{"id":967,"date":"2019-10-22T12:25:04","date_gmt":"2019-10-22T10:25:04","guid":{"rendered":"https:\/\/sven-seeberg.de\/wp\/?p=967"},"modified":"2019-10-22T13:08:15","modified_gmt":"2019-10-22T11:08:15","slug":"using-multiple-openpgp-smart-cards-with-the-same-secret-keys","status":"publish","type":"post","link":"https:\/\/sven-seeberg.de\/wp\/?p=967","title":{"rendered":"Using multiple OpenPGP Smart Cards with the same secret keys"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">For redundancy I am keeping the same PGP private key on multiple OpenPGP smart cards. Sadly, GnuPG does not provide a way to manage multiple smart cards for the same private key stub. Therefore, the management for the smart cards must be done manually. (This text does not cover creating multiple smart cards with the same device. Outline: I&#8217;m running the keytocard command multiple times on different smart cards.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After importing the smart card on a device, the private key stubs are kept int the directory<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">~\/.gnupg\/private-keys-v1.d<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To see which file belongs to which private (sub-)key, run<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">gpg --with-keygrip -K<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then move the files belonging to the smart card to backup locations, for example<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cd ~\/.gnupg\/private-keys-v1.d <br>mv AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.key \\<br>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.key.card1<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Repeat this for all private keys stored on your smart card.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After that, unplug the first smart card and plug in the second smart card. Run<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">gpg --edit-card<br>fetch<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then run gpg &#8211;with-keygrip -K again and copy the newly created stub files files to new locations:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cd ~\/.gnupg\/private-keys-v1.d \nmv AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.key \\\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.key.card2<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now you can copy the .card1 or card2 files over the original key file and by that switch the smart card. You can write a short bash script that automatically copies the correct key file. Example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#!\/bin\/bash\ntouch ~\/.gnupg\/sc-toggle-status\nSC=$(cat ~\/.gnupg\/sc-toggle-status)\nif [ \"$SC\" == \"card1\" ]; then\n  echo \"card2\" > .gnupg\/sc-toggle-status\n  find ~\/.gnupg\/private-keys-v1.d -name \"*.card2\" | while read f; do cp \"$f\" \"${f%.card2}\"; done\n  echo \"Switching to SmartCard 2\"\nelse\n  echo \"card1\" > .gnupg\/sc-toggle-status\n  find ~\/.gnupg\/private-keys-v1.d -name \"*.card1\" | while read f; do cp \"$f\" \"${f%.card1}\"; done\n  echo \"Switching to SmartCard 1\"\nfi<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>For redundancy I am keeping the same PGP private key on multiple OpenPGP smart cards. Sadly, GnuPG does not provide a way to manage multiple smart cards for the same private key stub. Therefore, the management for the smart cards &hellip; <a href=\"https:\/\/sven-seeberg.de\/wp\/?p=967\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-967","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/posts\/967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=967"}],"version-history":[{"count":7,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/posts\/967\/revisions"}],"predecessor-version":[{"id":974,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=\/wp\/v2\/posts\/967\/revisions\/974"}],"wp:attachment":[{"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sven-seeberg.de\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}