Parcourir la source

Include the backup key in key splitting

Bob Mottram il y a 9 ans
Parent
révision
7104c356c1
2 fichiers modifiés avec 41 ajouts et 5 suppressions
  1. 1
    1
      src/freedombone
  2. 40
    4
      src/freedombone-splitkey

+ 1
- 1
src/freedombone Voir le fichier

@@ -7331,7 +7331,7 @@ function split_gpg_key_into_fragments {
7331 7331
   # split the gpg key into fragments if social key management is enabled
7332 7332
   if [[ $ENABLE_SOCIAL_KEY_MANAGEMENT == "yes" ]]; then
7333 7333
       echo 'Splitting GPG key. You may need to enter your passphrase.'
7334
-      freedombone-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS
7334
+      freedombone-splitkey -u $MY_USERNAME -e $MY_EMAIL_ADDRESS --fullname "$MY_NAME"
7335 7335
       if [ ! -d /home/$MY_USERNAME/.gnupg_fragments ]; then
7336 7336
           echo 'Yhe GPG key could not be split'
7337 7337
           exit 86548

+ 40
- 4
src/freedombone-splitkey Voir le fichier

@@ -37,10 +37,11 @@
37 37
 KEY_FRAGMENTS=3
38 38
 MY_USERNAME=
39 39
 MY_EMAIL_ADDRESS=
40
+MY_NAME=
40 41
 
41 42
 function show_help {
42 43
     echo ''
43
-    echo 'freedombone-splitkey -u [username] -n [number of fragments] -e [email address]'
44
+    echo 'freedombone-splitkey -u [username] -n [number of fragments] -e [email address] --fullname [Full name]'
44 45
     echo ''
45 46
     exit 0
46 47
 }
@@ -65,6 +66,10 @@ case $key in
65 66
     shift
66 67
     MY_EMAIL_ADDRESS=$1
67 68
     ;;
69
+    --fullname)
70
+    shift
71
+    MY_NAME=$1
72
+    ;;
68 73
     *)
69 74
     # unknown option
70 75
     ;;
@@ -95,7 +100,19 @@ if [ ! $MY_EMAIL_ADDRESS ]; then
95 100
     MY_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
96 101
 fi
97 102
 KEYID=$(su -c "gpg --list-keys $MY_EMAIL_ADDRESS | grep 'pub '" - \
98
-        $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
103
+           $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
104
+if [ ${#KEYID} -lt 4 ]; then
105
+    echo "gpg key for $MY_EMAIL_ADDRESS was not found"
106
+    return 3682
107
+fi
108
+
109
+MY_BACKUP_KEY_ID=$(gpg --list-keys "$MY_NAME (backup key)" | \
110
+                          grep 'pub ' | awk -F ' ' '{print $2}' | \
111
+                          awk -F '/' '{print $2}')
112
+if [ ${#MY_BACKUP_KEY_ID} -lt 4 ]; then
113
+    echo "gpg backup key for '$MY_NAME' was not found"
114
+    return 58213
115
+fi
99 116
 
100 117
 # create the key file
101 118
 mkdir -p $FRAGMENTS_DIR
@@ -105,14 +122,33 @@ if [ ! "$?" = "0" ]; then
105 122
     echo "Unable to extract public key for $KEYID"
106 123
     exit 7835
107 124
 fi
108
-gpg --output $FRAGMENTS_DIR/privkey.txt --armor --export-secret-key $KEYID
125
+gpg --output $FRAGMENTS_DIR/privkey.txt \
126
+    --armor --export-secret-key $KEYID
109 127
 if [ ! "$?" = "0" ]; then
110 128
     echo "Unable to extract private key for $KEYID"
111 129
     exit 7823
112 130
 fi
113
-cat $FRAGMENTS_DIR/pubkey.txt $FRAGMENTS_DIR/privkey.txt > $KEYS_FILE
131
+gpg --output $FRAGMENTS_DIR/backup_pubkey.txt \
132
+    --armor --export $MY_BACKUP_KEY_ID
133
+if [ ! "$?" = "0" ]; then
134
+    echo "Unable to extract backup public key for $MY_BACKUP_KEY_ID"
135
+    exit 62928
136
+fi
137
+gpg --output $FRAGMENTS_DIR/backup_privkey.txt \
138
+    --armor --export-secret-key $MY_BACKUP_KEY_ID
139
+if [ ! "$?" = "0" ]; then
140
+    echo "Unable to extract backup private key for $MY_BACKUP_KEY_ID"
141
+    exit 13783
142
+fi
143
+
144
+cat $FRAGMENTS_DIR/pubkey.txt \
145
+    $FRAGMENTS_DIR/privkey.txt \
146
+    $FRAGMENTS_DIR/backup_pubkey.txt \
147
+    $FRAGMENTS_DIR/backup_privkey.txt > $KEYS_FILE
114 148
 shred -zu $FRAGMENTS_DIR/privkey.txt
115 149
 shred -zu $FRAGMENTS_DIR/pubkey.txt
150
+shred -zu $FRAGMENTS_DIR/backup_privkey.txt
151
+shred -zu $FRAGMENTS_DIR/backup_pubkey.txt
116 152
 
117 153
 KEY_SHARES=$((KEY_FRAGMENTS * 2))
118 154
 gfsplit -n $KEY_FRAGMENTS -m $KEY_SHARES $KEYS_FILE