gpg --expert --full-generate-key

Select RSA (set your own capabilities).

Toggle sign and encrypt OFF so the current allowed actions is certify***.

****Create a key length of 4096 bits.

Provide an expiry date (3y).

Finish creating with name and email.

Add shorterlived subkeys for sign, encryption and authenticate.

gpg --export --edit-key [email protected]

The prompt will change to gpg>.

The addkey command is used to create each subkey. Choose the option for RSA (set your own capabilities).

Use a smaller length of 3072 to reduce size of the key.

After all three subkeys are created use the save command to exit.

You can also at this point add a small image tothey key, but I won't cover that.

gpg --export-secret-key --armor [email protected] > \<[email protected]\>.private.gpg-key

gpg --armor --gen-revoke [email protected] > \<[email protected]\>.gpg-revocation-certificate

Use the ./printkey.sh script to take a key, split it up and create a qrcode for each part. Print these out and store them safely.

Run the following command to ensure the crc of the keypair is good. gpg --dearmor newkey >/dev/null

If the key is already exported we can diff the files:

diff input <[email protected]>

Check the output of gpg --list-secret-keys

gpg --export-secret-subkeys --armor [email protected] > \<[email protected]\>.subkeys.gpg-key
gpg --delete-secret-keys [email protected]
gpg --import \<[email protected]\>.subkeys.gpg-key

Now look at the output of gpg --list-secret-keys it should say #sec in the first key. This means that the signing key is not in the keypair.

Now shred -z -u $file any exported files.

gpg --export-secret-keys --armor [email protected] > \<[email protected]\>.laptop.private.gpg-key gpg --export --armor [email protected] > \<[email protected]\>.laptop.public.gpg-key

Then on the new system

gpg --import \<[email protected]\>.laptop.public.gpg-key gpg --import \<[email protected]\>.laptop.private.gpg-key

Scan each barcode into a file:

zbarcam --raw >> inputkey

verify the CRC with

gpg --dearmor inputkey >/dev/null

After scanning there might be a 0x0A missing at the end of line 1 and an extra 0x0A at the end of the last line.

Importing to an offline RPI running raspian involves using the loopback pinentry command

gpg --import --pinentry-mode loopback inputkey

When a key is expiring

gpg --expert --edit-key <key>

key 1

expire

To export ssh public key

gpg --export-ssh-key [email protected]

and the privatekey

gpg --export-ssh-secret-key [email protected]

• https://alexcabal.com/creating-the-perfect-gpg-keypair
• https://spin.atomicobject.com/2013/11/24/secure-gpg-keys-guide/
• https://unix.stackexchange.com/questions/280222/generating-qr-code-of-very-big-file
• http://wiki.debian.org/subkeys
• https://security.stackexchange.com/questions/31594/what-is-a-good-general-purpose-gnupg-key-setup