1 |
commit: fd51ab71f9ae4493ea25f012d622e0c92e0e1d82 |
2 |
Author: Michał Górny <mgorny <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Jul 7 05:52:08 2018 +0000 |
4 |
Commit: Michał Górny <mgorny <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Jul 29 20:07:26 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/data/glep.git/commit/?id=fd51ab71 |
7 |
|
8 |
glep-0063: Remove gpg.conf bits |
9 |
|
10 |
Remove the gpg.conf bits from recommended and minimal specification. |
11 |
Apparently they are seriously obsolete and worse than the modern |
12 |
defaults. While at it, editorial corrections to 'SHA2' bit. |
13 |
|
14 |
Requested-by: Richard Yao <ryao <AT> gentoo.org> |
15 |
|
16 |
glep-0063.rst | 60 +++++++++-------------------------------------------------- |
17 |
1 file changed, 9 insertions(+), 51 deletions(-) |
18 |
|
19 |
diff --git a/glep-0063.rst b/glep-0063.rst |
20 |
index 37b1f4d..84d87d2 100644 |
21 |
--- a/glep-0063.rst |
22 |
+++ b/glep-0063.rst |
23 |
@@ -42,6 +42,9 @@ v2 |
24 |
The ``gpgfingerprint`` LDAP field has been altered to remove optional |
25 |
whitespace. |
26 |
|
27 |
+ The ``gpg.conf`` contents have been removed as they were seriously |
28 |
+ outdated and decreased security over the modern defaults. |
29 |
+ |
30 |
v1.1 |
31 |
The recommended RSA key size has been changed from 4096 bits |
32 |
to 2048 bits to match the GnuPG recommendations [#GNUPG-FAQ-11-4]_. |
33 |
@@ -73,10 +76,8 @@ This section specifies obligatory requirements for all OpenPGP keys used |
34 |
to commit to Gentoo. Keys that do not conform to those requirements can |
35 |
not be used to commit. |
36 |
|
37 |
-1. SHA2-series output digest (SHA1 digests internally permitted), |
38 |
- 256bit or more:: |
39 |
- |
40 |
- personal-digest-preferences SHA256 |
41 |
+1. SHA-2 series output digest (SHA-1 digests internally permitted), |
42 |
+ at least 256-bit. |
43 |
|
44 |
2. Signing subkey that is different from the primary key, and does not |
45 |
have any other capabilities enabled |
46 |
@@ -102,58 +103,15 @@ The developers should follow those practices unless there is a strong |
47 |
technical reason not to (e.g. hardware limitations, necessity of replacing |
48 |
their primary key). |
49 |
|
50 |
-1. Copy ``/usr/share/gnupg/gpg-conf.skel`` to ``~/.gnupg/gpg.conf``, append |
51 |
- the following block:: |
52 |
- |
53 |
- keyserver pool.sks-keyservers.net |
54 |
- |
55 |
- emit-version |
56 |
- |
57 |
- default-recipient-self |
58 |
- |
59 |
- # -- All of the below portion from the RiseUp.net OpenPGP best practices, and |
60 |
- # -- many of them are also in the Debian GPG documentation. |
61 |
- |
62 |
- # when outputting certificates, view user IDs distinctly from keys: |
63 |
- fixed-list-mode |
64 |
- |
65 |
- # long keyids are more collision-resistant than short keyids (it's trivial to make a key |
66 |
- # with any desired short keyid) |
67 |
- # NOTE: this breaks kmail gnupg support! |
68 |
- keyid-format 0xlong |
69 |
- |
70 |
- # when multiple digests are supported by all recipients, choose the strongest one: |
71 |
- personal-digest-preferences SHA512 SHA384 SHA256 SHA224 |
72 |
- |
73 |
- # preferences chosen for new keys should prioritize stronger algorithms: |
74 |
- default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed |
75 |
- |
76 |
- # If you use a graphical environment (and even if you don't) you should be using an agent: |
77 |
- # (similar arguments as https://www.debian-administration.org/users/dkg/weblog/64) |
78 |
- use-agent |
79 |
- |
80 |
- # You should always know at a glance which User IDs gpg thinks are legitimately bound to |
81 |
- # the keys in your keyring: |
82 |
- verify-options show-uid-validity |
83 |
- list-options show-uid-validity |
84 |
- |
85 |
- # include an unambiguous indicator of which key made a signature: |
86 |
- # (see http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234) |
87 |
- # (and http://www.ietf.org/mail-archive/web/openpgp/current/msg00405.html) |
88 |
- sig-notation issuer-fpr@×××××××××××××××××××××××××××××××.net=%g |
89 |
- |
90 |
- # when making an OpenPGP certification, use a stronger digest than the default SHA1: |
91 |
- cert-digest-algo SHA256 |
92 |
- |
93 |
-2. Primary key and the signing subkey are both of type RSA, 2048 bits |
94 |
+1. Primary key and the signing subkey are both of type RSA, 2048 bits |
95 |
(OpenPGP v4 key format or later) |
96 |
|
97 |
-3. Key expiration renewed annually to a fixed day of the year |
98 |
+2. Key expiration renewed annually to a fixed day of the year |
99 |
|
100 |
-4. Create a revocation certificate & store it hardcopy offsite securely |
101 |
+3. Create a revocation certificate & store it hardcopy offsite securely |
102 |
(it's about ~300 bytes). |
103 |
|
104 |
-5. Encrypted backup of your secret keys. |
105 |
+4. Encrypted backup of your secret keys. |
106 |
|
107 |
Gentoo LDAP |
108 |
=========== |