AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
blog

Table des matières

4 billet(s) pour septembre 2026

Notes HTTP Strict Transport Security - HSTS2026/09/18 11:04Jean-Baptiste
Notes GNU Linux GPU carte graphiques2026/09/08 15:49Jean-Baptiste
Notes GNU Linux graphique2026/09/08 15:42Jean-Baptiste
Notes urlencoding - passer des mots de passe en HTTPS2026/09/03 17:58Jean-Baptiste

GPG - recovering lost gpg public keys from your yubikey

Source : https://www.nicksherlock.com/2021/08/recovering-lost-gpg-public-keys-from-your-yubikey/ 

$ gpg --card-status                                                                        
Reader ...........: Nitrokey Nitrokey Pro (00000000000000000000BD62) 00 00
Application ID ...: D27600012401030400050000BD620000                                                     
Application type .: OpenPGP                                                                              
Version ..........: 3.4                                                                                  
Manufacturer .....: ZeitControl                                                                          
Serial number ....: 0000BD62                                                                             
Name of cardholder: [not set]                                                                            
Language prefs ...: de                                                                                   
Salutation .......:                                                                                                                                                                                               
URL of public key : [not set]                                                                                                                                                                                     
Login data .......: [not set]                                                                            
Signature PIN ....: forced                                                                                                                                                                                        
Key attributes ...: brainpoolP512r1 brainpoolP512r1 brainpoolP512r1                                      
Max. PIN lengths .: 64 64 64                                                                             
PIN retry counter : 3 0 3                                                                                                                                                                                         
Signature counter : 0                                                                                    
KDF setting ......: off                                                                                  
Signature key ....: 5A79 88CB 3667 6795 A817  0DB7 CBBD AA0F 4B7C 7DD7                                                                                                                                            
      created ....: 2023-02-26 14:04:38             
Encryption key....: 8695 C0E7 6ABC 2FFF F7CC  7D71 F8CE 04C4 D381 8C66                                   
      created ....: 2023-02-26 14:07:32                                                                  
Authentication key: 1D9D 57AF C804 3C8E 1AA8  82ED 7571 DCC2 1DE7 4064                                   
      created ....: 2023-02-26 14:09:20                                                                  
General key info..: [none]

Les champs qui nous intéressent : 

Signature key ....: 5A79 88CB 3667 6795 A817  0DB7 CBBD AA0F 4B7C 7DD7                                                                                                                                            
      created ....: 2023-02-26 14:04:38             
Encryption key....: 8695 C0E7 6ABC 2FFF F7CC  7D71 F8CE 04C4 D381 8C66                                   
      created ....: 2023-02-26 14:07:32                                                                  
Authentication key: 1D9D 57AF C804 3C8E 1AA8  82ED 7571 DCC2 1DE7 4064                                   
      created ....: 2023-02-26 14:09:20

2023-02-26 14:04:38 va devenir 20230226T140438!

Création de la clef primaire (sign)

$ gpg --faked-system-time "20230226T140438!" --expert --full-generate-key
gpg: WARNING: running with faked system time: 2023-02-26 14:04:38
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
   (9) ECC and ECC
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (13) Existing key
  (14) Existing key from card
Your selection? 14
Serial number of the card: D27600012401030400050000BD620000
Available keys:
   (1) 3F5417680639FCEF05C54803B408B83BA496E964 OPENPGP.1 brainpoolP512r1 (cert,sign)
   (2) DC81057888D07B12268226B9F136013C4D32566D OPENPGP.2 brainpoolP512r1 (encr)
   (3) F66AA9329AEA6F09D69DD852BF8233DE68119AF5 OPENPGP.3 brainpoolP512r1 (sign,auth)
Your selection? 1

Possible actions for a ECDSA/EdDSA key: Sign Certify  
Current allowed actions: Sign Certify 

   (S) Toggle the sign capability
   (Q) Finished

Your selection? q
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 26 Feb 2024 03:04:38 PM CET
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Bob MARLEY
Email address: bmarley@acme.fr
Comment: 
You selected this USER-ID:
    "Bob MARLEY <bmarley@acme.fr>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
gpg: directory '/home/jibe/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/home/jibe/.gnupg/openpgp-revocs.d/5A7988CB36676795A8170DB7CBBDAA0F4B7C7DD7.rev'
public and secret key created and signed.

pub   brainpoolP512r1 2023-02-26 [SC] [expires: 2024-02-26]
      5A79 88CB 3667 6795 A817  0DB7 CBBD AA0F 4B7C 7DD7
uid                      Bob MARLEY <bmarley@acme.fr>

Création des clefs secondaires

La seconde clef 

$ gpg --faked-system-time "20230226T140732!" --expert --edit-key bmarley
gpg: WARNING: running with faked system time: 2023-02-26 14:07:32
Secret key is available.

gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2024-02-26
sec  brainpoolP512r1/CBBDAA0F4B7C7DD7
     created: 2023-02-26  expires: 2024-02-26  usage: SC  
     card-no: 0005 0000BD62
     trust: ultimate      validity: ultimate
[ultimate] (1). Bob MARLEY <bmarley@acme.fr>
     
gpg> addkey 
Secret parts of primary key are stored on-card.
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
  (14) Existing key from card
Your selection? 14
Serial number of the card: D27600012401030400050000BD620000
Available keys:
   (1) 3F5417680639FCEF05C54803B408B83BA496E964 OPENPGP.1 brainpoolP512r1 (cert,sign)
   (2) DC81057888D07B12268226B9F136013C4D32566D OPENPGP.2 brainpoolP512r1 (encr)
   (3) F66AA9329AEA6F09D69DD852BF8233DE68119AF5 OPENPGP.3 brainpoolP512r1 (sign,auth)
Your selection? 2

Possible actions for a ECDH key: Encrypt 
Current allowed actions: Encrypt

   (E) Toggle the encrypt capability
   (Q) Finished

Your selection? q
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 26 Feb 2024 03:07:32 PM CET
Is this correct? (y/N) y
Really create? (y/N) y

sec  brainpoolP512r1/CBBDAA0F4B7C7DD7
     created: 2023-02-26  expires: 2024-02-26  usage: SC  
     card-no: 0005 0000BD62
     trust: ultimate      validity: ultimate
ssb  brainpoolP512r1/F8CE04C4D3818C66
     created: 2023-02-26  expires: 2024-02-26  usage: E   
     card-no: 0005 0000BD62
[ultimate] (1). Bob MARLEY <bmarley@acme.fr>

gpg> quit
Save changes? (y/N) y

La troisieme clef 

$ gpg --faked-system-time "20230226T140920!" --expert --edit-key bmarley                  
gpg: WARNING: running with faked system time: 2023-02-26 14:09:20
Secret key is available.

sec  brainpoolP512r1/CBBDAA0F4B7C7DD7
     created: 2023-02-26  expires: 2024-02-26  usage: SC  
     card-no: 0005 0000BD62
     trust: ultimate      validity: ultimate
ssb  brainpoolP512r1/F8CE04C4D3818C66
     created: 2023-02-26  expires: 2024-02-26  usage: E   
     card-no: 0005 0000BD62
[ultimate] (1). Bob MARLEY <bmarley@belaris.fr>
    
gpg> addkey 
Secret parts of primary key are stored on-card.
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
  (14) Existing key from card
Your selection? 14
Serial number of the card: D27600012401030400050000BD620000
Available keys:
   (1) 3F5417680639FCEF05C54803B408B83BA496E964 OPENPGP.1 brainpoolP512r1 (cert,sign)
   (2) DC81057888D07B12268226B9F136013C4D32566D OPENPGP.2 brainpoolP512r1 (encr)
   (3) F66AA9329AEA6F09D69DD852BF8233DE68119AF5 OPENPGP.3 brainpoolP512r1 (sign,auth)
Your selection? 3

Possible actions for a ECDSA/EdDSA key: Sign Authenticate 
Current allowed actions: Sign Authenticate 

   (S) Toggle the sign capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a ECDSA/EdDSA key: Sign Authenticate 
Current allowed actions: Authenticate 

   (S) Toggle the sign capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Mon 26 Feb 2024 03:09:20 PM CET
Is this correct? (y/N) y
Really create? (y/N) y

sec  brainpoolP512r1/CBBDAA0F4B7C7DD7
     created: 2023-02-26  expires: 2024-02-26  usage: SC  
     card-no: 0005 0000BD62
     trust: ultimate      validity: ultimate
ssb  brainpoolP512r1/F8CE04C4D3818C66
     created: 2023-02-26  expires: 2024-02-26  usage: E   
     card-no: 0005 0000BD62
ssb  brainpoolP512r1/7571DCC21DE74064
     created: 2023-02-26  expires: 2024-02-26  usage: A   
     card-no: 0005 0000BD62
[ultimate] (1). Bob MARLEY <bmarley@belaris.fr>

gpg> quit
Save changes? (y/N) y
2025/03/24 15:06

GPG - Publier sa clef sur un serveur

Voir aussi :

Serveur de clefs / keyservers SKS WKD - hkp / hkps:

Voir :

Remplacer SKS par WKD :

Serveur de clefs

gpg --refresh-keys
gpg --keyserver key_server --refresh-keys
gpg --keyserver pgp.mit.edu  --search-key

Publier

https://wiki.debian.org/fr/Subkeys 

# gpg --send-keys --keyserver keyring.debian.org KeyID
# gpg --send-keys --keyserver subkeys.pgp.net KeyID
 
gpg --keyserver keyserver.ubuntu.com --send-key KeyID
#gpg --keyserver hkps://keys.openpgp.org --send-key KeyID
gpg --export KeyID | curl -T - https://keys.openpgp.org

