Create Backup Yubikey With Identical PGP Keys


Answer :

found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup card, not the worst case to run an "init" to make it work.



https://forum.yubico.com/viewtopic38a1.html?f=35&t=2400




Running



gpg-connect-agent "scd serialno" "learn --force" /bye



will update the secret key stubs for the PGP keys on the currently
inserted key. So running that after key insertion will cause gpg to
use the currently inserted key.




After a lot trial and error, I finally found a way to achieve this. Here is an answer to my own question in case it helps someone :



The trick was to not try to export the same subkeys to the two Yubikeys (gpg doesn't like that) but to generate different subkeys. In my keyring I have 6 subkeys : 3 for the main Yubikey (Sign, Encrypt, Auth) and 3 for the backup Yubikey. I exported the corresponding private keys to the Yubikeys, which this time didn't need the hack to restore a backup of .gnupg. Finally, I encrypt my files using both public keys, so I can decrypt them with either Yubikeys :



gpg -e -r [keyid1]! -r [keyid2]! [file]


Don't forget the exclamation mark at the end of each key id. Otherwise, for some reason, gpg will understand that for each recipient you want "some key in the same keyring" and will select the same key twice by default.



Now gpg will accept either private key to decrypt the file. In case of Yubikeys, it will ask you to plug the first one, and if you cancel, it will ask for the second one, so you can use either one. I specified the main key in the first -r so gpg directly ask for the main Yubikey and won't bother me with the backup one. To make things simpler, I aliased the whole gpg command with both keyids to yk_encrypt.



Instead of backing up an entire directory you can export (create a backup copy of) the key using e.g.



gpg -a -o seckey.asc --export-secret-key ABCD1234


and import it again (after moving to first card) with



gpg --import seckey.asc


GPG is asking for the specific card because after it moves the key to the card it stores a key stub on your system, which ties that key to that card. If you delete the key from gpg (e.g. gpg --delete-secret-and-public-key ABCD1234) and the reference (One of potentially many in e.g.



C:\users\someUser\AppData\Roaming\gnupg\private-keys-v1.d or



/home/someUser/.gnupg/private-keys-v1.d



) then you can insert the backup Yubikey and



gpg --card-status


to create a stub referencing that key on the second Yubikey instead of the first.



You could also just keep the exported key secure and use that as your backup, but that wasn't the question asked.



Comments

Post a Comment

Popular posts from this blog

Converting A String To Int In Groovy

Answer : Use the toInteger() method to convert a String to an Integer , e.g. int value = "99".toInteger() An alternative, which avoids using a deprecated method (see below) is int value = "66" as Integer If you need to check whether the String can be converted before performing the conversion, use String number = "66" if (number.isInteger()) { int value = number as Integer } Deprecation Update In recent versions of Groovy one of the toInteger() methods has been deprecated. The following is taken from org.codehaus.groovy.runtime.StringGroovyMethods in Groovy 2.4.4 /** * Parse a CharSequence into an Integer * * @param self a CharSequence * @return an Integer * @since 1.8.2 */ public static Integer toInteger(CharSequence self) { return Integer.valueOf(self.toString().trim()); } /** * @deprecated Use the CharSequence version * @see #toInteger(CharSequence) */ @Deprecated public static Integer toInteger(String self) { return toInteg
Read more

"Cannot Create Cache Directory /home//.composer/cache/repo/https---packagist.org/, Or Directory Is Not Writable. Proceeding Without Cache"

Answer : if anyone pass through here, this is shorter solution: sudo chown -R $USER $HOME/.composer it seems to me the group information is missing in your command sudo chown -R <user> /home/<user>/.composer/cache/repo/https---packagist.org Shoud be sudo chown -R <user>:<group> /home/<user>/.composer/cache/repo/https---packagist.org But to avoid other permission issues, I would rather advise: sudo chown -R <user>:<group> /home/<user>/.composer/cache (you'll need access to other folders in there) and sudo chown <user>:<group> /home/<user>/.composer To make sure your user has permissions enough on the global composer folder. Mind the missing recursion so the user don't own keys created by root. If you need to find out the group: groups <user>
Read more

Android How Can I Convert A String To A Editable

Answer : As you probably found out, Editable is an interface so you cannot call new Editable() . However an Editable is nothing more than a String with Spannables, so use SpannableStringBuilder: Editable editable = new SpannableStringBuilder("Pass a string here"); If you only want to change the Spannables, never the text itself, you can use a basic SpannableString. Use Editable.Factory.getInstance().newEditable(str) From the android documentation: Returns a new SpannedStringBuilder from the specified CharSequence. You can override this to provide a different kind of Spanned.
Read more