Maniphest T6943

Add tool to detect and clean unsolicited copies of smartcard keys
Closed, ResolvedPublic
Actions

Assigned To
• werner
Authored By
• werner
Jan 17 2024, 3:10 PM
Tags
Subscribers
• werner

Description

Due to the on-disk generation of encryption keys with a followup transfer to a smartcard, it may happen that a copy of the key still exists in gpg-agent's key store. We need a new command to gpg-card whcih checks the keys of inserted smartcards, prints information and allows to delete unwanted key copies.

Revisions and Commits

rG GnuPG
rGadeb17e37588 card: New subcommand "checkkeys".

Related Objects
Search...

Event Timeline

• werner triaged this task as High priority.Jan 17 2024, 3:10 PM
• werner created this task.
• werner created this object in space Restricted Space.
• werner created this object with edit policy "Contributor (Project)".
• werner added a comment.Jan 17 2024, 3:13 PM

Example output:

gpg/card> checkkeys
D276000124010304000500009D8A0000 OpenPGP A1E8C48004B6F000B0D0872C35798C94D7F669B5 OPENPGP.1 shadowed
D276000124010304000500009D8A0000 OpenPGP 4EA2A5AF4E19A121FCCCF2BF8FA78141653EBEEE OPENPGP.2 clear
D276000124010304000500009D8A0000 OpenPGP 0CC9BECA94342A8A381ED9BC3BFF3AE110D2BCD3 OPENPGP.3 shadowed
gpg/card> checkkeys --delete-clear-copy
D276000124010304000500009D8A0000 OpenPGP A1E8C48004B6F000B0D0872C35798C94D7F669B5 OPENPGP.1 shadowed
D276000124010304000500009D8A0000 OpenPGP 4EA2A5AF4E19A121FCCCF2BF8FA78141653EBEEE OPENPGP.2 clear
D276000124010304000500009D8A0000 OpenPGP 0CC9BECA94342A8A381ED9BC3BFF3AE110D2BCD3 OPENPGP.3 shadowed
Number of deleted key copies: 1
gpg/card> checkkeys
D276000124010304000500009D8A0000 OpenPGP A1E8C48004B6F000B0D0872C35798C94D7F669B5 OPENPGP.1 shadowed
D276000124010304000500009D8A0000 OpenPGP 4EA2A5AF4E19A121FCCCF2BF8FA78141653EBEEE OPENPGP.2 shadowed
D276000124010304000500009D8A0000 OpenPGP 0CC9BECA94342A8A381ED9BC3BFF3AE110D2BCD3 OPENPGP.3 shadowed
• werner added a commit: rGadeb17e37588: card: New subcommand "checkkeys"..Jan 22 2024, 10:33 AM
• werner changed the task status from Open to Testing.Jan 22 2024, 4:52 PM
• werner moved this task from Backlog to QA on the gnupg24 board.
• werner changed the status of subtask T6944: The default card key generation keeps an unprotected backup of the encryption key on disk from Open to Testing.
• werner closed subtask T6944: The default card key generation keeps an unprotected backup of the encryption key on disk as Resolved.Jan 24 2024, 2:31 PM
• werner closed this task as Resolved.Jan 25 2024, 11:56 AM
• werner shifted this object from the Restricted Space space to the S1 Public space.
• werner moved this task from QA to gnupg-2.4.4 on the gnupg24 board.
• werner edited projects, added gnupg24 (gnupg-2.4.4); removed gnupg24.