mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
translated
This commit is contained in:
cmn
parent
976619a68c
commit
c03cd48071
@ -1,177 +0,0 @@
|
||||
translating by kimii
|
||||
Protecting Code Integrity with PGP — Part 2: Generating Your Master Key
|
||||
======
|
||||
|
||||
|
||||
|
||||
In this article series, we're taking an in-depth look at using PGP and provide practical guidelines for developers working on free software projects. In the previous article, we provided an introduction to [basic tools and concepts][1]. In this installment, we show how to generate and protect your master PGP key.
|
||||
|
||||
### Checklist
|
||||
|
||||
1. Generate a 4096-bit RSA master key (ESSENTIAL)
|
||||
|
||||
2. Back up the master key using paperkey (ESSENTIAL)
|
||||
|
||||
3. Add all relevant identities (ESSENTIAL)
|
||||
|
||||
|
||||
|
||||
|
||||
### Considerations
|
||||
|
||||
#### Understanding the "Master" (Certify) key
|
||||
|
||||
In this and next section we'll talk about the "master key" and "subkeys." It is important to understand the following:
|
||||
|
||||
1. There are no technical differences between the "master key" and "subkeys."
|
||||
|
||||
2. At creation time, we assign functional limitations to each key by giving it specific capabilities.
|
||||
|
||||
3. A PGP key can have four capabilities.
|
||||
|
||||
* [S] key can be used for signing
|
||||
|
||||
* [E] key can be used for encryption
|
||||
|
||||
* [A] key can be used for authentication
|
||||
|
||||
* [C] key can be used for certifying other keys
|
||||
|
||||
4. A single key may have multiple capabilities.
|
||||
|
||||
|
||||
|
||||
|
||||
The key carrying the [C] (certify) capability is considered the "master" key because it is the only key that can be used to indicate relationship with other keys. Only the [C] key can be used to:
|
||||
|
||||
* Add or revoke other keys (subkeys) with S/E/A capabilities
|
||||
|
||||
* Add, change or revoke identities (uids) associated with the key
|
||||
|
||||
* Add or change the expiration date on itself or any subkey
|
||||
|
||||
* Sign other people's keys for the web of trust purposes
|
||||
|
||||
|
||||
|
||||
|
||||
In the Free Software world, the [C] key is your digital identity. Once you create that key, you should take extra care to protect it and prevent it from falling into malicious hands.
|
||||
|
||||
#### Before you create the master key
|
||||
|
||||
Before you create your master key you need to pick your primary identity and your master passphrase.
|
||||
|
||||
##### Primary identity
|
||||
|
||||
Identities are strings using the same format as the "From" field in emails:
|
||||
```
|
||||
Alice Engineer <alice.engineer@example.org>
|
||||
|
||||
```
|
||||
|
||||
You can create new identities, revoke old ones, and change which identity is your "primary" one at any time. Since the primary identity is shown in all GnuPG operations, you should pick a name and address that are both professional and the most likely ones to be used for PGP-protected communication, such as your work address or the address you use for signing off on project commits.
|
||||
|
||||
##### Passphrase
|
||||
|
||||
The passphrase is used exclusively for encrypting the private key with a symmetric algorithm while it is stored on disk. If the contents of your .gnupg directory ever get leaked, a good passphrase is the last line of defense between the thief and them being able to impersonate you online, which is why it is important to set up a good passphrase.
|
||||
|
||||
A good guideline for a strong passphrase is 3-4 words from a rich or mixed dictionary that are not quotes from popular sources (songs, books, slogans). You'll be using this passphrase fairly frequently, so it should be both easy to type and easy to remember.
|
||||
|
||||
##### Algorithm and key strength
|
||||
|
||||
Even though GnuPG has had support for Elliptic Curve crypto for a while now, we'll be sticking to RSA keys, at least for a little while longer. While it is possible to start using ED25519 keys right now, it is likely that you will come across tools and hardware devices that will not be able to handle them correctly.
|
||||
|
||||
You may also wonder why the master key is 4096-bit, if later in the guide we state that 2048-bit keys should be good enough for the lifetime of RSA public key cryptography. The reasons are mostly social and not technical: master keys happen to be the most visible ones on the keychain, and some of the developers you interact with will inevitably judge you negatively if your master key has fewer bits than theirs.
|
||||
|
||||
#### Generate the master key
|
||||
|
||||
To generate your new master key, issue the following command, putting in the right values instead of "Alice Engineer:"
|
||||
```
|
||||
$ gpg --quick-generate-key 'Alice Engineer <alice@example.org>' rsa4096 cert
|
||||
|
||||
```
|
||||
|
||||
A dialog will pop up asking to enter the passphrase. Then, you may need to move your mouse around or type on some keys to generate enough entropy until the command completes.
