I wanna generate a ECC key which primary key is just for cert and has 3 subkeys for auth, sign, encrypt.

I've found 2 methods to generate it. But I wanna unattended key generation via

gpg —-batch —generate-key

Work method

Interacitve mode

In contrast to --generate-key the key is generated directly without the need to answer a bunch of prompts. Unless the option --yes is given, the key creation will be canceled if the given user id already exists in the keyring. -- 4.1.3 How to manage your keys

The following command works in interacitve mode

gpg2 --expert --full-gen-key

Key info

sec   ed25519/0x5842AA66BB63DA36 2019-07-18 [C] [expires: 2020-07-17]
      Key fingerprint = FF1F E580 F6D3 453E BA88  DD98 5842 AA66 BB63 DA36
uid                   [ultimate] Name_test (Testing) <email_test@xxx.com>
ssb   ed25519/0x4F33E67F4B554A73 2019-07-18 [S] [expires: 2020-07-17]
ssb   cv25519/0xDE2253D7DAD20F1A 2019-07-18 [E] [expires: 2020-07-17]
ssb   ed25519/0x46A28F2FCC84A822 2019-07-18 [A] [expires: 2020-07-17]

Quick mode

According to

The following command works in quick mode

gpg --batch --passphrase '1Qaz@wSx' --quick-gen-key "Name_test (Testing) <email_test@xxx.com>" ed25519 cert 1y
fpr=$(gpg --list-options show-only-fpr-mbox --list-secret-keys | sed -r -n '$!d;s@^([^[:space:]]+).*@\1@g;p')

gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr ed25519 sign 1y
gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr ed25519 auth 1y
gpg --batch --pinentry-mode=loopback --passphrase '1Qaz@wSx' --quick-add-key $fpr cv25519 encrypt 1y

Key info

sec   ed25519/0xE8C6CF665ACABDB6 2019-07-18 [C] [expires: 2020-07-17]
      Key fingerprint = 03A9 E9BD CF6A BF7F 62B4  BBDA E8C6 CF66 5ACA BDB6
uid                   [ultimate] Name_test (Testing) <email_test@xxx.com>
ssb   ed25519/0xBA77943ABAE5F238 2019-07-18 [S] [expires: 2020-07-17]
ssb   ed25519/0x7272CF7C764BDB9E 2019-07-18 [A] [expires: 2020-07-17]
ssb   cv25519/0xB42F8319BA8D0CBE 2019-07-18 [E] [expires: 2020-07-17]

Unattended generation ?

I read How to batch generate ECC key, the config inside works.

Config contents

%echo Generating a OpenPGP key
Key-Type: eddsa
Key-Curve: Ed25519
Key-Usage: cert
Subkey-Type: ecdh
Subkey-Curve: Curve25519
Subkey-Usage: encrypt
Subkey-Type: eddsa
Subkey-Curve: Ed25519
Subkey-Usage: sign,auth
Passphrase: 1Qaz@wsX
Name-Real: Name_test
Name-Email: email_test@xxx.com
Name-Comment: Unattended Testing
Expire-Date: 0
%echo done

It prompts error

duplicate keyword

If I set Subkey-Usage: sign,auth,encrypt, it prompts error

specified Subkey-Usage not allowed for algo 18

This is because cv25519 for encrypt, ed25519 for cert, sign, auth.

If I just set

Subkey-Type: ecdh
Subkey-Curve: Curve25519
Subkey-Usage: encrypt

it works.

If I set

Subkey-Type: eddsa
Subkey-Curve: ed25519
Subkey-Usage: sign, auth

it also works, but sign, auth are listed in the same subkey.

How should I change the config file to make is works. Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.