Generating a GPG key with smartcard and SSH Authentication

Sun, 09/13/2020 - 19:46

This document will get you step by step through the generation of a GPG smartcard key, with the correct subkeys for use on a smartcard like the OpenPGP smartcard or a Yubikey. This will also allow you to use your GPG Authentication subkey for SSH support.

Generating a key

Generating the masterkey

With a smartcard key, you split your key into a master key (certify key) and individual subkeys (signing, encrypting, authentication). Often this is done on a airgapped machine.
First off, you generate the key using expert mode:

gpg --full-generate-key --expert

Choose option "RSA (set your own capabilities)", which is currently number 8 and toggle the sign (S) and encrypt (E) by selecting the option and confirming with enter.
The only option on this key should be Certify!
Then press Q followed by enter to finish.

For keysize, choose 4096 and confirm with enter.
For the expire date, choose 10y and confirm with enter. and yes.

Fill in your full name and email, leave the comment blank, confirm your choice and enter in your passphrase.
 

You should now have a masterkey, it should show the fingerprint on the screen. (example: 34B35DD172E366BF6867AB069FB800372F2546D8)

Creating your subkeys

Now we are going to add the capability to sign or decrypt messages and use the key for ssh authentication.

gpg --expert --edit-key <YOUR FINGERPRINT>

In this interface, you are going to generate some subkeys:
 

Signing key

addkey

Choose option "RSA (set your own capabilities)", which is currently number 8.
Toggle E (encryption) so the "Current allowed actions" only lists Sign and confirm with Q.
Choose the keysize 4096.
Choose the key expire date 3y.
Confirm twice, then enter your passphrase.

Encryption key

addkey

Choose option "RSA (set your own capabilities)", which is currently number 8.
Toggle S (Signing) so the "Current allowed actions" only lists Encrypt and confirm with Q.
Choose the keysize 4096.
Choose the key expire date 3y.
Confirm twice, then enter your passphrase.

Authentication key

addkey

Choose option "RSA (set your own capabilities)", which is currently number 8.
Toggle S (Signing), E (Encryption) and A (Authentication) so the "Current allowed actions" only lists Authenticate and confirm with Q.
Choose the keysize 4096.
Choose the key expire date 3y.
Confirm twice, then enter your passphrase.

Trusting the keys and finishing up

Type in the command:

trust

Choose 5, confirm. Type in:

save

And check if you have multiple subkeys like such:

$ gpg --list-key 015E51CA677A864C61F13D13149B9E17245535D8

pub   rsa4096 2020-03-26 [C] [expires: 2030-03-24]
      015E51CA677A864C61F13D13149B9E17245535D8
uid           [ultimate] Test testtt <testtt@techwolf12.nl>
sub   rsa4096 2020-03-26 [S] [expires: 2023-03-26]
sub   rsa4096 2020-03-26 [E] [expires: 2023-03-26]
sub   rsa4096 2020-03-26 [A] [expires: 2023-03-26]

It should show 3 subkeys with a letter S, E and A, as well as the master key with the letter C!

Backups

One of the most important things. Backup your key now since you have everything in one place!

gpg --output revoke.asc --gen-revoke <YOUR FINGERPRINT>
gpg --armor --output privkey.sec --export-secret-key <YOUR FINGERPRINT>
gpg --armor --output subkeys.sec --export-secret-subkeys <YOUR FINGERPRINT>
gpg --armor --output pubkey.asc --export <YOUR FINGERPRINT>

Save these files somewhere safe. You need access to them if you lose your token or need to edit the expiration date.
Share the pubkey.asc file with whoever you want to send you encrypted messages.

Initialising the smartcard

Insert your smartcard, and execute the following command:

gpg --card-edit

 

Do the following, between parenthesis are comments:

 

admin
passwd
(change admin pin, currently option 3, default is 12345678)
3
(change this to a random, new 8 numeric code)
(set the reset code, option 4, use your admin pin)
4
(change this to a random, new 8 numeric code)
1 
(change this to a random, new 6 numeric code. Default is 123456 This is the one you will use during signing or encryption)
q
name
(enter your (nick)name)
url
(enter the https location of your public key file)
quit

 

 

 

Pushing the subkeys to the smartcard

Execute the following:

gpg --expert --edit-key <YOUR FINGERPRINT>

Then here, do the following:

toggle
key 1
keytocard

Now take a look at the selected key after "key 1", it should be the one with "usage: S"
Select the storage slot "Signature key" (1)
Enter your passphrase for your gpg masterkey.
Enter the ADMIN PINCODE you got with the key from one of the admins.

Then run:

key 1
key 2
keytocard

This should be your encryption key with "usage: E"
Select the storage slot "Encryption key" (2)
Enter your passphrase for your gpg masterkey.
Enter the ADMIN PINCODE you got with the key from one of the admins.

 Then run:

key 2
key 3
keytocard

This should be your authentication key with "usage: A"
Select the storage slot "Authentication key" (3)
Enter your passphrase for your gpg masterkey.
Enter the ADMIN PINCODE you got with the key from one of the admins.

Finish with:

save

Testing the key

Test your key with the following, it should prompt for your pincode instead of passphrase and show a signed message:

echo "test" | gpg -a -u <your fingerprint> --sign

Using on another computer

This is very easy to do, insert your token and run. This will import your public key and connect it to the smartcard. This only works if your public key is already uploaded to the location of the URL field in your card.

gpg --card-edit
fetch
quit

Enabling SSH support

Add enable-ssh-support and write-env-file to ~/.gnupg/gpg-agent.conf

Restart GPG agent or reboot.

Check echo $SSH_AUTH_SOCK - it should be pointing to gpg-agent's socket instead of ssh-agent.

Check your authentication key fingerprint's last 16 characters by running:

$ gpg --fingerprint --fingerprint 015E51CA677A864C61F13D13149B9E17245535D8

pub   rsa4096 2020-03-26 [C] [expires: 2030-03-24]
      015E 51CA 677A 864C 61F1  3D13 149B 9E17 2455 35D8
uid           [ultimate] Test testtt <testtt@techwolf12.nl>
sub   rsa4096 2020-03-26 [S] [expires: 2023-03-26]
      0612 76E3 8F5B 2F4D 095F  95A0 286E 51F1 6D91 53EE
sub   rsa4096 2020-03-26 [E] [expires: 2023-03-26]
      D7C6 3D9E 78BE 0932 F844  42DA 60D9 8F16 D50B B177
sub   rsa4096 2020-03-26 [A] [expires: 2023-03-26]
      CD1F B5B8 78F2 A1DE B036  6D90 3BF1 9BEC 700E 4870

Look at the subkey here with "[A]", copy the 4 groups at the end, in this case: 3BF1 9BEC 700E 4870

Remove the spaces: 3BF19BEC700E4870 and run (keep the exclamation mark in mind!):

gpg -o gpg_ssh.pub --export-ssh-key 3BF19BEC700E4870!

You now have your ssh key in gpg_ssh.pub which you can use on servers like you normally would with SSH keys.