|
||||
|
||||
Review the output of the command, it will be something like this:
|
||||
```
|
||||
pub rsa4096 2017-12-06 [C] [expires: 2019-12-06]
|
||||
111122223333444455556666AAAABBBBCCCCDDDD
|
||||
uid Alice Engineer <alice@example.org>
|
||||
|
||||
```
|
||||
|
||||
Note the long string on the second line -- that is the full fingerprint of your newly generated key. Key IDs can be represented in three different forms:
|
||||
|
||||
* Fingerprint, a full 40-character key identifier
|
||||
|
||||
* Long, last 16-characters of the fingerprint (AAAABBBBCCCCDDDD)
|
||||
|
||||
* Short, last 8 characters of the fingerprint (CCCCDDDD)
|
||||
|
||||
|
||||
|
||||
|
||||
You should avoid using 8-character "short key IDs" as they are not sufficiently unique.
|
||||
|
||||
At this point, I suggest you open a text editor, copy the fingerprint of your new key and paste it there. You'll need to use it for the next few steps, so having it close by will be handy.
|
||||
|
||||
#### Back up your master key
|
||||
|
||||
For disaster recovery purposes -- and especially if you intend to use the Web of Trust and collect key signatures from other project developers -- you should create a hardcopy backup of your private key. This is supposed to be the "last resort" measure in case all other backup mechanisms have failed.
|
||||
|
||||
The best way to create a printable hardcopy of your private key is using the paperkey software written for this very purpose. Paperkey is available on all Linux distros, as well as installable via brew install paperkey on Macs.
|
||||
|
||||
Run the following command, replacing [fpr] with the full fingerprint of your key:
|
||||
```
|
||||
$ gpg --export-secret-key [fpr] | paperkey -o /tmp/key-backup.txt
|
||||
|
||||
```
|
||||
|
||||
The output will be in a format that is easy to OCR or input by hand, should you ever need to recover it. Print out that file, then take a pen and write the key passphrase on the margin of the paper. This is a required step because the key printout is still encrypted with the passphrase, and if you ever change the passphrase on your key, you will not remember what it used to be when you had first created it -- guaranteed.
|
||||
|
||||
Put the resulting printout and the hand-written passphrase into an envelope and store in a secure and well-protected place, preferably away from your home, such as your bank vault.
|
||||
|
||||
**Note on printers:** Long gone are days when printers were dumb devices connected to your computer's parallel port. These days they have full operating systems, hard drives, and cloud integration. Since the key content we send to the printer will be encrypted with the passphrase, this is a fairly safe operation, but use your best paranoid judgement.
|
||||
|
||||
#### Add relevant identities
|
||||
|
||||
If you have multiple relevant email addresses (personal, work, open-source project, etc), you should add them to your master key. You don't need to do this for any addresses that you don't expect to use with PGP (e.g., probably not your school alumni address).
|
||||
|
||||
The command is (put the full key fingerprint instead of [fpr]):
|
||||
```
|
||||
$ gpg --quick-add-uid [fpr] 'Alice Engineer <allie@example.net>'
|
||||
|
||||
```
|
||||
|
||||
You can review the UIDs you've already added using:
|
||||
```
|
||||
$ gpg --list-key [fpr] | grep ^uid
|
||||
|
||||
```
|
||||
|
||||
##### Pick the primary UID
|
||||
|
||||
GnuPG will make the latest UID you add as your primary UID, so if that is different from what you want, you should fix it back:
|
||||
```
|
||||
$ gpg --quick-set-primary-uid [fpr] 'Alice Engineer <alice@example.org>'
|
||||
|
||||
```
|
||||
|
||||
Next time, we'll look at generating PGP subkeys, which are the keys you'll actually be using for day-to-day work.