Voir : https://keys.openpgp.org/about

Publier une clef que vous signé FIXME A vérifier 

tsocks gpg --send-keys 5AA19646

Tor

Rafraîchissez vos clés l’une après l’autre. Parcimonie est un démon qui rafraîchit lentement votre trousseau de clés à partir d’un serveur de clés en passant par Tor. Il utilise un délai aléatoire 

sudo apt-get install parcimonie

Penser à mettre à jour les clefs GPG via Tor grâce à parcimonie

http://genma.free.fr/?Mise-a-jour-des-clefs-GPG-via-Tor

You should not use gpg --refresh-keys or the refresh keys menu item on your email client because you disclose to anyone listening, and the keyserver operator, the whole set of keys that you are interested in refreshing.

2025/03/24 15:06

GPG - Plan

GPG - Config

GPG - Générer une paire de clefs

GPG - Utilisation basique - exemples

GPG - Limites et réserves à avoir

GPG - Chiffrement symétrique

GPG - Signer une clef - Key signing party

GPG - Publier sa clef sur un serveur

GPG - Toile de confiance - Web of Trust

GPG - Carte à puce YubiKey NitroKey

GPG - Renouvellement de clefs

PGP ou GPG ?

PGP can refer to two things:

  • The Pretty Good Privacy software originally written by Phil Zimmermann, and now owned by Symantec.
  • The formats for keys, encrypted messages and message signatures defined by that software. These have now been formalised as the OpenPGP standard.

The GNU Privacy Guard (GPG) software is an independent implementation of the OpenPGP standards, so you can use it to exchange encrypted messages with people using other OpenPGP implementations (e.g. Symantec's PGP).

Due to its popularity on Linux systems, it is also fairly common for people to incorrectly use the term “GPG” to refer to the whole OpenPGP cryptography system (e.g. “GPG keys” or “GPG signatures”). It is usually pretty clear what they mean from the context though.

Source : https://askubuntu.com/a/186814

2025/03/24 15:06
,

GPG - limites et réserves à avoir

Alternatives

Alternative pour signer :

Une implémentation moderne de PGP

Limites et problème de GPG

Voir aussi :

Problème Solution
Surreptitious forwarding attack Une clef pour signer différente de la clef pour chiffrer
(p) Utiliser les clefs en local sans jamais passer par des serveurs de clefs PGP Certificate Flooding attacks)
Perte d'anonymat dans l'échange de clefs Utiliser tor/i2p ou échange de clefs en local
Complexe a utiliser (p) Fournir une documentation ou un outil clef en main
Code complexe et donc surface d'attaque trop large -
No forward secrecy (p) Changer régulièrement les clefs/sous-clefs
Metadata - Destinataire du message Utiliser l'option --hidden-recipient ou --throw-keyids. Ne pas publier cette clef publique
Metadata - Version clef et autre Changer la conf par défaut
AFAIL Attack Ne pas mettre sa clef privée dans un client mail ou alors désactiver HTML

(p) : Solution partielle

Voir https://www.bortzmeyer.org/gpg-option-no-keyid.html

2025/03/24 15:06

GPG - Générer une paire de clefs

Voir : https://docs.nitrokey.com/fr/pro/openpgp-keygen-backup.html

Création des clefs

apt-get install rng-tools

Voir : https://github.com/drduh/YubiKey-Guide - OneRNG Voir aussi clrngd

/etc/default/rng-tools 

HRNGDEVICE=/dev/urandom

Trouver une autre solution Voir https://lwn.net/Articles/525459/ 

service rng-tools restart
gpg2 --expert --gen-key
gpg2 --expert --edit-key 86E4065450014


addkey
save
change-usage
save

OU 

cat >key-input <<EOF
%echo Generating a standard key
Key-Type: RSA
Key-Length: 4096
Name-Real: ${USER}
Name-Email: ${USER}@${HOSTNAME}
Expire-Date: 0
%commit
%echo Finished creating standard key
EOF
 
gpg2 --batch --gen-key key-input

Sauvegarde

Exporter sa clef

Voir :

Voir aussi :

  • Paperkey

Clef publique 

gpg -a --export 0x50D12DE07663C664 > ~/.gnupg/jean@acme.fr.pub.asc

Clef privée 

gpg -a --export-secret-keys 0x50D12DE07663C664 > ~/.gnupg/jean@acme.fr.sec.asc

Uniquement les sous-clefs privées 

gpg -a --export-secret-subkeys 0x50D12DE07663C664 > ~/.gnupg/jean@acme.fr.sub.sec.asc

Exporter uniquement une sous-clef spécifique 

gpg -a --export-secret-subkeys [subkey id]! > /tmp/subkey.gpg

Warning: If you forget to add the !, all of your subkeys will be exported.

2025/03/24 15:06

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : de 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki