歡迎光臨
每天分享高質量文章
當前位置：知識星球 > 後端 > 正文

在 Gentoo 中使用 Yubikey PGP 卡

2018-05-17 分類：後端 閱讀(499) 評論(0)

PGP 卡是一種智慧卡，這種智慧卡可以執行加密、解密、數字簽名/驗證、認證等任務。它允許我們安全地儲存金鑰。
— Locez


致謝
轉載自　|　http://locez.com/linux/cryptography/yubikey-pgp-card/
　作者　|　Locez

本文環境

◈ OS：Gentoo
◈ 核心：4.9.76
◈ gpg (GnuPG)： 2.2.4
◈ yubikey-manager： 0.6.0
◈ pcsc-tools： 1.4.27

什麼是 PGP 卡？

在加密技術中，PGP 卡是一種智慧卡，這種智慧卡可以執行加密、解密、數字簽名/驗證、認證等任務。它允許我們安全地儲存金鑰。私鑰和密碼不能用任何命令或功能從卡上讀取，但是可以將新金鑰寫入到卡上改寫舊金鑰。Yubikey 裡面有 PGP 卡的功能，因此可以將金鑰安全地存進去，使得我們的金鑰有一個物理裝置的載體，類似於銀行的 U 盾。

軟體安裝

Yubikey 相關的包都被 Gentoo 標記為 Masked，所以首先是要解除掉才能安裝：

  1. # vim /etc/portage/package.accept_keywords/yubikey

將以下內容填入：

  1. # required by app-crypt/yubikey-manager-0.6.0::gentoo
  2. # required by app-crypt/yubikey-manager (argument)
  3. =dev-python/pyusb-1.0.2 ~amd64
  4. # required by app-crypt/yubikey-manager (argument)
  5. =app-crypt/yubikey-manager-0.6.0 ~amd64
  6. # required by app-crypt/yubikey-manager-0.6.0::gentoo
  7. # required by app-crypt/yubikey-manager (argument)
  8. =dev-python/pyscard-1.9.5 ~amd64
  9. # required by sys-apps/pcsc-tools-1.4.27::gentoo
  10. # required by pcsc-tools (argument)
  11. =dev-perl/pcsc-perl-1.4.14 ~amd64
  12. # required by pcsc-tools (argument)
  13. =sys-apps/pcsc-tools-1.4.27 ~amd64

安裝 yubikey-manager：

  1. # emerge --ask app-crypt/yubikey-manager

安裝 pcsc-tools：

  1. # emerge --ask  pcsc-tools

連線裝置

因為本人是的桌面環境是 awesome，因此需要禁用 OTP 功能，只啟用 U2F、CCID：

  1. $ ykpersonalize -m5

註意： 在其它桌面環境中，如啟用全部 3 個功能只需要 ykpersonalize -m6 即可。

啟動 pcscd 守護行程：

  1. # systemctl start pcscd.socket

測試連線：

  1. $ pcsc_scan
  2. PC/SC device scanner
  3. V 1.4.27 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
  4. Compiled with PC/SC lite version: 1.8.22
  5. Using reader plug'n play mechanism
  6. Scanning present readers...
  7. 0: Yubico Yubikey 4 U2F+CCID 00 00
  9. Tue Apr 24 14:46:32 2018
  10. Reader 0: Yubico Yubikey 4 U2F+CCID 00 00
  11. ...
  1. $ gpg-connect-agent --hex "scd apdu 00 f1 00 00" /bye
  2. D[0000]  04 03 07 90 00                                     .....
  3. OK

編輯 PGP 卡資訊

  1. $ gpg --card-edit
  3. Reader ...........: Yubico Yubikey 4 U2F CCID 00 00
  4. Application ID ...: D2760001240102010006069500550000
  5. Version ..........: 2.1
  6. Manufacturer .....: Yubico
  7. Serial number ....: 06950055
  8. Name of cardholder: [not set]
  9. Language prefs ...: [not set]
  10. Sex ..............: unspecified
  11. URL of public key : [not set]
  12. Login data .......: [not set]
  13. Signature PIN ....: not forced
  14. Key attributes ...: rsa2048 rsa2048 rsa2048
  15. Max. PIN lengths .: 127 127 127
  16. PIN retry counter : 3 0 3
  17. Signature counter : 0
  18. Signature key ....: [none]
  19. Encryption key....: [none]
  20. Authentication key: [none]
  21. General key info..: [none]

