blob: e087d48740d60fff05b4214a85d51f64572de299 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
# Password Store with OTP using SmartCard
## Installation
```bash
# MacOS
brew install pass
brew install pass-otp
# Linux
sudo apt-get install pass
sudo apt install pass-extension-otp
# Password Store
git clone [email protected]:a14m/.pass ~/.password-store
```
### Usage
```bash
pass Personal/reddit
pass otp Personal/reddit
```
## Mobile Setup
[Install the pass app from the app store](https://mssun.github.io/passforios/)
Configure the app settings as follow:
+ General
+ Remember PGP Key Passphrase (ON)
+ Remember Git Credential Passphrase (ON)
+ Show Folders (ON)
+ Hide OTP Fields (ON)
+ Password Repository
+ Git URL: `https://github.com/a14m/.pass.git`
+ Username: `a14m`
+ Authentication Method: password
+ Generate a token at [github tokens](https://github.com/settings/tokens)
(with all `repo` permissions)
+ Paste the token into the mobile app
----
## SmartCard Setup
### Install Tails
+ Download [tails](https://tails.net/install/index.en.html)
+ Format a USB
+ Unmount disk (on MacOS ex. `diskutil unmountDisk /dev/diskX`)
+ Create bootable image from iso
`sudo dd if=/path/to/tails.img of=/dev/diskX bs=4M status=progress`
+ Boot the `tails` live image from a bootable USB
### Generate GPG Keys
```bash
gpg --expert --full-generate-key
Please select what kind of key you want:
(1) RSA and RSA (default)
...
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
...
Your selection? 11
Possible actions: Sign Certify Authenticate
Current allowed actions: Sign Certify
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? Q
Please select which elliptic curve you want:
(1) Curve 25519
(2) Curve 448
(3) NIST P-256
...
Your selection? 1
gpg --expert --edit-key <KEY_ID>
gpg> adduid
gpg> addkey
Please select what kind of key you want:
(1) RSA and RSA (default)
...
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
...
Your selection? 11
Possible actions: Sign Authenticate
Current allowed actions: Authenticate
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? Q
gpg> addkey
Please select what kind of key you want:
(1) RSA and RSA (default)
...
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
...
Your selection? 12
```
### Backup GPG Keys
```bash
gpg --export-secret-keys --armor <KEY_ID> > private.asc
gpg --export --armor <KEY_ID> > pubic.asc
cat private.asc | qr > private.png
cat public.asc | qr > public.png
gpg --delete-secret-and-public-keys <KEY_ID>
```
### Restore GPG Keys
```bash
# Restore GPG key from camera
zbarcam -1 --raw > key.asc
# Restore GPG key from file
zbarimg -1 --raw key.png > key.asc
```
### Import GPG Keys to SmartCard
```bash
# Import the GPG key on smartcard
gpg --import private.asc
gpg --edit-key --expert <KEY_ID>
gpg> trust
gpg> keytocard
Really move the primary key? (y/N) y
Please select where to store the key:
(1) Signature key
(2) Encryption key
(3) Authentication key
Your selection? 1
...
gpg> key 1
gpg> keytocard
Please select where to store the key:
(2) Encryption key
(3) Authentication key
Your selection? 2
...
gpg> key 1
gpg> key 2
gpg> keytocard
Please select where to store the key:
(3) Authentication key
Your selection? 3
...
gpg> save
gpg> quit
Save changes? (y/N) y
```
|
