Generating a new UID, and generating a "Recovery/Revocation Pack"

[bsodmike]

I have a simple script that I've been planning to wrap around a Clap based CLI - https://github.com/bsodmike/Yubikey-GPG-SSH-FIDO2-MFA-ZeroTrust

However, once I discovered this fantastic TUI, it's a simple option to add as a new feature. Here's how I think it would work if anyone feels it's a good value addition:

• User to supply a config yaml file (We can tweak this later)
• Generate C/S/E/A keys
• config to specify list of email identities
• config to specify keyserver
• revocation certs are pre-created
• entire output is tarballed.
• (good idea to have?) the tarball is LUKS encrypted.
• (optional) if AWS API keys are provided in config, stream the encrypted file into S3 bucket.

I already have a module I've made in the past that streams content into S3 and can reuse that etc.

[orhun]

Thanks for sharing your use case! However, it feels a bit too specific for gpg-tui. I'd rather keep it simple and only support keyring operations.

That being said, there is already "upload to keyserver" functionality available. Maybe we can support customizing that a bit.

[bsodmike]

Thanks for sharing your use case! However, it feels a bit too specific for gpg-tui. I'd rather keep it simple and only support keyring operations.

That being said, there is already "upload to keyserver" functionality available. Maybe we can support customizing that a bit.

True! Let me know what sort of customisations could work.

If we ignore the "upload to AWS" part, how about creating the full identity like this,

• Menu option to generate an identity recovery pack
• Field to enter details such as Name, all emails, key server etc
• Hit generate + provide a long password (see XKCD correct horse battery staple haha)
• Save encrypted LUKS file as gzipped tarball.
• push the identity to the keyserver via gpgme

Thoughts?

[orhun]

It still sounds a bit complicated and I feel like some of the parts can be offloaded with a simple bash script (e.g. encrypted LUKS)

You're definitely on to something here though, I would be happy to discuss it further after seeing a PoC of some sort.

Let me know what sort of customisations could work.

Maybe there are more services out that we can support uploading to. Though IIRC it can be customized via gpg-agent too...

[bsodmike]

It still sounds a bit complicated and I feel like some of the parts can be offloaded with a simple bash script (e.g. encrypted LUKS)

True, or optionally one could also do a gpg --encrypt etc via a bash script and tar ball etc.

You're definitely on to something here though, I would be happy to discuss it further after seeing a PoC of some sort.

Let me know what sort of customisations could work.

Maybe there are more services out that we can support uploading to. Though IIRC it can be customized via gpg-agent too...

Got it, thanks.

[bsodmike]

Phase 1
The POC should focus on the "Recovery/Revocation Pack"

• Menu option to generate an identity and the above mentioned pack, with expiry details as part of the input.
• It should contain:
  • private/public and sub-keys
  • S/C/E/A keys separately
  • revocation certs for the above
• Field to enter details such as Name, all emails

Phase 2
Discussing upload details.

[orhun]

Sounds good!