Here we create the master key. We want only Certify capability: we use the master key only to create the subkeys, Sign - Encrypt - Authenticate capabilities will be assigned to the subkeys.
Run the following command to start the master key generation process. Select the set your own capabilities creation process (type 8)
▶ gpg --full-generate-key --expert
gpg (GnuPG) 2.2.9; Copyright (C) 2018 Free Software Foundation, Inc.
|
You'll probably be working with a single smartcard, so you'll want only one primary key ( |
Putting cryptographic primitives together is a lot like putting a jigsaw puzzle together, where all the pieces are cut exactly the same way, but there is only one correct solution. Thankfully, there are some projects out there that are working hard to make sure developers are getting it right.
The following advice comes from years of research from leading security researchers, developers, and cryptographers. This Gist was [forked from Thomas Ptacek's Gist][1] to be more readable. Additions have been added from
This is a local copy of the commands from:
This guide serves as a reference of collected information necessary for strict management of PGP keys. This includes keeping a master key that always remains
