Scripts to Automate the Provisioning of a Yubikey | Hacker News Reader

Scripts to Automate the Provisioning of a Yubikey

github.com

This is my project! I'm extremely happy to see that other people have found my work useful.

The problem that these scripts solve is something that was encountered by my company when trying to enforce git commit signature verifications. We had given out yubikeys to every employee but not kept the public keys after provisioning them! This is a bit problem because it's next to impossible to extract the full public key from a yubikey without knowing three different incantations and the internals of how GnuPG deals with smartcards. That said, I wrote these scripts to automate the re-provisioning of the company's yubikeys (specifically just the PGP applet) so we could have our public keys stored it our own in-house PKI.

Obligatory: if you see any way this project can be improved, please open a pull request. I'm also open to work :)

Yeah, GnuPG and the OpenPGP smartcard spec are not ideal for corporate deployment scenarios; you are expected to already have a master keypair (or stub key) in your keyring before doing generating subkeys, and you are expected to have the entire public key block in your keyring before attempting to use a card. This is great in the usual case, which is the enlightened hacker with their well-known identity key exported to public keyservers; not so great for bulk-provisioning keys on private infra and ensuring users have a working GPG/agent/scdaemon setup.

I would actually encourage corps to train folks on PGP and get them set up with public identities, offline backups of master keys and revocation certs, holding the key-signing parties, and all that; then giving instructions on adding their corporate user-id to the public key they'll use everywhere else. There is a lot less friction with GPG across all your users' devices when there's only one identity to manage, and the next corp they onboard to can just get a new user-id without the ceremony. Plus it's cool to empower folks with their own security, which is what PGP is all about in the end.

> This is great in the usual case, which is the enlightened hacker with their well-known identity key exported to public keyservers

It’s great if you are doing exactly what the original GPG code wanted you to do. If you want to deviate in any way, it’s almost malicious. Want to use an airgapped or otherwise highly secure system to export a copy of a private key to a card? You had better back up your keyring first because the export operation is destructive! Want to verify a signature against a specific public key stored in a file? Prepare for a world of pain as you try to figure out how to get the thing into your keyring and verify against the correct key!

As far as I’m concerned, about the best thing that can be said about PGP is that it’s better than other tools that were available when it was written. Other than that, it’s really quite bad.

> Want to use an airgapped or otherwise highly secure system to export a copy of a private key to a card?

This is now built-in when you generate a key in the --edit-card admin interface. It asks you if you want to save a backup copy of the secret key.

How does your company use GPG for security? In what cases it works well?

We use GPG to sign git code commits so that we have some sort of protected audit trail for checkins and to make it much more difficult for a transient endpoint compromise to lead to a malicious code push. Putting the GPG keys into a yubikey make this much easier and it also adds a two-factor auth path that is much more convenient for developers.

Yup! Exactly

Both git commit signing and 2FA. Some DevOps engineers also use it to SSH into prod whenever there's a problems with the servers

Oh, yeah, works well for signing code.

We used it for various other things, such as password management and authentication.

Reply on news.ycombinator.com