ixydo / gpg-smartcard-automation Goto Github PK
View Code? Open in Web Editor NEWTooling to make smartcard (e.g. yubikey) initialization easier
License: MIT License
Tooling to make smartcard (e.g. yubikey) initialization easier
License: MIT License
I thought you might be interested in ....
re your section:
_GPG only supports one card pointer per shadow/stub key
This is a GnuPG limitation that will be fixed by T2291. Unfortunately this didn't make it into the GnuPG-2.2. We work around this limitation by generating seaprate $GNUPGHOME folders for each smartcard being used. You then only import the main one you would use day to day on a given device, but if the need arises you're still able to switch to using the other smartcard by deleting your key shadows/stubs (hint: gpg --delete-secret-and-public-keys 0xKEY_ID), then re-importing the other shadows/stubs and registering them with the gpg --card-status command._
I'm using gpg 2.3.1 and your keyring can support multiple yubikeys per stub. If you don't SAVE after you have run keytocard to transfer your keys to your yubikey the private key is not deleted. This allows you to add a second yubikey and run keytocard again before finally entering SAVE to save the second yubikey and remove the full key leaving the stub.
You can then run a simple command to switch between the yubikeys
gpg-connect-agent "scd serialno" "learn --force" /bye
I added a script and the documented use on how to do this to drduh's yubikey guide
https://github.com/drduh/YubiKey-Guide/blob/master/switch-to-backup-yubikey
I've added a section to drduh's yubikey guide
Switching between two or more Yubikeys.
When you add a GPG key to a Yubikey using the keytocard command, GPG deletes the key form your keyring and adds a stub pointing to that exact Yubikey (the stub identifies the GPG KeyID and the Yubikey's serial number).
However, when you do this same operation for a second Yubikey, the stub in your keyring is overwritten by the keytocard operation and now the stub points to your second Yubikey. Adding more repeats this overwriting operation.
In other words, the stub will point ONLY to the LAST Yubikey written to.
When using GPG key operations with the GPG key you placed onto the Yubikeys, GPG will request a specific Yubikey asking that you insert a Yubikey with a given serial number (referenced by the stub). GPG will not recognise another Yubikey with a different serial number without manual intervention.
You can force GPG to scan the card and re-create the stubs to point to another Yubikey.
Having created two (or more Yubikeys) with the same GPG key (as described above) where the stubs are pointing to the second Yubikey:
Insert the first Yubikey (which has a different serial numnber) and run the following command:
$ gpg-connect-agent "scd serialno" "learn --force" /bye
GPG will then scan your first Yubikey for GPG keys and recreate the stubs to point to the GPG keyID and Yubikey Serial number of this first Yubikey.
To return to using the second Yubikey just repeat (insert other Yubikey and re-run command).
Obviously this command is not easy to remember so it is recommended to either create a script or a shell alias to make this more user friendly.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.