Securix core: replace all used GPG keys

[martinholovsky]

Together with first stable release of Securix GNU/Linux will be generated completely new master GPG key and new private subkeys
This measurement should increase security and trust of keys, because they will be generated in air-gapped environment and private key will be stored on secure place

Keys in subject:

• Github key
• Codesign key (if key from StartCom will not be used anymore)

[adrelanos]

Hope that helps:
https://www.whonix.org/wiki/Air_Gapped_OpenPGP_Key

[martinholovsky]

Thanks for the link. Unfortunately smartcards/tokens are not in scope :]

[adrelanos]

Not sure if you understood it like this, but that article isn't tied to smartcards at all. They're just very briefly mentioned. 99% of the article is about air gapped OpenPGP keys that do not involve any smartcards.

[martinholovsky]

Yep, I got it right. Problem is that all howtos like this one does not consider smartcards... I have found just one manual which is quite fine, but still it will be long run to use it regularly.

[adrelanos]

Mind to discuss smartcards here or elsewhere? Also feel free to delete these comments if you consider it off-topic.

I have a major problem with smartcards. Bought a smartcard reader with external pin pad + OpenPGP smartcard that can hold up to 3 keys 4096 RSA. Now it's collecting dust. Then I learned the hard way, that you cannot combine the protection offered by smartcards (key cannot be extracted, protected through physical measures [hardware]) with gnupg's software password/encryption for OpenPGP private keys. When keys are copied to smartcards, the password/encryption of the OpenPGP private key is removed. It's stored in cleartext on the smartcard. No way to store encrypted blobs there. If the smartcard gets stolen or robbed, someone could attempt to remove the storage volume from the smartcard. It's being said that this is very difficult, but I personally could sleep better relying on password/encryption by OpenPGP rather than the hardware vendor.

I trust gnupg's software password/encryption for OpenPGP private keys that is Free Software for many years a lot more than the proprietary stuff that hardware vendors cooked up. I'd appreciated to take the latter as a bonus, but I would never want to solely rely on it.

Quite certain about this. Specifically asked about this on the gnupg-users mailing list and also asked Werner Koch (gpg lead dev) at c3c1 conference about this. Can lookup the former.