3

I want to generate an ECC key where the primary key is just for cert and has 3 subkeys for auth, sign, encrypt.

I've found 2 methods to generate it. But I want to use unattended key generation via

gpg —-batch —generate-key

Work method

Interacitve mode

In contrast to --generate-key the key is generated directly without the need to answer a bunch of prompts. Unless the option --yes is given, the key creation will be canceled if the given user id already exists in the keyring. -- 4.1.3 How to manage your keys

The following command works in interactive mode

gpg2 --expert --full-gen-key

Key info

sec   ed25519/0x5842AA66BB63DA36 2019-07-18 [C] [expires: 2020-07-17]
      Key fingerprint = FF1F E580 F6D3 453E BA88  DD98 5842 AA66 BB63 DA36
uid                   [ultimate] Name_test (Testing) <email_test@xxx.com>
ssb   ed25519/0x4F33E67F4B554A73 2019-07-18 [S] [expires: 2020-07-17]
ssb   cv25519/0xDE2253D7DAD20F1A 2019-07-18 [E] [expires: 2020-07-17]
ssb   ed25519/0x46A28F2FCC84A822 2019-07-18 [A] [expires: 2020-07-17]

Quick mode

According to

The following command works in quick mode

gpg --batch --passphrase '1Qaz@wSx' --quick-gen-key "Name_test (Testing) <email_test@xxx.com>" ed25519 cert 1y
fpr=$(gpg --list-options show-only-fpr-mbox --list-secret-keys | sed -r -n '$!d;s@^([^[:space:]]+).*@\1@g;p')

gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr ed25519 sign 1y
gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr ed25519 auth 1y
gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr cv25519 encrypt 1y

Key info

sec   ed25519/0xE8C6CF665ACABDB6 2019-07-18 [C] [expires: 2020-07-17]
      Key fingerprint = 03A9 E9BD CF6A BF7F 62B4  BBDA E8C6 CF66 5ACA BDB6
uid                   [ultimate] Name_test (Testing) <email_test@xxx.com>
ssb   ed25519/0xBA77943ABAE5F238 2019-07-18 [S] [expires: 2020-07-17]
ssb   ed25519/0x7272CF7C764BDB9E 2019-07-18 [A] [expires: 2020-07-17]
ssb   cv25519/0xB42F8319BA8D0CBE 2019-07-18 [E] [expires: 2020-07-17]

Unattended generation ?

I read How to batch generate ECC key, the config inside works.

Config contents

%echo Generating a OpenPGP key
Key-Type: eddsa
Key-Curve: Ed25519
Key-Usage: cert
Subkey-Type: ecdh
Subkey-Curve: Curve25519
Subkey-Usage: encrypt
Subkey-Type: eddsa
Subkey-Curve: Ed25519
Subkey-Usage: sign,auth
Passphrase: 1Qaz@wsX
Name-Real: Name_test
Name-Email: email_test@xxx.com
Name-Comment: Unattended Testing
Expire-Date: 0
%commit
%echo done

I get the error message

duplicate keyword

If I set Subkey-Usage: sign,auth,encrypt, it displays the error

specified Subkey-Usage not allowed for algo 18

This is because cv25519 for encrypt, ed25519 for cert, sign, auth.

If I just set

Subkey-Type: ecdh
Subkey-Curve: Curve25519
Subkey-Usage: encrypt

it works.

If I set

Subkey-Type: eddsa
Subkey-Curve: ed25519
Subkey-Usage: sign, auth

it also works, but sign, auth are listed in the same subkey.

How should I change the config file to make is work?

4

In the section above "Unattended generation" you list "Config contents" to batch generate a master key and then provide details for TWO sub-keys.

When the facility for batch file processing was added to GnuPG, the batch generation of a master key with only ONE sub-key was provided.

https://www.gnupg.org/documentation/manuals/gnupg/Unattended-GPG-key-generation.html

          "Currently only one subkey can be handled."

This is why you are getting the error message "duplicate keyword".

In order to add multiple subkeys to a key via a script, there is no builtin script support and you should take a look at the solutions provided at

https://serverfault.com/questions/818289/add-second-sub-key-to-unattended-gpg-key

There is also a further difficulty concerning ed25519. Creating an ed25519 key or sub-key for "encryption" is only possible with GnuPG v2.1.7 and an ed25519 supporting version of libgcrypt.

https://www.gniibe.org/memo/software/gpg/keygen-25519.html

So unless you are using GnuPG v2.1.7 (with suitable libcrypt) trying to create an ed25519 key or subkey for encryption is going to fail with an error message.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.