Emacs, GnuPG and Pass

Arch Linux

#+BEGIN_SRC shell :results output code
  uname -a
#+END_SRC

#+RESULTS:
#+begin_src shell
Linux arch 5.7.7-arch1-1 #1 SMP PREEMPT Wed, 01 Jul 2020 14:53:16 +0000 x86_64 GNU/Linux
#+end_src

The first and most important part is GnuPG keys. They are used to encrypt, decrypt and for signing. This post will use one sub key for encryption/decryption and another for signing. The master key will never expire. The sub keys will have a lifetime of 1 year. After that they will be replaced with new sub keys.

This post wont cover the steps of publishing the public signing sub key. But one benefit of publishing new public keys "often" is the acknowledgment of new algorithms. If your published key is very old, it states that you only support old algorithms even if you run the latest GnuPG software. If you wanna know more about publishing keys, more info can be found here and here.

More details about GnuPG keys and sub keys can be found here:

• https://keyring.debian.org/creating-key.html
• https://ekaia.org/blog/2009/05/10/creating-new-gpgkey/
• https://wiki.debian.org/Subkeys
• https://wiki.archlinux.org/index.php/GnuPG
• https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html

GnuPG on Arch. Together with gpg a collection of pinentry tools is installed.

pacman -S gnupg

Before start generating keys, make sure that you have this config file in place.

#+BEGIN_SRC shell :results output code
  cat ~/.gnupg/gpg.conf
#+END_SRC

#+RESULTS:
#+begin_src shell
personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
#+end_src

Some of the steps are truncated with ... and some steps don't show exactly what you should do. If steps are confusing, turn to the links in the Intro section for guidance.

Start by creating a master key. This key should never expire and it's super important that you keep the master key safe. Bake sure to create a backup and store it offline.

gpg --full-gen-key
Select keys: RSA and RSA
Select keys size: 4096
Valid for: do not expire

Together with the master key, a sub key for encryption is also created. List the keys including sub key fingerprints.

gpg --list-secret-keys --with-subkey-fingerprint

Change the expire time of the encryption sub key to 1 year. This means that you every year need to generate a new encryption subkey from the master key.

gpg --edit-key <MASTER KEY FINGERPRINT>
key <EXISTING ENCRYPT SUB KEY FINGERPRINT>
expire
1y
...
save

This sub key will only be used for signing. After one year it will expire and a new one needs to be created from the master key.

gpg --edit-key <MASTER KEY FINGERPRINT>
addkey
Key:       RSA (sign only)
Key size:  4096
Valid for: 1y
...
save

Create backup and store some place safe!

umask 077; tar -cf $HOME/gnupg-backup.tar -C $HOME .gnupg

pinentry is the application that is responsible to ask you for the gpg passphrase. pinentry have applications for many environments. Such as curses, emacs, gnome, gtk, qt and tty. I am using pinentry-emacs. This requires some setup in order for Emacs to handle pinentry requests.

This is the gpg-agent config that tells it to use Emacs for pinentry:

#+BEGIN_SRC shell :results output code
  cat ~/.gnupg/gpg-agent.conf
#+END_SRC

#+RESULTS:
#+begin_src shell
default-cache-ttl 3600
allow-loopback-pinentry
pinentry-program /usr/bin/pinentry-emacs
allow-emacs-pinentry
#+end_src

When gpg need you to provide a passphrase to access gpg resources, it will ask in Emacs minibuffer!

Here is the list of pinentry applications provided by my current Arch GnuPG installation:

#+BEGIN_SRC shell :results output code
  pacman -Ql pinentry | awk '{ print $2}' | grep bin/pin
#+END_SRC

#+RESULTS:
#+begin_src shell
/usr/bin/pinentry
/usr/bin/pinentry-curses
/usr/bin/pinentry-emacs
/usr/bin/pinentry-gnome3
/usr/bin/pinentry-gtk-2
/usr/bin/pinentry-qt
/usr/bin/pinentry-tty
#+end_src

#+BEGIN_SRC shell :results output code
  cat ~/.config/systemd/user/emacs.service
#+END_SRC

#+RESULTS:
#+begin_src shell
[Unit]
Description=Emacs text editor
Documentation=info:emacs man:emacs(1) https://gnu.org/software/emacs/

[Service]
Type=simple
ExecStart=/usr/bin/emacs --fg-daemon --debug-init
ExecStop=/usr/bin/emacsclient --eval "(kill-emacs)"
Environment=SSH_AUTH_SOCK=%t/keyring/ssh
Restart=on-failure

[Install]
WantedBy=default.target
#+end_src

#+BEGIN_SRC shell :results output code
  cat ~/.bin/start-emacs
#+END_SRC

#+RESULTS:
#+begin_src shell
#!/bin/bash
emacsclient -nc
#+end_src

#+BEGIN_SRC shell :results output code
  systemctl --user status emacs.service  # Service status
  systemctl --user enable emacs.service  # Start service on boot
  systemctl --user start emacs.service   # Start service
  systemctl --user stop emacs.service    # Stop service
  journalctl --user -u emacs.service     # Service stdout
#+END_SRC

#+BEGIN_SRC shell :results output code
  cat ~/.emacs.d/packages.el | awk 'NR==7,NR==11'
#+END_SRC

#+RESULTS:
#+begin_src shell
(use-package pinentry
  :pin melpa
  :config
  (setf epa-pinentry-mode 'loopback)
  (pinentry-start))
#+end_src

To get the keys to my phone I exported them from the keychain and into qr codes. Then used imagemagick to show each of them for some seconds before showing the next one. When key size is 4096 they don't fit into one qr image.

The qr codes can also be printed and kept in a safe as a secure backup.

mkdir -p /tmp/keys-export && cd $_
gpg --export-secret-keys --armor <SUB KEY FINGERPRINT> > sub.key
split -C 2500 sub.key splitkey-
for file in splitkey-??; do <"$file" qrencode -s 3 -d 150 -o "$file".qr; done
display -delay 50 *.qr
cd /tmp && rm -rf keys-export

On Arch, all of the packages are in the repo.

pacman -S pass browserpass browserpass-chromium

Create a new store and provide your gpg id. Pass also have built in support for git.

pass init <ENCRYPT SUB KEY FINGERPRINT>!
pass git init

Add a password to the password store.

pass insert fsf.org

Get the password to stdout.

pass show fsf.org

pass have many more options, check them out.

pass --help

Install browser pass extension using the installation steps here.