4 ms·

I'm getting this error upon trying to create a team: > can't create a new team without having provisioned a per-user key According to the docs (https://keybas

by wilg 9y ago

I'm getting this error upon trying to create a team: > can't create a new team without having provisioned a per-user key According to the docs (https://keybase.io/docs/teams/puk https://keybase.io/docs/teams/puk) it should have automatically been created for me, though? Not sure if relevant but I did not use the auto-updater to update Keybase for macOS (if there is one), I just downloaded the latest DMG.

maxtaco 9y ago
In case anyone's curious, all Keybase users are now getting "per user keys" (PUKs). It's a key whose secret key is encrypted for each of your devices, and whose public key is advertised publicly in your sigchain. New users get a PUK right away, and older users run a background thread to make one. wilg's thread missed a window and would have rerun in 50 minutes, but he solved the problem by starting up a different device. In turn, all team crypto operations happen for PUKs (and not device keys) so it's necessary to have a PUK before you can use teams. These details are mainly hidden from users, except for bugs (as above, but we'll fix it soon). This is a change from previous designs, but the advantage is that when a user adds a new device, she'll get instant access to all teams, when the PUK's secret key is encrypted for the new device. Whenever a user deletes a device, there's a rekey cascade --- the user's PUK is rotated, and so are all teams the user is a member of. More info here: https://keybase.io/docs/teams/puk https://keybase.io/docs/teams/puk
- Gaelan 9y ago
  How does this interact with device compromise?
  - azag0 9y ago
    From the link: "On device revoke, the revoking device makes a new master key, encrypts for the private key for all remaining devices, and writes the new master key to the sigchain along with the statement revoking the old device."
    - maxtaco 9y ago
      Exactly. Sorry for the doc bug there. s/master key/PUK/g, now fixed on the site. An earlier internal name for PUKs was "master keys" but we've since changed.
tanderson92 9y ago
I have the same error. And what's strange is I believe I do have a per-user key on this device. At least I think I do, based on the output of `keybase device list`
- maxtaco 9y ago
  Looks like you also got a PUK, but after a delay. Signature here: https://keybase.io/tanderson/sigchain#9b066b9a96f8d041cf7b559d885cd0128ca1f633d46703af3ab2c160d717c7d70f https://keybase.io/tanderson/sigchain#9b066b9a96f8d041cf7b55...
  - tanderson92 9y ago
    Yep, thanks!

by wilg 9y ago

maxtaco 9y ago

In case anyone's curious, all Keybase users are now getting "per user keys" (PUKs). It's a key whose secret key is encrypted for each of your devices, and whose public key is advertised publicly in your sigchain. New users get a PUK right away, and older users run a background thread to make one. wilg's thread missed a window and would have rerun in 50 minutes, but he solved the problem by starting up a different device. In turn, all team crypto operations happen for PUKs (and not device keys) so it's necessary to have a PUK before you can use teams. These details are mainly hidden from users, except for bugs (as above, but we'll fix it soon). This is a change from previous designs, but the advantage is that when a user adds a new device, she'll get instant access to all teams, when the PUK's secret key is encrypted for the new device. Whenever a user deletes a device, there's a rekey cascade --- the user's PUK is rotated, and so are all teams the user is a member of. More info here: https://keybase.io/docs/teams/puk https://keybase.io/docs/teams/puk

Gaelan 9y ago
How does this interact with device compromise?
- azag0 9y ago
  From the link: "On device revoke, the revoking device makes a new master key, encrypts for the private key for all remaining devices, and writes the new master key to the sigchain along with the statement revoking the old device."
  - maxtaco 9y ago
    Exactly. Sorry for the doc bug there. s/master key/PUK/g, now fixed on the site. An earlier internal name for PUKs was "master keys" but we've since changed.

tanderson92 9y ago

I have the same error. And what's strange is I believe I do have a per-user key on this device. At least I think I do, based on the output of `keybase device list`

maxtaco 9y ago
Looks like you also got a PUK, but after a delay. Signature here: https://keybase.io/tanderson/sigchain#9b066b9a96f8d041cf7b559d885cd0128ca1f633d46703af3ab2c160d717c7d70f https://keybase.io/tanderson/sigchain#9b066b9a96f8d041cf7b55...
- tanderson92 9y ago
  Yep, thanks!