Thursday, November 21, 2013

GPG Keys and Password Management


GPG has a good encryption algorithm, but terrible key management and no forward security.   If your private key is compromised, then all your old data can be read.  For most people, it is simply unworkable due to the key exchange problems.

I recommend that everyone switch to Signal and WhatsApp for secure messaging and phone calls and when you suspect that something is wrong - your system/keys were compromised, simply create a new account. 

For your passwords, I recommend that you use KeepassX to generate and save unique passwords for all your internet, financial and computer accounts - do not re-use passwords on different services.


For the real card carrying geek masochists out there, this document briefly explains how to set up GPG with public and private keys, publish your public key to a key server and then configure ‘pass’ the standard Unix password manager.

With 'pass', you can easily generate long passwords, save them using GPG encryption and easily retrieve a password to the clipboard, so that you can paste it into a login dialog.

The advantage of 'pass' over other password managers, is that it is super simple - a Bash script.  Passwords are saved in GPG files, so you can use standard utilities to manage, save and copy your passwords, without being beholden to a 3rd party application.

'Pass' is so simple, that you can run it on any kind of UNIX, including Linux and Apple Mac machines.   The database is encrypted, so it can be safely kept on Dropbox or other free FTP service.  However, it is clunky, so you need to love the command line to like this one!

Another popular alternative is KeepassX, which is compatible with Keepass on Windows. Likewise, you can save the database on Dropbox to make it available on all your devices.  It doesn't need any explanation, since it has a GUI. For those worried about Keepass, see this:

That still leaves the initial laptop computer full disk encryption and login passwords which you need before the password manager is running - write those on a piece of paper and keep it in your wallet!

gpg --gen-key

These options are good:
  • RSA and RSA
  • 2048
  • 3y
  • Herman Oosthuysen
  • Don’tForgetYourVeryLongPassPhrase (and save it in KeepassX)

[herman@f16 ~]$ gpg --gen-key
gpg (GnuPG) 1.4.12; Copyright (C) 2012 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
  (1) RSA and RSA (default)
  (2) DSA and Elgamal
  (3) DSA (sign only)
  (4) RSA (sign only)
Your selection?
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
        0 = key does not expire
     <n>  = key expires in n days
     <n>w = key expires in n weeks
     <n>m = key expires in n months
     <n>y = key expires in n years
Key is valid for? (0) 3y
Key expires at Sun 20 Nov 2016 09:27:47 AM GST
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
   "Heinrich Heine (Der Dichter) <>"

Real name: Herman Oosthuysen
Email address:
You selected this USER-ID:
   "Herman Oosthuysen <>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 90 more bytes)
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 6D79E9A8 marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2016-11-20
pub   2048R/6D79E9A8 2013-11-21 [expires: 2016-11-20]
     Key fingerprint = 8D3C C541 2E4B E39E 0C59  98AD 8427 2B59 6D79 E9A8
uid                  Herman Oosthuysen <>
sub   2048R/8FDD82DD 2013-11-21 [expires: 2016-11-20]


The agent is usually started on demand by gpg, gpgsm,  gpgconf  or  gpg-
      connect-agent.   Thus there is no reason to start it manually.  In case
      you want to use the included Secure Shell Agent you may start the agent
        gpg-connect-agent /bye

The usual way to run the agent is from the ~/.xsession file:
        eval $(gpg-agent --daemon)

$ gpg-agent --daemon
gpg-agent[1543]: a gpg-agent is already running - not starting a new one

Publish your Public key to a key server

First get the public key fingerprint:
$ gpg --fingerprint
pub   2048R/6D79E9A8 2013-11-21 [expires: 2016-11-20]
     Key fingerprint = 8D3C C541 2E4B E39E 0C59  98AD 8427 2B59 6D79 E9A8
uid                  Herman Oosthuysen <>
sub   2048R/8FDD82DD 2013-11-21 [expires: 2016-11-20]

