8 == Generate GPG signing key pair
10 The guide will explain how to generate a new key pair, how to create a
11 signing sub key and how to strip the secret master key to avoid leaking
12 your primary secret key identity in case your signing key (or the entire
13 +~/.gnupg/+) ever gets lost.
16 === 1) Generate new, fresh key pair on a secure machine
20 $ chmod 0700 /tmp/signing
21 $ gpg --homedir /tmp/signing --gen-key
22 gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
23 This is free software: you are free to change and redistribute it.
24 There is NO WARRANTY, to the extent permitted by law.
26 gpg: keyring `/tmp/signing/secring.gpg' created
27 gpg: keyring `/tmp/signing/pubring.gpg' created
30 TIP: Pick 4 to generate an RSA-only key and choose a key size of 4096 bits.
31 For this how-to I choose to set no expiry at all.
34 Please select what kind of key you want:
35 (1) RSA and RSA (default)
40 RSA keys may be between 1024 and 4096 bits long.
41 What keysize do you want? (2048) 4096
42 Requested keysize is 4096 bits
43 Please specify how long the key should be valid.
44 0 = key does not expire
45 <n> = key expires in n days
46 <n>w = key expires in n weeks
47 <n>m = key expires in n months
48 <n>y = key expires in n years
50 Key does not expire at all
51 Is this correct? (y/N) y
54 TIP: GPG will ask about your user identity now, provide your real name and
55 the mail address you intend to use for your project communication.
56 I also suggest to provide a meaningful comment, eg. "LEDE Signing Key"
60 You need a user ID to identify your key; the software constructs the user ID
61 from the Real Name, Comment and Email Address in this form:
62 "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
64 Real name: Jo-Philipp Wich
65 Email address: jo@mein.io
66 Comment: LEDE Signing Key
67 You selected this USER-ID:
68 "Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>"
70 Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
71 You need a Passphrase to protect your secret key.
74 TIP: At this point enter a good pass phrase twice to protect your secret
75 key, the command will take a while to gather entropy and complete key
76 until it'll eventually print the key summary:
79 gpg: /tmp/signing/trustdb.gpg: trustdb created
80 gpg: key 612A0E98 marked as ultimately trusted
81 public and secret key created and signed.
83 gpg: checking the trustdb
84 gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
85 gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
86 pub 4096R/612A0E98 2016-04-05
87 Key fingerprint = 69B2 6A27 62D0 65E6 6F59 6755 C76F DE50 612A 0E98
88 uid Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>
90 Note that this key cannot be used for encryption. You may want to use
91 the command "--edit-key" to generate a subkey for this purpose.
94 === 2) Generate a sub key
97 $ gpg --homedir /tmp/signing --edit-key jo@mein.io
98 gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
99 This is free software: you are free to change and redistribute it.
100 There is NO WARRANTY, to the extent permitted by law.
102 Secret key is available.
104 pub 4096R/612A0E98 created: 2016-04-05 expires: never usage: SC
105 trust: ultimate validity: ultimate
106 [ultimate] (1). Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>
109 TIP: In the now appearing interactive gpg prompt enter "addkey" to create
110 a new signing subkey. GnuPG will ask your to unlock the master key using
111 the passphrase you've given in the previous step.
117 You need a passphrase to unlock the secret key for
118 user: "Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>"
119 4096-bit RSA key, ID 612A0E98, created 2016-04-05
121 Please select what kind of key you want:
124 (5) Elgamal (encrypt only)
125 (6) RSA (encrypt only)
128 TIP: We'll use a signing-only 4096bit RSA key with an validity of two years
132 RSA keys may be between 1024 and 4096 bits long.
133 What keysize do you want? (2048) 4096
134 Requested keysize is 4096 bits
135 Please specify how long the key should be valid.
136 0 = key does not expire
137 <n> = key expires in n days
138 <n>w = key expires in n weeks
139 <n>m = key expires in n months
140 <n>y = key expires in n years
141 Key is valid for? (0) 730
142 Key expires at Thu Apr 5 18:19:42 2018 CEST
143 Is this correct? (y/N) y
144 Really create? (y/N) y
147 TIP: At this point, GnuPG will start gathering entropy again, running an
148 "find /" in the background is a good way to speed it up. When done it
149 will print the sub key summary and return to the prompt. Note the ID
150 "1584F206" of the subkey, we'll need that in step 4.
