1

After researching about OpenPGP and smartcards, I came to a dilemma. The usual setup I've seen more widely is a master key (with SC capabilities) and 3 subkeys (with S, E, A each):

pub  4096R/0E427716  created: 2016-01-15  expires: never       usage: SC
                               trust: ultimate      validity: ultimate
sub  2048R/49C9CBD7  created: 2016-01-15  expires: 2016-10-12  usage: S
sub  2048R/A7D84FFD  created: 2016-01-15  expires: 2016-10-12  usage: E
sub  2048R/879F1ED3  created: 2016-01-15  expires: 2016-10-12  usage: A

I understand the concept of keeping the master key only for the purpose of signing and certifying subkeys. The problem comes when trying to write the keys to a smartcard which only have three keys/subkeys slots, as I want to write master key inside the card.

Is it going to work and still be safe adding authentication capability to the master key 0E427716 then writing it to the smartcard along with only two subkeys (one for signing 49C9CBD7 and one for encrypting A7D84FFD)?

For clarifying the final picture in the smartcard will be:

pub  4096R/0E427716  created: 2016-01-15  expires: never       usage: SCA
sub  2048R/49C9CBD7  created: 2016-01-15  expires: 2016-10-12  usage: S
sub  2048R/A7D84FFD  created: 2016-01-15  expires: 2016-10-12  usage: E

I'll keep three backup smartcards in safe places, so don't worry, no way to lose the master key.

1

I wouldn't go for it. This means additional exposure of the master key, and it might have been exposed in bugs like CVE-2016-0777 when used with SSH.

You can also not distinguish any more between using the primary key vs using a subkey.

If you're going to buy several cards anyway, and are keen on using a card for the primary key, buy another one (or set of cards) and put the primary key on a dedicated card (set). This will not only enable you to be sure about which key you're going to use (the primary key is not connected at all), but also remove the three-keys-limitation of OpenPGP smartcards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.