hey everybody just wanted to make a quick video about pgp in particular uh an amendment to the security video that i did so bring up my whiteboard real quick okay so if you recall in the video uh we used a two key solution so you had key one and that was a cold key and key two that was a hot key and key two was generated the normal way through either gpa or cleopatra and key one the colt key is generated using a ub key and if you read the ub key documentation real closely if you create a key on the yubi key itself there is only one copy of that private key and that's going to live on the key okay so if you lose that ub key then you don't have any way of restoring that key okay so it's uh not good to lose that the traditional way of generating a key that goes on a ub key is to generate a master key using the normal way that we generated the hotkey and then you use the command line to transfer after you've backed up the master key you use the command line to transfer the ub key to yubikey second here transfer to eb key the pgp keys so you'll have a backed up master key sitting somewhere and it'll have that little dot ase aca sc extension uh and then your ub key will contain the keys that you normally use okay um here's the issue that somebody pointed out over twitter and i checked it myself when i used the cleopatra interface the smart card interface it generates a dot gpg file which is normally an encrypted file and i actually went grab those backups to check real quick and see if i could restore them the normal way like i would restore a asc key and it's able to read a secret key but it for some reason doesn't really want to import that secret key so tomorrow i'm going to send some messages out read the documentation and see what's going on it's a bit confusing the cleopatra interface that clicking backup actually doesn't make a valid backup and i'm sure that there's some kabuki involving maybe you have to use another smart card and you can only restore to another smart card or something it would be pretty crazy if the backup didn't actually produce a backup or else why would they have this option in the cleopatra gui so i'm going to look a little bit into this and if is is the case that this is not usable like an asc file is or you just simply import it then i'm going to reshoot the security video a little bit ahead of schedule i was planning on crowdsourcing recommended solutions and updates and other things to it and then reshooting the video for maybe next month but i'll make some sort of video on pgp to talk about signatures and authentication and encryption and sub keys and uploading the key servers and all these things and due course but just be aware that there may be an issue with recoverability with the video that i made and i just wasn't aware that you apparently can't restore from these backups i assume that this backup here was just simply something that you would import like you would a normal asc file a asc file and you have access to it and then you just simply store these backups on your um apricorns the apricorns are the encrypted flash drives that i told you guys to buy all right so in the meantime uh don't use the ub key and if you've already used it ub key for encryption and you've already gone through the whole thing and you've managed to use it some people have i just decrypt and just use a single encryption with your hotkey that's probably good enough considering that the master password of the hotkey is very strong and while the hotkey is hot and that it lives on one of your computers it's never been transmitted into the cloud okay so still very secure to have a single pgp encryption it just this is the belt and suspenders option and having a hardware key combined with a software key is the gold standard it's okay just to have a single one especially if it's sitting in an area with low access quote low access with strong access control and low ability to be tampered with everything else is good you can still use your uv key for otp or fido u2f hey you know all that stuff that's fine that's completely fine it's a beautiful device still use it for your assault that's fine as well for static passwords and so forth but i'm not just so sure about that i should have double checked and verified that i could restore it i just saw the backup copy and i said okay port this over the file i assume that cleopatra was a little smarter unfortunately cleopatra is not the friendliest of software and it's not um super super easy to use so if you still want to use the ub key then you're going to have to learn how to do a command line port and there's a command called key to card so you're going to type something like gpg dash dash card dash edit and then there's going to be a lot of commands that you can run with that once you're inside the terminal uh and you'll have to basically prime and activate your key that you've already created using cleopatra and then you call the key to card and we'll transfer it there so if you've made a backup then you'll have two copies of it one in the backup and then one that now lives on the eb key and there's plenty of tutorials for this that are online uh that are relatively straightforward and easy to follow the only reason i generated it in the gui was that i saw the option to do a backup and i assumed that okay it should be just like any other pgp backup i'm not sure why i'm having trouble importing that and maybe i'm just missing something i'm used to importing uh these types of files so i'll look into it it's probably something stupid and you know something in the lore of pgp i'm not aware of and i'll let you guys know what comes up in the meantime just use a single layer of encryption or do this and what the commenter pointed out is that it's and he did the right thing it's always good to check if each step works so verify that you can restore from backup always so before you write your private keys down in a permanent storage verify that you can restore your wallet from those private from that key recovery phrase and before you consider your encryption good make sure that you can decrypt the file and before you consider your keys good make sure you can destroy your keys and restore your keys so in order uh do your pgp keys first because they're the basis of your key security and then your wallet recovery phrase and then the encryption and decryption of your wallet recovery phrase but always make sure you can restore from backup and the commenter did try to do this and they ran into that same error that i'm now running into uh and uh there you go and if you guys know how to restore these.gpg when you construct a key in cleopatra from the panel and activate the backup do let me know for some reason i'm just not able to do it it's reading the key and i looked through the documentation i didn't see anything about it unfortunately smart card documentation leaves something to be desired anyway brief video uh just as a a little bit of an amendment uh and i'll shoot a whole video on pgp when i've had some chance to go and read the whole spec again and go through everything again so until next time have a nice day everybody cheers