設定密碼等資訊，預設的 PIN 是 123456，PUK 是 12345678：

  1. gpg/card> admin
  2. Admin commands are allowed
  4. gpg/card> passwd
  5. gpg: OpenPGP card no. D2760001240102010006069500550000 detected
  7. 1 - change PIN
  8. 2 - unblock PIN
  9. 3 - change Admin PIN
  10. 4 - set the Reset Code
  11. Q - quit
  13. Your selection? 1
  14. PIN changed.
  16. 1 - change PIN
  17. 2 - unblock PIN
  18. 3 - change Admin PIN
  19. 4 - set the Reset Code
  20. Q - quit
  22. Your selection? 3
  23. PIN changed.
  25. 1 - change PIN
  26. 2 - unblock PIN
  27. 3 - change Admin PIN
  28. 4 - set the Reset Code
  29. Q - quit
  31. Your selection? 4
  32. Reset Code set.
  34. 1 - change PIN
  35. 2 - unblock PIN
  36. 3 - change Admin PIN
  37. 4 - set the Reset Code
  38. Q - quit
  40. Your selection? q
  42. gpg/card>

設定個人資訊：

  1. gpg/card> name
  2. Cardholder's surname: Locez
  3. Cardholder's given name: Locez
  5. gpg/card> lang
  6. Language preferences: zh
  8. gpg/card> sex
  9. Sex ((M)ale, (F)emale or space): M
  11. gpg/card> login
  12. Login data (account name): Locez
  14. gpg/card>
  16. Reader ...........: Yubico Yubikey 4 U2F CCID 00 00
  17. Application ID ...: D2760001240102010006069500550000
  18. Version ..........: 2.1
  19. Manufacturer .....: Yubico
  20. Serial number ....: 06950055
  21. Name of cardholder: Locez Locez
  22. Language prefs ...: zh
  23. Sex ..............: male
  24. URL of public key : [not set]
  25. Login data .......: Locez
  26. Signature PIN ....: not forced
  27. Key attributes ...: rsa2048 rsa2048 rsa2048
  28. Max. PIN lengths .: 127 127 127
  29. PIN retry counter : 3 3 3
  30. Signature counter : 0
  31. Signature key ....: [none]
  32. Encryption key....: [none]
  33. Authentication key: [none]
  34. General key info..: [none]
  36. gpg/card>

生成與匯入 key

生成 PGP 主金鑰：

  1. $ gpg --full-generate-key
  2. gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
  3. This is free software: you are free to change and redistribute it.
  4. There is NO WARRANTY, to the extent permitted by law.
  6. gpg: directory '/home/locez/.gnupg' created
  7. gpg: keybox '/home/locez/.gnupg/pubring.kbx' created
  8. Please select what kind of key you want:
  9.    (1) RSA and RSA (default)
  10.    (2) DSA and Elgamal
  11.    (3) DSA (sign only)
  12.    (4) RSA (sign only)
  13. Your selection? 1
  14. RSA keys may be between 1024 and 4096 bits long.
  15. What keysize do you want? (2048) 4096
  16. Requested keysize is 4096 bits
  17. Please specify how long the key should be valid.
  18.          0 = key does not expire
  19.       <n>  = key expires in n days
  20.       <n>w = key expires in n weeks
  21.       <n>m = key expires in n months
  22.       <n>y = key expires in n years
  23. Key is valid for? (0) 0
  24. Key does not expire at all
  25. Is this correct? (y/N) y
  27. GnuPG needs to construct a user ID to identify your key.
  29. Real name: Locez
  30. Email address: loki.a@live.cn
  31. Comment: 
  32. You selected this USER-ID:
  33.     "Locez "
  35. Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
  36. We need to generate a lot of random bytes. It is a good idea to perform
  37. some other action (type on the keyboard, move the mouse, utilize the
  38. disks) during the prime generation; this gives the random number
  39. generator a better chance to gain enough entropy.