|
||||
|
||||
Learn more about Linux through the free ["Introduction to Linux" ][2]course from The Linux Foundation and edX.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linux.com/blog/learn/PGP/2018/2/protecting-code-integrity-pgp-part-2-generating-and-protecting-your-master-pgp-key
|
||||
|
||||
作者：[KONSTANTIN RYABITSEV][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://www.linux.com/users/mricon
|
||||
[1]:https://www.linux.com/blog/learn/2018/2/protecting-code-integrity-pgp-part-1-basic-pgp-concepts-and-tools
|
||||
[2]:https://training.linuxfoundation.org/linux-courses/system-administration-training/introduction-to-linux
|
||||
@ -0,0 +1,176 @@
|
||||
用 PGP 保护代码完整性 - 第二部分：生成你的主密钥
|
||||
======
|
||||
|
||||
|
||||
|
||||
在本系列文章中，我们将深度探讨如何使用 PGP 以及为工作于自由软件项目的开发者提供实用指南。在前一篇文章中，我们介绍了[基本工具和概念][1]。在本文中，我们将展示如何生成和保护你的 PGP 主密钥。
|
||||
|
||||
### 清单
|
||||
|
||||
1. 生成一个 4096 位的 RSA 主密钥 (ESSENTIAL)
|
||||
|
||||
2. 使用 paperkey 备份你的 RSA 主密钥 (ESSENTIAL)
|
||||
|
||||
3. 添加所有相关的身份 (ESSENTIAL)
|
||||
|
||||
|
||||
|
||||
|
||||
### 考虑事项
|
||||
|
||||
#### 理解“主”（认证）密钥
|
||||
|
||||
在本节和下一节中，我们将讨论“主密钥”和“子密钥”。理解以下内容很重要：
|
||||
|
||||
1. 在“主密钥”和“子密钥”之间没有技术上的区别。
|
||||
|
||||
2. 在创建时，我们赋予每个密钥特定的能力来分配功能限制
|
||||
|
||||
3. 一个 PGP 密钥有四项能力
|
||||
|
||||
* [S] 密钥可以用于签名
|
||||
|
||||
* [E] 密钥可以用于加密
|
||||
|
||||
* [A] 密钥可以用于身份认证
|
||||
|
||||
* [C] 密钥可以用于认证其他密钥
|
||||
|
||||
4. 一个密钥可能有多种能力
|
||||
|
||||
|
||||
|
||||
|
||||
带有[C] (认证)能力的密钥被认为是“主”密钥，因为它是唯一可以用来表明与其他密钥关系的密钥。只有[C]密钥可以被用于：
|
||||
|
||||
* 添加或撤销其他密钥（子密钥）的 S/E/A 能力
|
||||
|
||||
* 添加，更改或撤销密钥关联的身份（uids）
|
||||
|
||||
* 添加或更改本身或其他子密钥的到期时间
|
||||
|
||||
* 为了网络信任目的为其它密钥签名
|
||||
|
||||
|
||||
|
||||
|
||||
在自由软件的世界里，[C]密钥就是你的数字身份。一旦你创建该密钥，你应该格外小心地保护它并且防止它落入坏人的手中。
|
||||
|
||||
#### 在你创建主密钥前
|
||||
|
||||
在你创建的你的主密钥前，你需要选择你的主要身份和主密码。
|
||||
|
||||
##### 主要身份
|
||||
|
||||
身份使用邮件中发件人一栏相同格式的字符串：
|
||||
```
|
||||
Alice Engineer <alice.engineer@example.org>
|
||||
|
||||
```
|
||||
|
||||
你可以在任何时候创建新的身份，取消旧的，并且更改你的“主要”身份。由于主要身份在所有 GnuPG 操作中都展示，你应该选择正式的和最有可能用于 PGP 保护通信的名字和邮件地址，比如你的工作地址或者用于在项目提交（commit）时签名的地址。
|
||||
|
||||
##### 密码
|
||||
|
||||
密码（passphrase）专用于在存储在磁盘上时使用对称加密算法对私钥进行加密。如果你的 .gnupg 目录的内容被泄露，那么一个好的密码就是小偷能够在线模拟你的最后一道防线，这就是为什么设置一个好的密码很重要的原因。
|
||||
|
||||
一个强密码的好的指导是用丰富或混合的词典的 3-4 个词，而不引用自流行来源（歌曲，书籍，口号）。由于你将相当频繁地使用该密码，所以它应当易于 输入和记忆。
|
||||
|
||||
##### 算法和密钥强度
|
||||
|
||||
尽管现在 GnuPG 已经支持椭圆曲线加密一段时间了，我们仍坚持使用 RSA 密钥，至少稍长一段时间。虽然现在就可以开始使用 ED25519 密钥，但你可能会碰到无法正确处理它们的工具和硬件设备。
|
||||
|
||||
如果后续的指南中我们说 2048 位的密钥对 RSA 公钥加密的生命周期已经足够，你可能也会好奇主密钥为什么是 4096 位。 原因很大程度是由于社会因素而非技术上的：主密钥在密钥链上恰好是最明显的，同时如果你的主密钥位数比一些你交互的开发者的少，他们将不可避免地负面评价你。
|
||||
|
||||
#### 生成主密钥
|
||||
|
||||
为了生成你的主密钥，请使用以下命令，并且将“Alice Engineer:”替换为正确值
|
||||
```
|
||||
