I've read quite a few different articles on how to setup PGP keys with an offline master key. I own multiple YubiKey NEO hardware smart cards which I intend on using for PGP and as an SSH key. One of the hardware keys will be my daily driver, the others kept in secure locations elsewhere in case of a loss of the key. The master key, as recommended elsewhere will exist offline in a secure location, as I'll only need to access it when I need to revoke subkeys.
I see that there are three types of keys that I'll need to maintain:
- Offline master key.
- Only one.
- Responsible for signing and revoking subkeys.
- Exists completely offline in a secure location.
- Shared encryption key.
- Only one.
- Responsible for encryption and decryption.
- Exists simultaneously on all hardware smart cards and offline in a secure location.
- Shared authentication key.
- Only one.
- Responsible for SSH authentication.
- Exists simultaneously on all hardware smart cards and offline in a secure location.
- Signing keys.
- One per hardware smartcard.
- Responsible for signing things.
- Only exists on a single hardware smartcard, no need for an offline backup.
Is this the general idea behind having subkeys? As I'll primarily be using my smart cards for SSH authentication first, and PGP encryption/decryption second, does this setup make sense?
I've not heard of people using a shared encryption key, is this possible? For each card, I suppose I'd do something where I'd do gpg --card-edit
and import the encryption/decryption keypair and then generate and import the new signing keypair, signing it with the offline master key. Is there a guide on how to do this somewhere?
I'm new to subkeys and I'm still trying to learn the ropes of what's possible and what would be "best" for security.