此時可以動動滑鼠鍵盤讓他收集足夠的隨機資料。

生成一個用於認證的子金鑰：

  1. $ gpg --expert --edit-key Locez
  2. gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
  3. This is free software: you are free to change and redistribute it.
  4. There is NO WARRANTY, to the extent permitted by law.
  6. gpg> addkey

然後跟著嚮導進行選擇就可以了，通常是選擇 (8) RSA (set your own capabilities) ，然後 4096 位金鑰 其中子金鑰對的型別選擇應該如下：

  1. Possible actions for a RSA key: Sign Encrypt Authenticate
  2. Current allowed actions: Sign Encrypt  #此處顯示的為該子金鑰可以使用的用途，
  3.                                        #透過多次選擇下麵的開關進行調整
  5.    (S) Toggle the sign capability
  6.    (E) Toggle the encrypt capability
  7.    (A) Toggle the authenticate capability
  8.    (Q) Finished
  10. Your selection?

然後重覆上面的操作再次新增一個用於簽名的子金鑰，最終效果大概如下，使用 save 命令儲存退出：

  1. gpg: checking the trustdb
  2. gpg: marginals needed: 3  completes needed: 1  trust model: pgp
  3. gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
  4. pub  rsa4096/AAAAAAAAAAAAAAAA
  5.      created: 2018-04-24  expires: never       usage: SC
  6.      trust: ultimate      validity: ultimate
  7. ssb  rsa4096/BBBBBBBBBBBBBBBB
  8.      created: 2018-04-24  expires: never       usage: E
  9. ssb  rsa4096/CCCCCCCCCCCCCCCC
  10.      created: 2018-04-24  expires: never       usage: A
  11. ssb  rsa4096/DDDDDDDDDDDDDDDD
  12.      created: 2018-04-24  expires: never       usage: S
  13. [ultimate] (1). Locez <loki.a@live.cn>

備份公鑰與私鑰

當我們把金鑰匯入 Yubikey 的時候，我們就無法取出金鑰，因此在匯入之前最好備份 備份主金鑰私鑰：

  1. $ gpg --export-secret-key --armor Locez >> master.key

備份主金鑰公鑰：

  1. $ gpg -a --export Locez >> master.pub

當然也可以對單獨子金鑰進行備份，語法如下：

  1. gpg --export-secret-subkeys  --armor DDDDDDDDDDDDDDDD >> sign.key

DDDDDDDDDDDDDDDD 為子金鑰的指紋資訊。子金鑰公鑰當然也可以單獨匯出，但是在匯出主金鑰公鑰的時候其實已經把子金鑰公鑰匯出了，因此可以不必重覆備份。

匯入進 Yubikey

備份做好以後，就可以將 RSA 金鑰匯入進 Yubikey 了，通常不建議直接將主金鑰匯入，因此在本文除了主金鑰外，另外有三個子金鑰用於匯入進 Yubikey。

採用 key index 語法選擇或者取消選擇金鑰，主金鑰為 0， 其它依次遞增，被選中會有星號。

  1. gpg> key 1
  2. ssb* rsa4096/BBBBBBBBBBBBBBBB
  3.      created: 2018-04-24  expires: never       usage: E

然後接著：

  1. gpg> keytocard
  2. Signature key ....: [none]
  3. Encryption key....: [none]
  4. Authentication key: [none]
  6. Please select where to store the key:
  7.    (2) Encryption key
  8. Your selection? 2

取消選擇子金鑰 1 並選擇子金鑰 2：

  1. gpg> key 1
  2. gpg> key 2
  3. gpg> keytocard
  4. Signature key ....: [none]
  5. Encryption key....: BBBB BBBB BBBB BBBB BBBB  BBBB BBBB BBBB BBBB BBBB 
  6. Authentication key: [none]
  8. Please select where to store the key:
  9.    (3) Authentication key
  10. Your selection? 3

