfortunately, the v3 source code is not available, and I'm not sure whether Curve25519 is supported even with v3 because of hardware limitation. Probably not. But these premade cards are not designed to be hackable by end-users, anyway. >https://www.g10code.com/p-card.html >https://www.floss-shop.de/de/security-privacy/smartcards/ Traditionally, becoming a fellow member of the Free Software Foundation of Europe was the major way to get the card for more than 10 years. But they don't issue the card anymore since November 2017. Unfortunately. >https://web.archive.org/web/20170511075257/http://wiki.fsfe.org/TechDocs/FellowshipSmartCard >https://fsfe.org/news/2017/news-20171116-01.en.html Nitrokey is known for its free hardware and software design. In fact, the Nitrokey Start is just an overpriced version of gnuk STM32 token, and the Nitrokey Pro is a free hardware USB card reader with a ZetiControl card inside... >https://shop.nitrokey.com/shop/product/nitrokey-pro-3 Nitrokey Pro's USB reader + ZetiControl card is inspirited from an earlier project called Crypto Stick by German Privacy Foundation. These sticks has been obsoleted by Nitrokey, but for historical purpose... >https://www.privacyfoundation.de/projekte/crypto_stick/crypto_stick_english/ Also, there are several free firmware implementations of OpenPGP Card standards for JavaCard and BasicCard, you can purchase blank cards and program the card by youself. OpenPGP on JavaCards Tutorial >https://subgraph.com/sgos/documentation/smartcards/index.en.html Achim Pietig’s BasicCard implementation. >OpenPGP Card v2.1 >http://g10code.com/docs/openpgp-card-v21-free-source.zip It can be flashed to a standard BasicCard. Achim Pietig is the author of the OpenPGP card specification. This is the source code of OpenPGP Card v2.1 application running on ZetiControl's original card, released by g10 code. BasicCard itself comes with its own system, but the OpenPGP application itself is completely free software. Joeri de Ruiter's Java Card implementation. >OpenPGP Card v2.0 >https://github.com/jderuiter/javacard-openpgpcard FluffyKaon's Java Card implementation >OpenPGP Card v2.0 >https://github.com/FluffyKaon/OpenPGP-Card ANSSI's Java Card implementation, up-to-date, recommended. Note: a free software project under the management of Agence nationale de la sécurité des systèmes d'information of French government, probably some developers in the college with government grants. >OpenPGP Card v3.3 >https://github.com/anssi-fr/smartpgp Alternatively, Yubikey's proprietary USB token also implements the OpenPGP Card standard on a secure microcontroller with certification. >https://www.yubico.com/ Such cards usually come with a temper-resistance version of microcontroller core, sometimes with certification, and good performance. But the firmware is proprietary due to NDA-restrictions imposed by the hardware manufacturer. Whether they are trustworthy or not is your own discretion. Interestingly, some Bitcoin wallets also have OpenPGP Card capabilities, and providing their own version of gpg-agent to operate with. I've personally never tried any of these wallets, but these hardware trends to have better transparency and security attention from the community due to their high value and Bitcoin fever. Yubikey and ZetiControl don't release code and firmware at all (though g10 code released the application code of OpenPGP v2.1), while most Bitcoin wallets release everything they can. Trezor. The original, best-tested Bitcoin wallet, now comes with upgraded firmware and its version of gpg-agent (called trezor-agent) for GnuPG and SSH! But unlike the advertisement, it's not the most secure hardware wallet. Both Trezor One and Trezor Model T only use a generic STM32 microcontroller, STM32F205 and STM32F427, respectively. Techinically it's no better than gnuk-based tokens (STM32F4 is faster though), Trezor's attack surface may be larger. But in case you need a Bitcoin wallet, it can be used with OpenPGP/SSH as well! 100% free software/hardware. >https://trezor.io >https://github.com/trezor/trezor-core/blob/master/docs/hardware.md >https://github.com/romanz/trezor-agent Ledger Nano S. A nice Bitcoin wallet based on ST31 secure processor w/ NDA. The developers said they release everything except the low-level binary blob of ST31. Not perfect but probably a better choice than Yubikey. >https://www.ledgerwallet.com/products/ledger-nano-s >https://old.reddit.com/r/Bitcoin/comments/4oyylt/ledger_nano_s_new_generation_hardware_wallet/d4hpwkc/ Secalot. This is a Bitcoin wallet based on NXP K82 microcontroller, looks like the K82 is designed for IoT applications and it just has a crypto coprocessor, instead of being a secure processor. But I guess it should be more secure than generic versions of STM32 (who knows?), and it doesn't have NDA, so 100% free software. >https://www.secalot.com/ >https://www.reddit.com/r/Bitcoin/comments/6dzuho/secalot_a_hardware_bitcoin_wallet_with_extra/ >https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/kinetis-cortex-m-mcus/k-seriesperformancem4/k8x-secure/kinetis-k82-150-mhz-hw-cryptographic-co-processor-quadspi-microcontrollers-mcus-based-on-arm-cortex-m4-core:K82_150 If you already use Bitcoin and the value of your Bitcoin is greater than the price of the wallet (80 Euro), personally I think getting a Ledger Nano S for both Bitcoin and OpenPGP is the best choice. I've spent two hours putting everthing together, lainons, free to make your own choice! The bottom-line is, any OpenPGP card, even it's a piece of proprietary hardware, or an unsecred generic microcontroller, or whatever, is still better than not using a card at all. Even the hardware is unsecured, it's still provide physical isolation from your operating system and this is the biggest reason to have a card, after all. If you have problems, such as cannot afford high price of a card, cannot find a vendor, or international shipping issues, I recommend you to get the cheapest STM32 board (per >>4647) and secure your key IMMEDIATELY, instead of waiting for your dreaming card, which is a problem you can solve later.

>>4663 I have analysis paralysis now. Thanks. Man, if I felt like I had no idea what I was doing before, that's just been magnified by orders of magnitude.

botan is a comfy library

>>3466 I wish I could get my friends/co-workers on board with the idea of using PGP to sign/encrypt emails. Has anyone been successful in doing this without sounding like an annoying tinfoil hat wearing preacher?