improve GnuPG configuration file /etc/skel/.gnupg/gpg.conf

[adrelanos]

Stronger ciphers?

Any other hardening suggestions?

https://github.com/Kicksecure/security-misc/blob/master/etc/skel/.gnupg/gpg.conf

https://forums.whonix.org/t/anon-gpg-tweaks-gpg-conf-enhancements-duraconf-a-collection-of-hardened-configuration-files/5378

https://www.kicksecure.com/wiki/Air_Gapped_OpenPGP_Key

https://www.kicksecure.com/wiki/OpenPGP

[EclipseBazooka]

Stronger ciphers?

The default symmetric cipher used is AES-128

Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256

I'm not sure what would be/is better?

Also are there more ciphers?

https://www.gnupg.org/documentation/manuals/gcrypt/Available-ciphers.html

ArchWiki suggests adding this line to gpg.conf?

personal-cipher-preferences TWOFISH CAMELLIA256 AES 3DES

[monsieuremre]

This should not be too hard. Just choose the one that keeps winning the cipher competitions.

Also, we should make post quantum options the default as soon as possible, for the asymmetric stuff I mean.

Reasonable path for the future is follow this draft really closely.

There are individual post-quantom implementations, but these are not standardized. We should just follow closely the developments in standardization of this. Many big boy projects are already sponsoring the development of such standards. These will be available in the wild. We just want to be ahead of the curve to adapt. Not to mention, the other side should also support these technologies for them to work as intended.

[souchikjoardar201]

https://www.kicksecure.com/wiki/Air_Gapped_OpenPGP_Key

On a Airgapped machine I would suggest generating your key in RAM by pointing the --homedir to /tmp.

Generate new key in /tmp keyring
gpg --homedir=/tmp/.gnupg --full-generate-key

Export secret/private key to drive you want to save it to
Replace name@email with your key-id and replace /dev/sdb/ with your correct drive you wish to add it to.
Aswell as changing the name name-private.asc to your name of your key.

gpg --homedir=/tmp/.gnupg --export-secret-keys -a [email protected] > /dev/sdb/name-private.asc

Alternatively export secret/private key to STDOUT then copy and it and paste it where you want to save it
gpg --homedir=/tmp/.gnupg --export-secret-keys -a name@email -o

[adrelanos]

Unless using live mode, writing to RAM is too difficult for users.

/tmp isn't guaranteeing that nothing is written to the disk. (Swap, crash dumps. This goes into the topic of anti-forensics. In short: forget about it and use live mode.)

But what is the point of writing to RAM anyhow in this context? The private key needs to be stored persistently somewhere anyhow.

[souchikjoardar201]

In short: forget about it and use live mode.

lol yeah thats better said to do your right.

Half the time I was thinking of other users as Kicksecure/Whonix documentation alone is really great even if you aren't using either OS.

But what is the point of writing to RAM anyhow in this context?

Say for whatever reason you didn't want the private key to touch the disk. Lets say you were generating a PGP key for hardware key like Yubikey or something equivilent.

The private key needs to be stored persistently somewhere anyhow.

Yeah maybe it just too paranoid but to be fair you could store it onto offline storage media like a USB etc.

Then when you import it private key you can import it to another keyring (the one in /tmp) using the --homedir= command and sign whatever it be a file, checksums, or a message. But this route you have to import the key everytime to /tmp from your storage media. I highly doubt this would swap even if a swap was enabled but like you said live mode is better.

[souchikjoardar201]

@adrelanos

On the topic of live mode even though this issue is about gpg.conf I think should consider more grub options like an additonal live mode entry that disables networking (live offline).

Also maybe using a custom GDM in the future as grub is very limited to configuration like example you cant set seperate colored text entries for live mode entries and increasing grub text size for users with small screen resolutions.

[ben-grande]

Another hardend GnuPG configuration:

• https://gist.github.com/sebmellen/b0d0424caefa1221cbe4d9aaf2172d2c

[EclipseBazooka]

Another hardend GnuPG configuration:

* https://gist.github.com/sebmellen/b0d0424caefa1221cbe4d9aaf2172d2c

Thats many years old and wonder if key size beyond 4096 are really more secure at this point?

[ben-grande]

Thats many years old and wonder if key size beyond 4096 are really more secure at this point?

1. Many years old and still newer than the currently used gpg.conf.
2. I didn't say to trust everything in that file, it has outdated settings, yes, but it has many valuable ones.