重覆操作，直至把 3 個子金鑰都匯入進 Yubikey，最後 save 命令儲存,當你看到多了這樣的 card-no 字樣即錶面匯入成功：

  1. gpg --edit-key Locez
  2. gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
  3. This is free software: you are free to change and redistribute it.
  4. There is NO WARRANTY, to the extent permitted by law.
  6. Secret key is available.
  8. sec  rsa4096/AAAAAAAAAAAAAAAA
  9.      created: 2018-04-24  expires: never       usage: SC
  10.      trust: ultimate      validity: ultimate
  11. ssb  rsa4096/BBBBBBBBBBBBBBBB
  12.      created: 2018-04-24  expires: never       usage: E
  13.      card-no: 0000 00000001
  14. ssb  rsa4096/CCCCCCCCCCCCCCCC
  15.      created: 2018-04-24  expires: never       usage: A
  16.      card-no: 00000 00000001
  17. ssb  rsa4096/DDDDDDDDDDDDDDDD
  18.      created: 2018-04-24  expires: never       usage: S
  19.      card-no: 000000 00000001
  20. [ultimate] (1). Locez <loki.a@live.cn>

刪除主金鑰私鑰

通常，為了保證安全，日常操作採用子金鑰足以，主金鑰私鑰應該離線儲存在一個非常安全的地方，對的就是剛剛備份的那些東西需要離線儲存，例如找個保險櫃，此時先刪除主金鑰私鑰：

  1. $ gpg --delete-secret-key Locez
  2. gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
  3. This is free software: you are free to change and redistribute it.
  4. There is NO WARRANTY, to the extent permitted by law.
  7. sec  rsa4096/AAAAAAAAAAAAAAAA 2018-04-24 Locez <loki.a@live.cn>
  9. Delete this key from the keyring? (y/N) y
  10. This is a secret key! - really delete? (y/N) y

還可透過輸入以下命令進行確認, sec 後的 # 即表明主金鑰私鑰不可用：

  1. $ gpg -K
  2. /home/locez/.gnupg/pubring.kbx
  4. sec#  rsa4096 2018-04-24 [SC]     
  5.       AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
  6. uid           [ultimate] Locez <loki.a@live.cn>
  7. ssb>  rsa4096 2018-04-24 [E]
  8. ssb>  rsa4096 2018-04-24 [A]
  9. ssb>  rsa4096 2018-04-24 [S]

同樣輸入 gpg --edit-key Locez 會看到 Secret subkeys are available. 字樣，是子金鑰可用，而不是原來的主金鑰了。

簡單測試

為了驗證卡片寫入成功，做個簡單的測試，先拔掉 Yubikey：

  1. $ echo "Hello, this is a test" > test
  2. $ gpg --output test.en -se test 
  3. You did not specify a user ID. (you may use "-r")
  5. Current recipients:
  7. Enter the user ID.  End with an empty line: Locez
  9. Current recipients:
  10. rsa4096/BBBBBBBBBBBBBBBB 2018-04-24 "Locez "
  12. Enter the user ID.  End with an empty line:

空行結束，然後會要求你插入 Yubikey 並輸入 PIN 進行加密。

解密如下：

  1. gpg --decrypt test.en
  2. gpg: encrypted with 4096-bit RSA key, ID BBBBBBBBBBBBBBBB, created 2018-04-24
  3.       "Locez "
  4. Hello, this is a test
  5. gpg: Signature made Tue 24 Apr 2018 09:08:28 PM CST
  6. gpg:                using RSA key BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
  7. gpg: Good signature from "Locez " [ultimate]

參考資料

◈ https://developers.yubico.com/PGP/
◈ https://en.wikipedia.org/wiki/OpenPGP_card
◈ https://wiki.archlinux.org/index.php/GnuPG
◈ https://zhuanlan.zhihu.com/p/24103240

贊(0)
標籤：

相關推薦

熱門標籤

iOS (11238)微軟 (4955)Linux (4274)安全 (4180)Python (4161)效能 (3165)運維 (2774)最佳化 (2419).NET (2262)Google (2136)機器學習 (1795)併發 (1613)分散式 (1559)叢集 (1240)SQL (1174)Mysql (1060)區塊鏈 (1017)Docker (977)微服務 (922)面試 (919)Apache (743)NLP (725)Redis (719)Android (668)Git (640)架構師 (632)Nginx (630)Facebook (599)JVM (595)爬蟲 (476)

熱門文章

分享創造快樂

© 2024 知識星球   網站地圖