I use the
pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different keypair (I use a separate key just for
Supposing I've exported the
pass keypair as
pass.sec.asc, my current thought is that I should be able to use my default (not-
pass) keypair to do the following:
gpg --encrypt --armor --encrypt-to 0xMYKEY < pass.sec.asc > encrypted.asc
encrypted.asc to a public location. Then, take my Yubikey to the new workstation, download
gpg --decrypt < encrypted.asc > pass.sec.asc gpg --import pass.sec.asc
and be able to access the passwords in my store.
- Would it be ill-advised to publish even an encrypted version of my key?
- Are there cryptographic dangers to encrypting a secret key?
- Is there a better way to bootstrap new password-store machines in a mostly-scripted way?