4 ms·

Does anyone have a good source on what kind of keys I should make? Or what ciphers I should enable on my key (is that the right terminology?) Should I add a sm

Does anyone have a good source on what kind of keys I should make? Or what ciphers I should enable on my key (is that the right terminology?) Should I add a small thumbnail photo of myself in my key? Or is that generally frowned upon? Finally, are there good sources on how I would create a 4096 bit master key, and then add a 2048 bit subkeys for signing and encryption that I can add to my smart card which only allows for keys up to 2048? Would generating 2048 subkeys allow me to still decrypt gpg encrypted emails sent to me encrypted with my 4096 bit master key? Still trying to figure this all out after picking up some YubiKeys

hlieberman 11y ago
The best document I've found for key generation (the one I turn to myself, when my memory needs refreshing) is the one on Riseup: https://help.riseup.net/en/security/message-security/openpgp/best-practices https://help.riseup.net/en/security/message-security/openpgp... . If you follow that guide, you will get a keypair that avoids the common pitfalls. The photo question is an interesting one - some people frown on it, some people like it. Personally, I lean towards not adding them, just because the number of times I've actually checked it is so low (maybe once, ever.) That being said, I don't think people feel so strongly that they'd refuse to use or sign your key over it; they might just not sign that particular uid. (The photo is stored the same way an alternate email is, basically.) Properly setting up an offline subkey involves some rather archaic incantations; even more so when you are burning them into a smart card. Specifically, I would probably use some combination of the above instructions (to get my gpg.conf into the correct state), and then something like this guide: https://gist.github.com/abeluck/3383449 https://gist.github.com/abeluck/3383449 Specifically, I would look for a guide that instructs you to have a master key that is valid only for certification. I have a personal dislike for allowing your "master" key to be used for encryption, because it incentivizes you to do things that are not best-practice: specifically, using it. In the ideal world, your master key is kept, encrypted, on one (or more) USB drives that are all kept in various safes, and are never plugged into a computer that has an internet connection. Bonus points if the computer isn't used for anything else either. This is because your master key is the Thing That Must Not Be Compromised -- or you need to revoke the entire key and can never use it again. If a "working" subkey gets compromised, you can revoke it without losing all of the certification effort you've put into validating your identity in the web of trust.
acabal 11y ago
I wrote a short guide called "Creating the perfect GPG keypair" < https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/ > some time ago. I mainly wrote it for myself as a sort of step-by-step reminder on how to create an ideal key, but it seems others have found it useful. In particular it borrows from the Debian guide on creating subkeys for use on a laptop (or other device that has a high chance of being stolen/compromised). I don't consider myself an expert, and the guide is compiled from synthesizing several other guides. If anyone has tips on how to improve the guide, or spots any errors, please do let me know so I can update it.

hlieberman 11y ago

The best document I've found for key generation (the one I turn to myself, when my memory needs refreshing) is the one on Riseup: https://help.riseup.net/en/security/message-security/openpgp/best-practices https://help.riseup.net/en/security/message-security/openpgp... . If you follow that guide, you will get a keypair that avoids the common pitfalls. The photo question is an interesting one - some people frown on it, some people like it. Personally, I lean towards not adding them, just because the number of times I've actually checked it is so low (maybe once, ever.) That being said, I don't think people feel so strongly that they'd refuse to use or sign your key over it; they might just not sign that particular uid. (The photo is stored the same way an alternate email is, basically.) Properly setting up an offline subkey involves some rather archaic incantations; even more so when you are burning them into a smart card. Specifically, I would probably use some combination of the above instructions (to get my gpg.conf into the correct state), and then something like this guide: https://gist.github.com/abeluck/3383449 https://gist.github.com/abeluck/3383449 Specifically, I would look for a guide that instructs you to have a master key that is valid only for certification. I have a personal dislike for allowing your "master" key to be used for encryption, because it incentivizes you to do things that are not best-practice: specifically, using it. In the ideal world, your master key is kept, encrypted, on one (or more) USB drives that are all kept in various safes, and are never plugged into a computer that has an internet connection. Bonus points if the computer isn't used for anything else either. This is because your master key is the Thing That Must Not Be Compromised -- or you need to revoke the entire key and can never use it again. If a "working" subkey gets compromised, you can revoke it without losing all of the certification effort you've put into validating your identity in the web of trust.

acabal 11y ago

I wrote a short guide called "Creating the perfect GPG keypair" < https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/ > some time ago. I mainly wrote it for myself as a sort of step-by-step reminder on how to create an ideal key, but it seems others have found it useful. In particular it borrows from the Debian guide on creating subkeys for use on a laptop (or other device that has a high chance of being stolen/compromised). I don't consider myself an expert, and the guide is compiled from synthesizing several other guides. If anyone has tips on how to improve the guide, or spots any errors, please do let me know so I can update it.