keys/employees-keys/README.md: major redesign of the procedure #101
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit consiste following changes: - added table of contents - added procedure of revocation certificate delivery to 3mdeb leader or manager - added procedure for uploading keys to keys.opengpg.org - simplified procedure of generating new keys through scripts/gen-new-employee-key.sh - improved procedure of key generation using RSA4096, not expiring Certify key and 1 year valid Signing and Encrypting subkeys - added procedure how to recover in case of key lost, compromised or employee no longer working in 3mdeb Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
pietrushnic
requested review from
macpijan,
miczyg1,
krystian-hebel and
TomaszAIR
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
macpijan
reviewed
Oct 12, 2023
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Tested on GnuPG 2.2.40.
Following is sample debug run for future reference of this script:
-----BEGIN
./scripts/gen-new-employee-key.sh "Your Name" "your.name@3mdeb.com"
+ '[' 2 -ne 2 ']'
+ KEY_NAME='Your Name'
+ KEY_EMAIL=your.name@3mdeb.com
+ KEY_COMMENT='Employee Cert Key'
+ KEY_FILE=your.name@3mdeb.com.asc
++ cat
+ BATCH_FILE_CONTENT='%echo Generating a primary certification key and subkeys for signing and encryption
Key-Type: RSA
Key-Length: 4096
Key-Usage: cert
Expire-Date: 0
Subkey-Type: RSA
Subkey-Length: 4096
Subkey-Usage: sign
Name-Real: Your Name
Name-Comment: Employee Cert Key
Name-Email: your.name@3mdeb.com
%no-protection
%commit
%echo Key generation complete'
+ echo '%echo Generating a primary certification key and subkeys for signing and encryption
Key-Type: RSA
Key-Length: 4096
Key-Usage: cert
Expire-Date: 0
Subkey-Type: RSA
Subkey-Length: 4096
Subkey-Usage: sign
Name-Real: Your Name
Name-Comment: Employee Cert Key
Name-Email: your.name@3mdeb.com
%no-protection
%commit
%echo Key generation complete'
+ gpg --list-keys --keyid-format LONG
+ awk '{print $2}'
+ grep pub
+ cut -d/ -f2
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 24 signed: 10 trust: 0-, 0q, 0n, 0m, 0f, 24u
gpg: depth: 1 valid: 10 signed: 1 trust: 10-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2023-10-28
+ gpg --batch --generate-key temp_batch_file.txt
gpg: Generating a primary certification key and subkeys for signing and encryption
gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/8A55685F330C97073856914BAA41746B115C35E3.rev'
gpg: Key generation complete
+ gpg --list-keys --keyid-format LONG
+ cut -d/ -f2
+ awk '{print $2}'
gpg: checking the trustdb
+ grep pub
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 25 signed: 10 trust: 0-, 0q, 0n, 0m, 0f, 25u
gpg: depth: 1 valid: 10 signed: 1 trust: 10-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2023-10-28
++ comm -13 keys_before.txt keys_after.txt
+ KEY_ID=AA41746B115C35E3
+ rm keys_before.txt keys_after.txt
+ gpg --fingerprint AA41746B115C35E3
+ echo 'Key with ID AA41746B115C35E3 generated successfully.'
Key with ID AA41746B115C35E3 generated successfully.
+ gpg --command-fd 0 --edit-key AA41746B115C35E3
gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
sec rsa4096/AA41746B115C35E3
created: 2023-10-13 expires: never usage: C
trust: ultimate validity: ultimate
ssb rsa4096/B642FA3402DD7BFA
created: 2023-10-13 expires: never usage: S
[ultimate] (1). Your Name (Employee Cert Key) <your.name@3mdeb.com>
sec rsa4096/AA41746B115C35E3
created: 2023-10-13 expires: never usage: C
trust: ultimate validity: ultimate
ssb* rsa4096/B642FA3402DD7BFA
created: 2023-10-13 expires: never usage: S
[ultimate] (1). Your Name (Employee Cert Key) <your.name@3mdeb.com>
Changing expiration time for a subkey.
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key expires at Sat 12 Oct 2024 01:00:35 PM CEST
sec rsa4096/AA41746B115C35E3
created: 2023-10-13 expires: never usage: C
trust: ultimate validity: ultimate
ssb* rsa4096/B642FA3402DD7BFA
created: 2023-10-13 expires: 2024-10-12 usage: S
[ultimate] (1). Your Name (Employee Cert Key) <your.name@3mdeb.com>
+ '[' 0 -ne 0 ']'
+ gpg --command-fd 0 --edit-key AA41746B115C35E3
gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 25 signed: 10 trust: 0-, 0q, 0n, 0m, 0f, 25u
gpg: depth: 1 valid: 10 signed: 1 trust: 10-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2023-10-28
sec rsa4096/AA41746B115C35E3
created: 2023-10-13 expires: never usage: C
trust: ultimate validity: ultimate
ssb rsa4096/B642FA3402DD7BFA
created: 2023-10-13 expires: 2024-10-12 usage: S
[ultimate] (1). Your Name (Employee Cert Key) <your.name@3mdeb.com>
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(14) Existing key from card
RSA keys may be between 1024 and 4096 bits long.
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key expires at Sat 12 Oct 2024 01:00:35 PM CEST
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec rsa4096/AA41746B115C35E3
created: 2023-10-13 expires: never usage: C
trust: ultimate validity: ultimate
ssb rsa4096/B642FA3402DD7BFA
created: 2023-10-13 expires: 2024-10-12 usage: S
ssb rsa4096/00F397DEEBCC7649
created: 2023-10-13 expires: 2024-10-12 usage: E
[ultimate] (1). Your Name (Employee Cert Key) <your.name@3mdeb.com>
+ '[' 0 -ne 0 ']'
+ gpg --armor --export 'Your Name (Employee Cert Key) <your.name@3mdeb.com>'
+ '[' 0 -ne 0 ']'
+ rm temp_batch_file.txt
+ echo 'Your KEY_ID: AA41746B115C35E3'
Your KEY_ID: AA41746B115C35E3
-----END
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
pietrushnic
force-pushed
the
add_proce_for_revocation
branch
from
65a290c
to
b15bfdd
Compare
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
pietrushnic
force-pushed
the
add_proce_for_revocation
branch
from
b15bfdd
to
282ec0a
Compare
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Krystian Hebel <krystian.hebel@3mdeb.com>
Co-authored-by: Krystian Hebel <krystian.hebel@3mdeb.com>
Co-authored-by: Krystian Hebel <krystian.hebel@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Co-authored-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
--search-keys is better than --import because it show preview key before making decision, so we can confirm that it is key that we need by comparing fingerprint as well as we can confirm if key is not expired. Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
This commit implements experimentally proved suggestion from review, which consist of using last known safe date as expiration date for revoked key. This lead that portals like Github show that key is both revoked and expired despite keeping green label of verified signature for git commits. Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
As it was pointed during review gpg has hidden command, which give ability to set arbitrary date up to seconds: https://stackoverflow.com/a/55061328 So it is incorrect to claim 1d is minimal gpg granularity. Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Not sure right know if fixing shellcheck error would not break this. Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
This is already included in the pre-commit checks Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Pre commit
Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
.pre-commit-config.yaml: disable shellcheck in pre-commit.ci
macpijan
approved these changes
Nov 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit consiste following changes: