s83/YubiKey-Guide
1
0
Fork 0
mirror of https://github.com/drduh/YubiKey-Guide.git synced 2025-06-18 11:12:40 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

set individual key types default to ed25519 for auth

Browse source
This commit is contained in:
drduh 2025-06-15 14:08:13 -07:00
parent e974dbb95c
commit 76d557b0f6
2 changed files with 31 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -367,7 +367,7 @@ Subkeys must be renewed or rotated using the Certify key - see [Updating keys](#
Set Subkeys to expire on a planned date: Set Subkeys to expire on a planned date:
```console ```console
export EXPIRATION=2027-05-01 export EXPIRATION=2027-07-01
``` ```
The expiration date may also be relative, for example set to two years from today: The expiration date may also be relative, for example set to two years from today:

42
scripts/generate.sh
View file

@ -32,12 +32,25 @@ get_id_label () {
printf "YubiKey User <yubikey@example.domain>" printf "YubiKey User <yubikey@example.domain>"
} }
get_key_type () { get_key_type_sign () {
# Returns key type and size. # Returns key type for signature subkey.
#printf "default" #printf "default"
printf "rsa4096" printf "rsa4096"
} }
get_key_type_enc () {
# Returns key type for encryption subkey.
#printf "default"
printf "rsa4096"
}
get_key_type_auth () {
# Returns key type for authentication subkey.
#printf "default"
#printf "rsa4096"
printf "ed25519"
}
get_key_expiration () { get_key_expiration () {
# Returns key expiration date. # Returns key expiration date.
printf "2027-07-01" printf "2027-07-01"
@ -58,10 +71,12 @@ set_temp_dir () {
set_attrs () { set_attrs () {
# Sets identity and key attributes. # Sets identity and key attributes.
export IDENTITY="$(get_id_label)" export IDENTITY="$(get_id_label)"
export KEY_TYPE="$(get_key_type)" export KEY_TYPE_SIGN="$(get_key_type_sign)"
export KEY_TYPE_ENC="$(get_key_type_enc)"
export KEY_TYPE_AUTH="$(get_key_type_auth)"
export KEY_EXPIRATION="$(get_key_expiration)" export KEY_EXPIRATION="$(get_key_expiration)"
printf "set attributes (label='%s', type='%s', expire='%s')\n" \ printf "set attributes (label='%s', sign='%s', enc='%s', auth='%s', expire='%s')\n" \
"$IDENTITY" "$KEY_TYPE" "$KEY_EXPIRATION" "$IDENTITY" "$KEY_TYPE_SIGN" "$KEY_TYPE_ENC" "$KEY_TYPE_AUTH" "$KEY_EXPIRATION"
} }
get_pass () { get_pass () {
@ -85,8 +100,7 @@ gen_key_certify () {
# Generates Certify key with no expiration. # Generates Certify key with no expiration.
echo "$CERTIFY_PASS" | \ echo "$CERTIFY_PASS" | \
gpg --batch --passphrase-fd 0 \ gpg --batch --passphrase-fd 0 \
--quick-generate-key "$IDENTITY" \ --quick-generate-key "$IDENTITY" "$KEY_TYPE_SIGN" "cert" "never"
"$KEY_TYPE" "cert" "never"
} }
set_fingerprint () { set_fingerprint () {
@ -102,13 +116,15 @@ set_fingerprint () {
gen_key_subs () { gen_key_subs () {
# Generates Subkeys with specified expiration. # Generates Subkeys with specified expiration.
for SUBKEY in sign encrypt auth ; do \
echo "$CERTIFY_PASS" | \ echo "$CERTIFY_PASS" | \
gpg --batch --passphrase-fd 0 \ gpg --batch --passphrase-fd 0 --pinentry-mode=loopback \
--pinentry-mode=loopback \ --quick-add-key "$KEY_FP" "$KEY_TYPE_SIGN" sign "$KEY_EXPIRATION"
--quick-add-key "$KEY_FP" \ echo "$CERTIFY_PASS" | \
"$KEY_TYPE" "$SUBKEY" "$KEY_EXPIRATION" gpg --batch --passphrase-fd 0 --pinentry-mode=loopback \
done --quick-add-key "$KEY_FP" "$KEY_TYPE_ENC" encrypt "$KEY_EXPIRATION"
echo "$CERTIFY_PASS" | \
gpg --batch --passphrase-fd 0 --pinentry-mode=loopback \
--quick-add-key "$KEY_FP" "$KEY_TYPE_AUTH" auth "$KEY_EXPIRATION"
} }
save_secrets () { save_secrets () {