153 pub 4096R/612A0E98 created: 2016-04-05 expires: never usage: SC
154 trust: ultimate validity: ultimate
155 sub 4096R/1584F206 created: 2016-04-05 expires: 2018-04-05 usage: S
156 [ultimate] (1). Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>
159 TIP: Enter "save" to commit the new key pair and its sub key to disk, the
160 GnuPG will automatically exit to the shell.
166 === 3) Put the key into a vault
168 At this point it is a good idea to make a *reliable and secure* backup
169 of the +/tmp/signing/+ directory, I suggest burning it onto a CDROM or
170 copying it onto a thumb drive which you can safely lock away or hide in
173 === 4) Export the private sub key only
175 We'll now export just the secret sub key since that is all we'll ever
176 need to sign files. Use the sub key ID from step 2 followed by an
177 exclamation mark to select the sub key to export:
180 $ gpg --homedir /tmp/signing --export-secret-subkeys 1584F206! \
181 > /tmp/secret-signing-key.pgp
182 $ file /tmp/secret-signing-key.pgp
183 secret-signing-key.pgp: PGP\011Secret Key - 1024b created on Tue Apr 5
184 16:08:15 2016 - RSA (Encrypt or Sign)
187 === 5) Import the secret signing sub key into your actual key store
189 You can now import the secret signing sub key on any machine you'll use
190 for signing files in the future. To import the sub key file, pass it to
191 +gpg --import+ and leave out the alternative homedir argument:
194 $ gpg --import /tmp/secret-signing-key.pgp
195 gpg: key 612A0E98: secret key imported
196 gpg: key 612A0E98: public key "Jo-Philipp Wich (LEDE Signing Key)
197 <jo@mein.io>" imported
198 gpg: Total number processed: 1
199 gpg: imported: 1 (RSA: 1)
200 gpg: secret keys read: 1
201 gpg: secret keys imported: 1
204 TIP: You can now issue a "gpg -K" to list all secret keys in your key store,
205 you should see the key you've imported with a leading "sec#". The hash
206 mark here indicates that the secret master key is missing, which is what
211 /home/jow/.gnupg/secring.gpg
212 ---------------------------
214 sec# 4096R/612A0E98 2016-04-05
215 uid Jo-Philipp Wich (LEDE Signing Key) <jo@mein.io>
216 ssb 4096R/1584F206 2016-04-05
219 TIP: It is time to upload your public key part to a key server now so that
220 others can easily fetch it by its fingerprint or your chosen mail
221 address later on. For uploading use the primary key ID printed after
222 the "sec#" word in the previous command.
225 $ gpg --keyserver hkp://pool.sks-keyservers.net --send-keys 612A0E98
226 gpg: sending key 612A0E98 to hkp server pool.sks-keyservers.net
229 === 6) Delete original
231 Make sure once again that your backup of the +/tmp/signing+ directory is
232 complete and readable, then remove the secret sub key file and the
233 entire temporary signing directory:
236 $ rm -r /tmp/signing/
237 $ rm /tmp/secret-signing-key.pgp
240 TIP: You're now done setting up a suitable signing key pair.
244 To export your public key in ASCII format use the following command,
245 again with the primary ID you've already used for uploading the pubkey.
247 Make sure to provide a meaningful comment so that people looking at the
248 key file know who it belongs to without having to inspect it using GPG
252 $ gpg --armor --export --no-version \
253 --comment="Public key of Jo-Philipp Wich" 612A0E98
256 In order to sign a file with your signing sub key, use the command below:
259 $ gpg --no-version -a -b -u 612A0E98 \
260 --comment="My signature for something" -o output.sig input.file
263 TIP: Use your key ID as filename when adding your public signing key to the
268 $ gpg --armor --export --no-version \
269 --comment="Public key of Me Myself" 612A0E98 > 612A0E98.asc
270 $ git add 612A0E98.asc
271 $ git commit -sm "Add my public key"
272 $ git push origin master
275 == Generate _usign_ key pair
277 In order to generate an _usign_ key pair for use in LEDE release and package
278 repositories, follow the steps below.
280 === 1) Obtain _usign_
282 Clone the _usign_ repository and compile it. Note that the compilation requires
283 an installed +cmake+ to succeed.
286 $ git clone https://git.openwrt.org/project/usign.git
292 TIP: Run +./usign+ to check that the binary works.
296 Usage: ./usign <command> <options>
298 -V: verify (needs at least -m and -p|-P)
299 -S: sign (needs at least -m and -s)
300 -F: print key fingerprint of public/secret key or signature
301 -G: generate a new keypair
303 -c <comment>: add comment to keys
304 -m <file>: message file
305 -p <file>: public key file (verify/fingerprint only)
306 -P <path>: public key directory (verify only)
307 -q: quiet (do not print verification result, use return code only)
308 -s <file>: secret key file (sign/fingerprint only)
309 -x <file>: signature file (defaults to <message file>.sig)
312 === 2) Generate key pair
314 Instruct the +usign+ executable to generate a new key pair and provide a
315 suitable comment to be able to identify the key file later on.
318 ./usign -G -c "LEDE usign key of Jo-Philipp Wich" \
319 -s secret.key -p public.key
322 TIP: Store the +secret.key+ file in a *secure and reliable* location, you'll
323 need it to sign package repositories in the future.
325 === 3) Add public key to the repository
327 Obtain the fingerprint of your public key with the +usign -F+ command and use
328 it as filename for storing the pubkey in the +keyring.git+ repository:
331 $ ./usign -F -p public.key
335 TIP: Add the key to Git, using the fingerprint as filename:
339 $ cp /some/where/public.key 72a57f2191b211e0
340 $ git add 72a57f2191b211e0
341 $ git commit -sm "Add my public usign key"
342 $ git push origin master