$ gpg --quick-generate-key 'Alice Engineer <alice@example.org>' rsa4096 cert
|
||||
|
||||
```
|
||||
|
||||
一个要求输入密码的对话框将弹出。然后，你可能需要移动鼠标或输入一些密钥才能生成足够的熵，直到命令完成。
|
||||
|
||||
查看命令输出，它就像这样：
|
||||
```
|
||||
pub rsa4096 2017-12-06 [C] [expires: 2019-12-06]
|
||||
111122223333444455556666AAAABBBBCCCCDDDD
|
||||
uid Alice Engineer <alice@example.org>
|
||||
|
||||
```
|
||||
|
||||
注意第二行的长字符串 -- 它是你新生成的密钥的完整指纹。密钥 ID（key IDs）可以用以下三种不同形式表达：
|
||||
|
||||
* Fingerprint，一个完整的 40 个字符的密钥标识符
|
||||
|
||||
* Long，指纹的最后 16 个字符(AAAABBBBCCCCDDDD)
|
||||
|
||||
* Short，指纹的最后 8 个字符(CCCCDDDD)
|
||||
|
||||
|
||||
|
||||
|
||||
你应该避免使用 8 个字符的短密钥 ID(short key IDs),因为它们不足够唯一。
|
||||
|
||||
这里，我建议你打开一个文本编辑器，复制你新密钥的指纹并粘贴。你需要在接下来几步中用到它，所以将它放在旁边会很方便。
|
||||
|
||||
#### 备份你的主密钥
|
||||
|
||||
出于灾后恢复的目的 -- 同时特别的如果你试图使用 Web of Trust 并且收集来自其他项目开发者的密钥签名 -- 你应该创建你的私钥的 硬拷贝备份。万一所有其它的备份机制都失败了，这应当是最后的补救措施。
|
||||
|
||||
创建一个你的私钥的可打印的硬拷贝的最好方法是使用为此而写的软件 paperkey。Paperkey 在所有 Linux 发行版上可用，在 Mac 上也可以通过 brew 安装 paperkey。
|
||||
|
||||
运行以下命令，用你密钥的完整指纹替换[fpr]：
|
||||
```
|
||||
$ gpg --export-secret-key [fpr] | paperkey -o /tmp/key-backup.txt
|
||||
|
||||
```
|
||||
|
||||
输出将采用易于 OCR 或手动输入的格式，以防如果你需要恢复它的话。打印出该文件，然后拿支笔，并在纸的边缘写下密钥的密码。这是必要的一步，因为密钥输出仍然使用密码加密，并且如果你更改了密钥的密码，你不会记得第一次创建的密钥是什么 -- 我保证。
|
||||
|
||||
将打印结果和手写密码放入信封中，并存放在一个安全且保护好的地方，最好远离你家，例如银行保险库。
|
||||
|
||||
**打印机注意事项** 打印机连接到计算机的并行端口的时代已经过去了。现在他们拥有完整的操作系统，硬盘驱动器和云集成。由于我们发送给打印机的关键内容将使用密码进行加密，因此这是一项相当安全的操作，但请使用您最好的偏执判断。
|
||||
|
||||
#### 添加相关身份
|
||||
|
||||
如果你有多个相关的邮件地址（个人，工作，开源项目等），你应该将其添加到主密钥中。你不需要为任何你不希望用于 PGP 的地址（例如，可能不是你的校友地址）这样做。
|
||||
|
||||
该命令是（用你完整的密钥指纹替换[fpr]）：
|
||||
```
|
||||
$ gpg --quick-add-uid [fpr] 'Alice Engineer <allie@example.net>'
|
||||
|
||||
```
|
||||
|
||||
你可以查看你已经使用的 UIDs：
|
||||
```
|
||||
$ gpg --list-key [fpr] | grep ^uid
|
||||
|
||||
```
|
||||
|
||||
##### 选择主 UID
|
||||
|
||||
GnuPG 将会把你最近添加的 UID 作为你的主 UID，如果这与你想的不同，你应该改回来：
|
||||
```
|
||||
$ gpg --quick-set-primary-uid [fpr] 'Alice Engineer <alice@example.org>'
|
||||
|
||||
```
|
||||
|
||||
下次，我们将介绍如何生成 PGP 子密钥，它是你实际用于日常工作的密钥。
|
||||
|
||||
通过 Linux 基金会和 edX 的免费[“Introduction to Linux” ][2]课程了解关于 Linux 的更多信息。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linux.com/blog/learn/PGP/2018/2/protecting-code-integrity-pgp-part-2-generating-and-protecting-your-master-pgp-key
|
||||
|
||||
作者：[KONSTANTIN RYABITSEV][a]
|
||||
译者：[kimii](https://github.com/kimii)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://www.linux.com/users/mricon
|
||||
[1]:https://www.linux.com/blog/learn/2018/2/protecting-code-integrity-pgp-part-1-basic-pgp-concepts-and-tools
|
||||
[2]:https://training.linuxfoundation.org/linux-courses/system-administration-training/introduction-to-linux
|
||||
Loading…
Reference in New Issue
Block a user