Sample Header Ad - 728x90

How to import secret key on OpenGPG smartcard (copied from one machine/OS to another)?

2 votes
1 answer
2288 views
I run a couple of PCs and they both multi-boot into more than one OS (Win10/Linux{Devuan}/FreeBSD & Win10/Linux{Devuan} respectively). I use Thunderbird + Enigmail (sticking with Version 68.x of the former for the moment as the integrated OpenGPG support coming in 78.x does not have SmartCard support working yet as I understand it). I have noted https://unix.stackexchange.com/q/184947/144991 but I am not sure it can work when the Secret key(s) are held in a Smart Card such as my OpenGPG (version 3.3) one. I am aware that an issue is that the secret keys themselves are normally supposed to be generated within the card's hardware and stored only on the card itself, with a fundamental part of the security being that they cannot be extracted **from** that card. I am also aware that the solution to this is to do the generation on an air-gapped PC, ideally running from a OS booted from Read-only material (CD/DVD) and to export and preserve in a **secure** manner the complete secret primary and separately the secret sub-keys and public keys. Then, on the first machine/OS one needs to reimport just the latter two of the those three and then use the keytocard feature to transfer the secret sub-keys to the card (it is a one-way trip!) which leaves special stubs in the secring.gpg that says "yes, we have these keys but they are stored on a card". Do I need to repeat the "importing the secret-sub-keys only and then use keytocard to generate the *secret-key-stubs* on each subsequent machine/OS" to get the secret key ring on each machine to have an awareness for that machine/OS that we have owner keys on a SmartCard; OR is there a short-cut method (perhaps copying the user's secring.gpg securely via sneakernet from the first machine/OS to the others) that should work?
Asked by SlySven (557 rep)
Oct 9, 2020, 07:39 PM
Last activity: Oct 9, 2020, 08:37 PM