4
$\begingroup$

After having purchased a USB GnuPG smartcard, I visited the manufacturer's website. A tutorial by the FSFE was mentioned there as the preferred way of setting up the smartcard.

However, this tutorial seems to be a bit outdated as the output of gpg --gen-key doesn't offer the option to create a "RSA + RSA"-keypair:

Please select what kind of key you want:
  (1) DSA and Elgamal (default)
  (2) DSA (sign only)
  (5) RSA (sign only)

The author chooses the first option and continues by generating two RSA subkeys of the DSA key. These two subkeys (one for signing, the second for encrypting) are then transferred to the smartcard. The Elgamal key is deleted, unused.

So my questions here – as an owner of a keypair consisting of two RSA keys, default in GnuPG for quite a long time – are: Do I really need to generate new subkeys for the smartcard? Or is this measure included in the tutorial for historical reasons (as smartcards seem to only support storing RSA keys)?

I don't know if, from the security point of view, there are reasons against putting your "master" key on a smartcard. But even if, wouldn't it be enough to generate one second subkey for signing instead of two new subkeys?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ IIRC only cards supporting the v3 spec can do ECC and no (known) card supports ElGamal. TL;DR: If you really want to, push your existing keys to the card, but security-wise it's much better to have them exist only in the card. And the external master key makes sense so you don't loose this entire (trusted / signed) set of keys when you mess up your card. $\endgroup$
    – SEJPM
    Commented Jan 23, 2017 at 22:46
  • $\begingroup$ @SEJPM Ok, I understand the problem with putting the master key on the smartcard, thank you. But as at least subkeys will reside outside the smartcard (I use GPG on my phone which can't connect to the card) and GPG seems to only support encrypting to one subkey, I'm afraid there is no possibility of only having some keys in the card for me. $\endgroup$
    – hansjoachim
    Commented Jan 24, 2017 at 9:58

1 Answer 1

Reset to default
1
$\begingroup$

Or is this measure included in the tutorial for historical reasons (as smartcards seem to only support storing RSA keys)?

While it is true that most (all?) OpenPGP compliant smart cards only support RSA, the likely reason for generating the keys in the tutorial was to show you how to generate keys and / or push them onto the card which is useful information in by itself.

I don't know if, from the security point of view, there are reasons against putting your "master" key on a smartcard.

There's nothing technically stopping you from putting your master key on your smart card. However when you lose the card, this master key, which has all sorts of hard-worked-for trust signatures is now gone. This certainly isn't something you want to risk usually (which is why better HSMs offer a way to backup keys). So you usually generate the master key in software, store it away safely and redundantly and maybe push a copy onto the card.

Do I really need to generate new subkeys for the smartcard?

No. While it's strongly advisable from a security standpoint to only have your keys on your card (so they're actually protected by the hardware and not by the software storage or the hardware) it is not mandatory.
Let's just assume that you have a software key shared between a mobile device and a computer. Let's further assume the mobile device is running iOS which is fairly good security-wise and the computer is running Windows 7 (which is less good security-wise). If you push your keys off the Windows PC an attacker would have to compromise your locked-down mobile device or the card which is both harder than compromising your Windows installation, so there you've gained some security.

But even if, wouldn't it be enough to generate one second subkey for signing instead of two new subkeys?

The interesting property of master keys is not that they can sign (S) stuff, but rather that they can certify (C) other keys to be belonging to you which as far as I know is exclusive to the master key in a set of keys.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thank you for this comprehensive answer. I just don't understand how the "certification" section is related to the question of whether a second encryption subkey is needed, but I think it gets explained indirectly in the next paragraph. Oh, btw.: I'm pretty sure certification is exclusive to the master key, as in the OpenPGP Message Format RFC it says: In a V4 key, the primary key MUST be a key capable of certification. The subkeys may be keys of any other type. (highlighted by me). $\endgroup$
    – hansjoachim
    Commented Jan 24, 2017 at 13:49
  • $\begingroup$ @hansjoachim that paragraph is related to the master-key backup section. And as said in the answer, you could keep your single encryption key and push the PC's copy to the card and keep the phone's copy. $\endgroup$
    – SEJPM
    Commented Jan 24, 2017 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.