Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2024-10-01 01:25:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Update split-gpg.md

Browse Source 
Sorry for proposing this change, since it evens puts into question the existence of the page and even Split GPG.  Maybe I should also submit a bug to https://github.com/QubesOS/qubes-issues .  I just followed the [contribution suggestions](https://www.qubes-os.org/doc/doc-guidelines/#contribution-suggestions).
This commit is contained in:
Daniel Gonzalez Gasull 2018-11-09 13:16:47 +08:00 committed by GitHub
parent 22ea6479f1
commit 1ea35ffe16
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
security/split-gpg.md
View File

@ -74,14 +74,18 @@ signed before the operation gets approved. Perhaps the GPG backend domain
could start a Disposable VM and have the to-be-signed document displayed
there? To Be Determined.
- The Split GPG client will fail to sign or encrypt if the private key in the
GnuPG backend is protected by a passphrase, it will give a *"Inappropriate ioctl
for device"* error. Avoid setting passphrases for the private keys in the GPG
backend domain, it won't provide extra security anyway, as explained before. If
you have a private key that already has a passphrase set use
`gpg2 --edit-key {key_id}`, then `passwd` to set an empty passphrase. Be aware
that `pinentry-ncurses` doesn't allow setting empty passphrases, so you would need
to install `pinentry-gtk` for it to work.
- **Split GPG is unusable due to the following problem**:
The Split GPG client will fail to sign or encrypt if the private key in the
GnuPG backend is protected by a passphrase, it will give a *"Inappropriate ioctl
for device"* error. Avoid setting passphrases for the private keys in the GPG
backend domain, it won't provide extra security anyway, as explained before.
Unfortunately you can set empty passphrases no matter what `pinentry-*` package
you are using. If you are generating a new key pair, or if you have a private
key that already has a passphrase and use
`gpg2 --edit-key {key_id}`, then `passwd`, then pinentry won't allow setting an
empty passphrase. This is true for any pinentry packages like `pinentry-ncurses`
and `pinentry-gtk` in Fedora, and for `pinentry-curses`, `pinentry-gtk2` and
`pinentry-gnome` in Debian.
## Configuring Split GPG ##