3 ms·
Which version of GnuPG are you using? (BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace f
by sowbug 9y ago
Which version of GnuPG are you using?
(BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
- danieldk 9y agoWhich version of GnuPG are you using? Version 2.2.5. The keyspace for PINs is tiny and trivially brute-forceable. Good point!
- sowbug 9y agoThanks. I'll wait for Ubuntu 18.04 to arrive and hope it contains a 2.2.x version, which might behave better.
- sowbug 9y agoConfirmed that 2.2.5 on Ubuntu 16.04 works with NIST P-256 for SSH authentication. For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/ http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked. Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.