4 ms·

Incidentally, I've been working with digital signatures which are legally equivalent to traditional ones in my country (Poland) and comparing them to a GnuPG se

by jwr 8y ago

Incidentally, I've been working with digital signatures which are legally equivalent to traditional ones in my country (Poland) and comparing them to a GnuPG setup with private keys stored on a YubiKey. It seems to me that my YubiKey setup (done following https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide) is substantially better in almost every respect than the state-provided smartcard. I intend to publish a signed PDF document (signed with the state-certified RSA key) that says that my GnuPG keys are really mine.

Boulth 8y ago
> It seems to me that my YubiKey setup (done following https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide) is substantially better in almost every respect than the state-provided smartcard. Would you care to explain the differences in detail? As far as I know the EU qualified certs are also required to be stored on smartcards so the only difference vs Yubikey would be Yubikey's portable format (it is a smartcard reader and a smartcard in one device).
- jwr 8y ago
  Perhaps not in detail, but in general outline: * I was able to generate my GnuPG keys myself and I know (to the extent that I trust my computing environment) that I am the only one to have access to the secret key(s), * the state-approved qualified cert is only a single RSA key, for signatures, * you don't get to make a backup of that key, * as a result, it can't really be used for anything else than signing documents, so forget about encrypting data or using it for authentication for example (cases where you really do need to have backups), * the key is stored on a physically inconvenient device (smartcard) and you need to have one and only one of those, Plus, of course you get the whole beauty of crappy PKI infrastructure (why does every company dealing with certs have to be shady, have a crappy website and in general be a mess?). But that is beside the point, I guess.
  - dcbadacd 8y ago
    Just for comparison the Estonian system: * As far as I know upon cert renewal the new cert is generated on your computer, uploaded to the card and then deleted - you could theoretically intercept that but I don't see why you would - the key is more secure on the card * The state-approved certs one is for e-identification (when PIN is entered also authentication), other for signing (AFAIK not RSA but EC) * See point one * Encrypting data can be done but as the software warns, it's to protect the data during transit not when idle and nothing is stopping me from using the card daily to log into my bank and other services I need to use * The key is stored on the smart card but you can get multiple (AFAIK at least for e-identification). Don't know much about the Estonian PKI infrastructure though and it seems stable enough for daily use without any noticeable hiccups.
    - pisipisipisi 8y ago
      The key is generated inside the card, but the key generation is initiated via your computer (but in fact, initiated by the card management system). So no, you can not intercept any keys in that process.
      - dcbadacd 8y ago
        Thanks for correcting me, I vaguely remember external key generation being possible/done but google is being useless at helping me find where I read about it.
        Boulth 8y ago
        External key generation could still make sense as Estonian ID card were suspectible to the Infineon bug. One workaround to that bug would be generating the key in software and putting it on the card. (I'm not saying that's the case, but merely that it may make sense.)
      - jwr 8y ago
        What I did not like about the process in Poland was that the key generation was done using a computer that wasn't mine. How do I know if the key was really generated on the card, rather than on the PC (and then a copy uploaded to the card)? I have to trust the companies that provide the issuing services, which I do not like.
- cjcollier 8y ago
  The state supplies smart cards?!
deleted 8y ago
[deleted]
jradd 8y ago
I use Yubi-Nano for email signing as well as authentication/security with gpg-agent for remote SSH. I haven't figured out the problems I'm having with multiple sessions/sockets, but aside from the need to recycle my agent from time to time, this is extremely convenient and exceptionally secure. I wrote a summary of this setup [1] a while back, that might be helpful, though yubikey has a good writeup [2] already. [1]: https://blog.jeremyredd.com/ https://blog.jeremyredd.com/ [2]: https://developers.yubico.com/PGP/SSH_authentication/ https://developers.yubico.com/PGP/SSH_authentication/
cjcollier 8y ago
Do you have your notary commission yet?

by jwr 8y ago

Boulth 8y ago

> It seems to me that my YubiKey setup (done following https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide) is substantially better in almost every respect than the state-provided smartcard. Would you care to explain the differences in detail? As far as I know the EU qualified certs are also required to be stored on smartcards so the only difference vs Yubikey would be Yubikey's portable format (it is a smartcard reader and a smartcard in one device).

jwr 8y ago
Perhaps not in detail, but in general outline: * I was able to generate my GnuPG keys myself and I know (to the extent that I trust my computing environment) that I am the only one to have access to the secret key(s), * the state-approved qualified cert is only a single RSA key, for signatures, * you don't get to make a backup of that key, * as a result, it can't really be used for anything else than signing documents, so forget about encrypting data or using it for authentication for example (cases where you really do need to have backups), * the key is stored on a physically inconvenient device (smartcard) and you need to have one and only one of those, Plus, of course you get the whole beauty of crappy PKI infrastructure (why does every company dealing with certs have to be shady, have a crappy website and in general be a mess?). But that is beside the point, I guess.
- dcbadacd 8y ago
  Just for comparison the Estonian system: * As far as I know upon cert renewal the new cert is generated on your computer, uploaded to the card and then deleted - you could theoretically intercept that but I don't see why you would - the key is more secure on the card * The state-approved certs one is for e-identification (when PIN is entered also authentication), other for signing (AFAIK not RSA but EC) * See point one * Encrypting data can be done but as the software warns, it's to protect the data during transit not when idle and nothing is stopping me from using the card daily to log into my bank and other services I need to use * The key is stored on the smart card but you can get multiple (AFAIK at least for e-identification). Don't know much about the Estonian PKI infrastructure though and it seems stable enough for daily use without any noticeable hiccups.
  - pisipisipisi 8y ago
    The key is generated inside the card, but the key generation is initiated via your computer (but in fact, initiated by the card management system). So no, you can not intercept any keys in that process.
    - dcbadacd 8y ago
      Thanks for correcting me, I vaguely remember external key generation being possible/done but google is being useless at helping me find where I read about it.
      - Boulth 8y ago
        External key generation could still make sense as Estonian ID card were suspectible to the Infineon bug. One workaround to that bug would be generating the key in software and putting it on the card. (I'm not saying that's the case, but merely that it may make sense.)
    - jwr 8y ago
      What I did not like about the process in Poland was that the key generation was done using a computer that wasn't mine. How do I know if the key was really generated on the card, rather than on the PC (and then a copy uploaded to the card)? I have to trust the companies that provide the issuing services, which I do not like.
cjcollier 8y ago
The state supplies smart cards?!

deleted 8y ago

[deleted]

jradd 8y ago

I use Yubi-Nano for email signing as well as authentication/security with gpg-agent for remote SSH. I haven't figured out the problems I'm having with multiple sessions/sockets, but aside from the need to recycle my agent from time to time, this is extremely convenient and exceptionally secure. I wrote a summary of this setup [1] a while back, that might be helpful, though yubikey has a good writeup [2] already. [1]: https://blog.jeremyredd.com/ https://blog.jeremyredd.com/ [2]: https://developers.yubico.com/PGP/SSH_authentication/ https://developers.yubico.com/PGP/SSH_authentication/

cjcollier 8y ago

Do you have your notary commission yet?