6

More than one time I read recommendations to use the primary key-pair in my OpenPGP certificate only to sign sub-key-pairs and not for general daily use (even to keep the private key stored on a non-network-enabled PC for additional security). I recently noticed that each key-pair in my certificate has flags which define for what purpose it must be used exclusively. As far as I understand currently (having trouble finding documentation), the process of signing sub-key-pairs would be depicted by A (for authentication).

In my newly generated certificate, my primary key-pair has the usage flags SC (signature and certification). Now it is quite easy to change these flags for sub-keys with the GnuPG command line tool, but I cannot find any way to modify the usage flags for the primary key-pair.

What I would like to be able to do, is to limit the primary key-pair to only be able to sign and revoke additional sub-key-pairs in my certificate. Can anyone tell me if this is possible and how to do it?

Improve this question

3 Answers 3

Reset to default
6

You'd need the usage flag certify C, which is required by the OpenPGP specifications anyway. Authentication A is rarely used and means you can authenticate yourself (similar to SSH key based authentication).

Yet it is not possible to change the usage flags in GnuPG (but by hacking the code). From a message by Resul Cetin on that mailing list thread:

Ok, it was quite easy to do (not clean, but it could be done in a fast and hackish way). Just searched for gnupg-1.4.9/g10/getkey.c:parse_key_usage and changed p to non-const and always set (*p) &=~2;. Afterwards I started my new compiled hackish-gpg --edit-key and set the expire of my master key. After this procedure I had only the Cert flag set. Thanks Christoph - you are my personal hero of the day :)

Improve this answer
1
  • 1
    This worked for me.
    – Ivan Vučica
    Jun 11, 2016 at 18:21
2

To change an existing master key, the gnupg-users thread which Jens quoted covers the only way I've seen of doing it.

To set the master key to only Certify when it is created is a little easier:

bash-3.2$ gpg --gen-key --expert
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
Your selection? 8

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? e

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
RSA keys may be between 1024 and 16384 bits long.
What keysize do you want? (2048)   C-c C-c
gpg: Interrupt caught ... exiting

bash-3.2$

You will, however, need to create the subkeys manually using the gpg --edit-key command afterwards.

Improve this answer
4
  • How are you getting the option of 16,384 bits? I was under the impression that GnuPG limited RSA keys to a maximum of 4,096 bits.
    – Tyler Crompton
    Jun 17, 2015 at 21:43
  • 1
    That is correct. In my case, however, I modify the source of version 1.4.x to add that and the requisite secure memory modifications to handle larger key sizes. Then just recompile as normal. I do not, however, use any keys over 4K for communications (that might change at some point, depending on the acceptance of ECC and other factors), so these changes only affect me. Normally I remember to modify examples like the one above to give the standard 4096-bits as the upper limit, but clearly I forgot in that case.
    – Ben
    Jun 19, 2015 at 9:03
  • @TylerCrompton in batch mode there are options to get bigger key sizes.
    – 0xC0000022L
    Mar 16, 2017 at 0:37
  • Yes, but there are hard limits in the source code too. Anyway, most people are better off sticking with the recommended best practices. Exceptions will already know who they are and why their threat model requires the exception.
    – Ben
    Mar 18, 2017 at 7:47
1

change-usage is the hidden subcommand that will change the allowed action.

$ gpg --edit-key $KEYID

gpg> change-usage
Changing usage of the primary key.

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection?

Sources -

  1. Detailed explanation is given in this answer given by sanmai to another question.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .