Hi. I've recently done something similar with the OpenPGP Smartcard V2[1] (YubiKey seems nicer now, but I don't think they existed when I got mine. In any case,

Hi. I've recently done something similar with the OpenPGP Smartcard V2[1] (YubiKey seems nicer now, but I don't think they existed when I got mine. In any case, they both seem to perform the same GPG operations, mine can also only hold 3 subkeys, etc). > In addition my main key is ~elsewhere~: After loading three subkeys on the yubikey I saved and removed my main key from the keychain. This _should_ solve the problem of the airgap in this article? A reasonable way to get access to your data/mail without giving access to your secret key? The way I understand it the reason for keeping your main key seperate from the card is so that in case you lose the card you can still issue revocations and issue new keys signed by your master key. The smartcard still contains three seperate secret keys, but does indeed not expose them to the computer. > I'm confused about the key backup solutions here. Keys generated on the smart card cannot be backed up as far as I can see. I have a decent idea of how I'm going to handle my master key (both where and how I'll store it safely), but .. the rest is still not quite clear to me Personally I've opted against having my smartcard generate the keys, because like you said this means it is impossible to extract the subkey used for encryption. Instead I generated the keys on a Raspberry Pi, used paperkey[2] to print them to paper (don't forget to also print some instructions on how to restore, in case you forget or someone else has to do it), and also burned them to a few CDROMs. Then I transferred them to the smartcard, keeping them on the Raspberry Pi's SD card as well, which I keep in a secure location with the CDRoms. > Mobile. So, if my day to day keys are on this smart card, I cannot read those mails on my mobile. Which .. might be a good thing when we talk about security, but a PITA for my day to day usage. No idea how or if I can solve this one I've been wondering if it would be possible to install opengpg on a rooted android phone and then seeing if it were possible to connect it to an usb smartcard reader using an OTG cable, but honestly I think that'd mostly just be a lot of wasted time and effort, and possibly insecure. I tend to carry a chromebook around and instead use that. > But back to the article: If you're in the "whistle-blowers, activists, spies" category, is the airgap (physically) really required or would a smart card give you the same protection? I think a smart card could give you similar protection, if it were to work perfectly. I don't think we can be absolutely certain they aren't backdoored, which is easier to make sure with a basic linux install on a computer that has never seen the internet. Additionally, if you were to use a smart card on a computer attached to the network, the plaintext would exist on that computer at some point which would be a problem if a keylogger or similar were present. [1] http://shop.kernelconcepts.de/product_info.php?products_id=42 http://shop.kernelconcepts.de/product_info.php?products_id=4... [2] http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/