带备份的OpenPGP密钥生成¶
下面的说明解释了OpenPGP密钥的生成以及如何将其复制到Nitrokey上。这种方法的好处是在Nitrokey丢失或损坏的情况下可以提供钥匙的备份。这些说明是基于GnuPG的命令行界面的。因此，你需要在你的系统上安装GnuPG。最新的Windows版GnuPG可以在`这里<https://www.gpg4win.org/>`__，最新的MacOS版可以在`这里<https://gpgtools.org/>`__找到。Linux系统的用户请在软件包管理器的帮助下安装GnuPG。
密钥生成¶
首先，你需要在本地生成一个密钥。你可以决定使用哪种密钥属性，最重要的是，你可以导出密钥并将其保存在某个地方，以备你需要恢复密钥。
主密钥和加密子密钥¶
我们可以使用``gpg --full-generate-key --expert``命令来启动一个具有所有可能选项的指导性密钥生成。你可以选择钥匙类型（通常是RSA（1）或ECC（9）），钥匙的长度和其他属性。下面的输出只是一个简单的例子，你可以选择其他值。
> gpg --full-generate-key --expert
gpg (GnuPG) 2.2.10; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(9) ECC and ECC
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(13) Existing key
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want for the subkey? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Jane Doe
Email address: jane@example.com
Comment:
You selected this USER-ID:
"Jane Doe "
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 0EFFB0704391497C marked as ultimately trusted
gpg: revocation certificate stored as '/home/nitrokey//.gnupg/openpgp-revocs.d/9D12C91F6FC4CD6E10A1727A0EFFB0704391497C.rev'
public and secret key created and signed.
pub rsa2048 2018-09-17 [SC]
9D12C91F6FC4CD6E10A1727A0EFFB0704391497C
uid Jane Doe
sub rsa2048 2018-09-17 [E]
备注
有关支持的算法的信息，请参考`faq<../faq.html>`_
认证的子密钥¶
你现在有一个能够签名和认证的主钥匙（标记为[SC]）和一个用于加密的子钥匙（标记为[E]）。在需要认证的情况下，有必要拥有另一个子密钥。这个子密钥将在下一步生成。输入``gpg --edit-key --expert keyID``来开始这个过程，而 "keyID "是钥匙的id或在钥匙生成时使用的电子邮件地址。
> gpg --edit-key --expert jane@example.com
gpg (GnuPG) 2.2.10; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
[ultimate] (1). Jane Doe
gpg>
现在你处于GnuPG的交互式模式，你可以通过简单地输入``addkey``添加一个密钥。你需要选择你想使用的密钥。选择 "设置你自己的能力 "是很关键的，因为我们想拥有 "验证 "能力，否则就没有这个能力。我们通过输入``s`和``<xid="330"></x>``，我们通过输入``a``激活认证。
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
Your selection? 8
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? s
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? e
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions:
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? a
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Authenticate
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? q
我们以``q``退出。之后，我们需要回答和之前一样的问题。最后，我们有一个准备好的密钥集，可以导入到我们的设备中。
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> quit
Save changes? (y/N) y
现在是备份你的钥匙的好时机。请保持这个备份非常安全。最好的做法是永远不要把这个密钥放在有互联网连接的普通计算机上，这样密钥就不会被破坏。你可以用以下方法创建一个备份。
> gpg --export-secret-keys jane@example.com > sec-key.asc
关键进口¶
你有一个主钥匙和两个子钥匙，可以导入到你的Nitrokey。在继续进行之前，请确保你真的有一个钥匙的备份，如果你需要的话。在接下来的步骤中使用的``keytocard``命令将从你的磁盘中**删除你的钥匙!
我们用``gpg --edit-key --expert keyID``再次访问GnuPG的交互式界面，而``keyID``是钥匙的id或钥匙生成时使用的电子邮件地址。
> gpg --edit-key --expert jane@example.com
gpg (GnuPG) 2.2.10; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> keytocard
Really move the primary key? (y/N) y
Please select where to store the key:
(1) Signature key
(3) Authentication key
Your selection? 1
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
我们刚刚把主钥匙导入卡中。现在我们继续处理两个子密钥。我们输入``key 1``来选择加密子密钥，并输入``keytocard``，再次选择要使用的插槽。
gpg> key 1
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb* rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> keytocard
Please select where to store the key:
(2) Encryption key
Your selection? 2
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb* rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
现在我们用``key 1``取消对第一个子键的选择，用<xid="79"></x>`key 2``并且用``keytocard``移动它。之后，我们退出并保存更改。
gpg> key 1
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> key 2
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb* rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> keytocard
Please select where to store the key:
(3) Authentication key
Your selection? 3
sec rsa2048/0EFFB0704391497C
created: 2018-09-17 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/A9A814C210F16700
created: 2018-09-17 expires: never usage: E
ssb* rsa2048/61F186B8B0BBD5D5
created: 2018-09-17 expires: never usage: A
[ultimate] (1). Jane Doe
gpg> quit
Save changes? (y/N) y
你的钥匙现在已经转移到了Nitrokey，从而在硬件上得到了保障。祝贺你!
导出公钥和钥匙服务器的使用¶
虽然你可以在你的系统上生成钥匙后立即开始使用你的Nitrokey，但你需要在每个你想使用Nitrokey的系统上导入你的公钥。所以为了做好准备，你有两个选择。你可以把公钥保存在你喜欢的任何地方，然后在另一个系统上使用，或者把公钥保存在一个网页/钥匙服务器上。
生成公钥文件¶
要获得你的公钥的简单文件，你可以直接使用``gpg --armor --export keyID > pubkey.asc``。使用指纹作为 "keyID"（查看``gpg -K``以获得它），或者直接使用你的电子邮件地址作为标识。
你可以随身携带这个文件，或者把它发送给你喜欢的人。这个文件一点也不秘密。如果你想在另一个系统上使用Nitrokey，你首先通过``gpg --import pubkey.asc``导入这个公钥，然后输入``gpg --card-status``，这样系统就知道要在哪里寻找这个密钥。这就是全部。
上传公钥¶
If you don't want to carry a public key file, you can upload it to keyserver. For the common SKS federated keyservers, for example, keyserver.ubuntu.com. Type gpg --keyserver keyserver.ubuntu.com --send-key keyID. If you are using another machine, you can just import it by using gpg --keyserver keyserver.ubuntu.com --recv-key keyID.
您也可以使用 openpgp.keys.org。建议使用``gpg --export your_address@example.net``。如果你使用的是另一台机器，可以直接通过``gpg --auto-key-locate hkps://keys.openpgp.org`` 导入。
另一种方法是更改密钥卡上的 URL 设置。再次启动``gpg --card-edit``，首先通过``url`` 命令设置密钥所在的 URL（例如在密钥服务器上或在你的网页上等）。从现在起，你只需在``gpg --card-edit environment`` 中使用``fetch`` 命令，就可以将密钥导入另一个系统。