Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-01-15 09:17:11 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update split-gpg.md

Browse Source 
Sorry for proposing this change, since it evens puts into question the existence of the page and even Split GPG.  Maybe I should also submit a bug to https://github.com/QubesOS/qubes-issues .  I just followed the [contribution suggestions](https://www.qubes-os.org/doc/doc-guidelines/#contribution-suggestions).
This commit is contained in:
Daniel Gonzalez Gasull 2018-11-09 13:16:47 +08:00 committed by GitHub
parent 22ea6479f1
commit 1ea35ffe16
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
security/split-gpg.md
View File

@ -74,14 +74,18 @@ signed before the operation gets approved. Perhaps the GPG backend domain
could start a Disposable VM and have the to-be-signed document displayed could start a Disposable VM and have the to-be-signed document displayed
there? To Be Determined. there? To Be Determined.
- The Split GPG client will fail to sign or encrypt if the private key in the - **Split GPG is unusable due to the following problem**:
The Split GPG client will fail to sign or encrypt if the private key in the
GnuPG backend is protected by a passphrase, it will give a *"Inappropriate ioctl GnuPG backend is protected by a passphrase, it will give a *"Inappropriate ioctl
for device"* error. Avoid setting passphrases for the private keys in the GPG for device"* error. Avoid setting passphrases for the private keys in the GPG
backend domain, it won't provide extra security anyway, as explained before. If backend domain, it won't provide extra security anyway, as explained before.
you have a private key that already has a passphrase set use Unfortunately you can set empty passphrases no matter what `pinentry-*` package
`gpg2 --edit-key {key_id}`, then `passwd` to set an empty passphrase. Be aware you are using. If you are generating a new key pair, or if you have a private
that `pinentry-ncurses` doesn't allow setting empty passphrases, so you would need key that already has a passphrase and use
to install `pinentry-gtk` for it to work. `gpg2 --edit-key {key_id}`, then `passwd`, then pinentry won't allow setting an
empty passphrase. This is true for any pinentry packages like `pinentry-ncurses`
and `pinentry-gtk` in Fedora, and for `pinentry-curses`, `pinentry-gtk2` and
`pinentry-gnome` in Debian.
## Configuring Split GPG ## ## Configuring Split GPG ##