Send the key to a public key server using the fingerprint from above:
$ gpg --keyserver hkp:// --send-key “8D3C C541 2E4B E39E 0C59  98AD 8427 2B59 6D79 E9A8

gpg: sending key 6D79E9A8 to hkp server

Backup your keys

Save the public key as a text file that you can freely give to other people:
$ gpg --export --armor > herman-publickey.txt

Display the public key for reference:
$ cat  herman-publickey.txt
Version: GnuPG v1.4.12 (GNU/Linux)


Save your private key in KeepassX, a USB stick or SD card that you always keep in a safe or in your wallet:
$ gpg --export-secret-keys --armor > herman-privatekey.txt

No, I’m not going to display that one...

I keep these files in my ~/.ssh directory and tighten up the permissions:
$ chmod 600 herman-p*

Configure pass

Install dependencies:
# yum install xclip
# yum install xz

Download pass from here:

Untar it:
$ tar -Jxvf pass[tab]

Install it:
# make install

List the keys in the gpg keyring:
$ gpg --list-keys
pub   2048R/6D79E9A8 2013-11-21 [expires: 2016-11-20]
uid                  Herman Oosthuysen <>
sub   2048R/8FDD82DD 2013-11-21 [expires: 2016-11-20]

Initialize the pass store:
$ pass init
mkdir: created directory `/home/herman/.password-store'
Password store initialized for

Using the password store

Save an existing password:
$ pass insert visa/joe.plumber

Retrieve the password to the clipboard:
$ pass -c visa/joe.plumber

Now you can paste the password with Ctrl-V.

Most handily, because Linux has two clip buffers, you can highlight the username above and use middle click to paste it into a dialogue box as well, without having to retype it. So, highlight middle click for the username and ctrl-v for the password.

Multi-line passwords

This feature is not useful, unless you make a little gpg script of your own to retrieve the rest of the data.

Further Examples

From the pass man page:
      Initialize password store
             zx2c4@laptop ~ $ pass init
             mkdir: created directory ‘/home/zx2c4/.password-store’
             Password store initialized for

      List existing passwords in store
             zx2c4@laptop ~ $ pass
             Password Store
             ├── Business
             │   ├──
             │   └──
             ├── Email
             │   ├──
             │   └──
             └── France
                 ├── bank
                 ├── freebox
                 └── mobilephone

             Alternatively, "pass ls".

      Show existing password
             zx2c4@laptop ~ $ pass Email/

      Copy existing password to clipboard
             zx2c4@laptop ~ $ pass -c Email/
             Copied Email/ to clipboard. Will clear in 45 seconds.

      Add password to store
             zx2c4@laptop ~ $ pass insert Business/cheese-whiz-factory
             Enter password for Business/cheese-whiz-factory: omg so much cheese what am i 
             gonna do

      Add multiline password to store
             zx2c4@laptop ~ $ pass insert -m Business/cheese-whiz-factory
             Enter contents of Business/cheese-whiz-factory and press Ctrl+D 

      when finished:
             Hey this is my

      Generate new password
             zx2c4@laptop ~ $ pass generate Email/ 15
             The generated password to Email/ is:

      Generate new alphanumeric password
             zx2c4@laptop ~ $ pass -n generate Email/ 12
             The generated password to Email/ is:

      Generate new password and copy it to the clipboard
             zx2c4@laptop ~ $ pass -c generate Email/ 19
             Copied Email/ to clipboard. Will clear in 45 seconds.

      Remove password from store
             zx2c4@laptop ~ $ pass remove Business/cheese-whiz-factory
             rm: remove regular file ‘/home/zx2c4/.password-store/Business/cheese- 
             whiz-factory.gpg’? y
             removed ‘/home/zx2c4/.password-store/Business/cheese-whiz-factory.gpg’

No comments:

Post a Comment

On topic comments are welcome. Junk will be deleted.