turnkey/openpgp-card
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add examples for passing PINs via file-descriptors.

Browse source 
Change the example card ident so that the serial number doesn't look like the default admin PIN.
This commit is contained in:
Heiko Schaefer 2021-11-06 12:36:59 +01:00
parent 9955c9e1be
commit 22bbf77707
No known key found for this signature in database
GPG key ID: 4A849A1904CCBD7D
1 changed files with 30 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
tools/README.md
View file

@ -55,13 +55,13 @@ $ opgpcard status
Explicitly print the status information for a specific card: Explicitly print the status information for a specific card:
``` ```
$ opgpcard status -c ABCD:12345678 $ opgpcard status -c ABCD:01234567
``` ```
Add `-v` for more verbose card status, including the list of supported Add `-v` for more verbose card status, including the list of supported
algorithms of the card (older cards may return no additional information): algorithms of the card (older cards may return no additional information):
``` ```
$ opgpcard status -c ABCD:12345678 -v $ opgpcard status -c ABCD:01234567 -v
``` ```
### Import keys ### Import keys
@ -69,7 +69,7 @@ $ opgpcard status -c ABCD:12345678 -v
Import private key onto a card. This works if at most one (sub)key Import private key onto a card. This works if at most one (sub)key
per role (sign, decrypt, auth) exists in `key.priv`: per role (sign, decrypt, auth) exists in `key.priv`:
``` ```
$ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> import key.priv $ opgpcard admin -c ABCD:01234567 -P <admin-pin-file> import key.priv
``` ```
Import private key onto a card while explicitly selecting subkeys. Import private key onto a card while explicitly selecting subkeys.
@ -77,7 +77,7 @@ Explicitly specified fingerprints are necessary if more than one subkey
exists in `key.priv` for any role (note: spaces in fingerprints are exists in `key.priv` for any role (note: spaces in fingerprints are
ignored). ignored).
``` ```
$ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> import key.priv \ $ opgpcard admin -c ABCD:01234567 -P <admin-pin-file> import key.priv \
--sig-fp "F290 DBBF 21DB 8634 3C96 157B 87BE 15B7 F548 D97C" \ --sig-fp "F290 DBBF 21DB 8634 3C96 157B 87BE 15B7 F548 D97C" \
--dec-fp "3C6E 08F6 7613 8935 8B8D 7666 73C7 F1A9 EEDA C360" \ --dec-fp "3C6E 08F6 7613 8935 8B8D 7666 73C7 F1A9 EEDA C360" \
--auth-fp "D6AA 48EF 39A2 6F26 C42D 5BCB AAD2 14D5 5332 C838" --auth-fp "D6AA 48EF 39A2 6F26 C42D 5BCB AAD2 14D5 5332 C838"
@ -89,19 +89,19 @@ keys will be imported for the other roles.
### Generate Keys on the card ### Generate Keys on the card
``` ```
$ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> generate -p <user-pin-file> -o <output-cert-file> 25519 $ opgpcard admin -c ABCD:01234567 -P <admin-pin-file> generate -p <user-pin-file> -o <output-cert-file> 25519
``` ```
### Set card metadata ### Set card metadata
Set cardholder name: Set cardholder name:
``` ```
$ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> name "Bar<<Foo" $ opgpcard admin -c ABCD:01234567 -P <admin-pin-file> name "Bar<<Foo"
``` ```
Set cardholder URL: Set cardholder URL:
``` ```
$ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> url "https://keyurl.example" $ opgpcard admin -c ABCD:01234567 -P <admin-pin-file> url "https://keyurl.example"
``` ```
### Signing ### Signing
@ -110,7 +110,7 @@ For now, this tool only supports creating detached signatures, like this
(if no input file is set, stdin is read): (if no input file is set, stdin is read):
``` ```
$ opgpcard sign --detached -c ABCD:12345678 -p <user-pin-file> -s <cert-file> <input-file> $ opgpcard sign --detached -c ABCD:01234567 -p <user-pin-file> -s <cert-file> <input-file>
``` ```
### Decrypting ### Decrypting
@ -118,17 +118,31 @@ $ opgpcard sign --detached -c ABCD:12345678 -p <user-pin-file> -s <cert-file> <i
Decryption using a card (if no input file is set, stdin is read): Decryption using a card (if no input file is set, stdin is read):
``` ```
$ opgpcard decrypt -c ABCD:12345678 -p <user-pin-file> -r <cert-file> <input-file> $ opgpcard decrypt -c ABCD:01234567 -p <user-pin-file> -r <cert-file> <input-file>
``` ```
### Factory reset ### Factory reset
Factory reset: Factory reset:
``` ```
$ opgpcard factory-reset -c ABCD:12345678 $ opgpcard factory-reset -c ABCD:01234567
``` ```
NOTE: you do not need a PIN to reset a card NOTE: you do not need a PIN to reset a card!
### Using file-descriptors for PINs
When using a shell like
[bash](https://www.gnu.org/software/bash/manual/html_node/Redirections.html#Here-Strings),
you can pass user and/or admin PINs via file-descriptors:
```
$ opgpcard sign --detached -c ABCD:01234567 -p /dev/fd/3 -s <cert-file> 3<<<123456
```
```
$ opgpcard admin -c ABCD:01234567 -P /dev/fd/3 generate -p /dev/fd/4 -o <output-cert-file> 25519 3<<<12345678 4<<<123456
```
## opgpcard-pin ## opgpcard-pin
@ -137,25 +151,25 @@ PIN on OpenPGP cards.
Set the user PIN (requires admin PIN): Set the user PIN (requires admin PIN):
``` ```
opgpcard-pin -c ABCD:12345678 set-user-pin opgpcard-pin -c ABCD:01234567 set-user-pin
``` ```
Set new admin PIN (requires admin PIN): Set new admin PIN (requires admin PIN):
``` ```
opgpcard-pin -c ABCD:12345678 set-admin-pin opgpcard-pin -c ABCD:01234567 set-admin-pin
``` ```
Reset user PIN after it has been blocked (requires admin PIN): Reset user PIN after it has been blocked (requires admin PIN):
``` ```
opgpcard-pin -c ABCD:12345678 reset-user-pin -a opgpcard-pin -c ABCD:01234567 reset-user-pin -a
``` ```
Set resetting code (requires admin PIN): Set resetting code (requires admin PIN):
``` ```
opgpcard-pin -c ABCD:12345678 set-reset-code opgpcard-pin -c ABCD:01234567 set-reset-code
``` ```
Reset user PIN (requires resetting code): Reset user PIN (requires resetting code):
``` ```
opgpcard-pin -c ABCD:12345678 reset-user-pin opgpcard-pin -c ABCD:01234567 reset-user-pin
``` ```