PGP

Generate Frequency PGP Keys

🗒️ Please note all current Frequency PGP secure assets are stored in “Frequency” vault on 1Password.com and GitHub secrets.

1. Create PGP Master Key

Let's just generate a RSA 4096 master key that never expires, so we are able to sign and encrypt. While the master key will never expire, the keys we will actually use on a daily basis will expire.

# Generate master key
$ gpg --full-gen-key
---
Your selection? 1 (RSA and RSA)
What keysize do you want? (3072) 4096
Key does not expire at all
Key is valid for? (0)
Is this correct? (y/N) y
Real name: Frequency
Email address: security@frequency.xyz
Comment: Frequency Chain Identity
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
Password: <master password>

# Verify the key was added
$ gpg -K

# Send public key to keyserver
$ gpg --keyserver hkp://keys.gnupg.net --send-keys <keyId>

Example output:

gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
/home/youruser/.gnupg/pubring.kbx
---------------------------------
sec   rsa4096 2018-06-14 [SC]
      B3DFA611285A0FF08D4151AE2E1920CC6D2B72DD
uid           [ultimate] Tyler Baker (Tyler Baker Foundries Identity) <tyler@foundries.io>
ssb   rsa4096 2018-06-14 [E]

2. Configure Everyday-use Subkeys

# Set expiration for subkey
$ gpg --edit-key <keyId>
---
gpg> key 1
gpg> expire
Key is valid for? (0) 1y
Is this correct? (y/N) y

# Add signing key
gpg> addkey
(4) RSA (sign only)
Your selection? 4
What keysize do you want? (3072) 4096
Key is valid for? (0) 1y
Is this correct? (y/N) y
Really create? (y/N) y

# Check and save changes
gpg> list
gpg> save

3. Remove secret Master Key from device

3.1 Create Revocation Certificate

$ gpg --output frequency.revocation-certificate.gpg.txt --gen-revoke security@frequency.xyz
---
Create a revocation certificate for this key? (y/N) y
Your decision? 0
>
Is this okay? (y/N) y

The revocation certificate will be stored in frequency.revocation-certificate.gpg.txt Store the file offline and delete it from the device.

3.2 Backup Master Key's Secret

$ gpg --export-secret-keys --output frequency.secret.gpg.txt --armor <keyId>
Store frequency.secret.gpg file in a safe, offline and easy-to-remember place and delete it from the device. 

3.3 Remove Master Key's secret from keyring. REMOVE THE MASTER KEY'S SECRET ONLY, LEAVING SUBKEYS ALONE.

gpg --delete-secret-key keyId
Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
Delete secret key: <Delete Key>
Delete secret subkey: <No>
gpg: deleting secret subkey failed: Operation cancelled
gpg: BF90*******************: delete key failed: Operation cancelled

# Verify the secret is no longer present
$ gpg -K
sec#  rsa4096 2022-11-04 [SC]
  BF90*******************

The # next to the Master Key's means that the secret part of that key is not present in the keyring anymore, therefore it is not usable.

3.4 Test the key backup

After the deleting the private part, the Master Key is not usable anymore to modifying or adding subkeys. To verify your backup, retrieve it from your secure offline storage and issue:

$ gpg --import frequency.secret.gpg.txt
$ gpg -K
sec   rsa4096 2022-11-04 [SC]
  BF90*******************

By listing the private keyring once again we can see that the # sign has disappeared, meaning the Master Key is once again usable.

4. Use GPG for Creating Detached Signature

gpg -u security@frequency.xyz --detach-sign --armor frequency 
gpg --verify frequency.asc

Rotate Frequency PGP Keys

Coming soon...