Document how to bootstrap keychain for an organization #23
scjudd
Loading…
Reference in New Issue
No description provided.
Delete Branch "%!s(<nil>)"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
From the "Trusted Keys" section of the provisioner docs:
Setting up this repository and, more importantly, creating and distributing these keys is something that could definitely be spelled out more. I'm certain there's some documentation around for getting PGP + YubiKeys set up, but we should make sure that this documentation doesn't assume that each individual user is equipped to provision a key on their own, unless that can be made very simple/mechanical.
If necessary, part of this could be a ceremony where technical users are to help less-technical users get their keys set up. There are at least two technical people who could provide some sort of oversight over each other.
Maybe this can happen simultaneously to a Root Entropy derivation ceremony? That documentation is also
TODOin the provisioner doc currently; but if that involves operators being together with an airgap machine ready, maybe it makes sense to use that opportunity to build a keychain and distribute YubiKeys.The keychain repository is just a git repo which has rules around how keys can be added to it. The derivation of the keys themselves is a separate concern. There are now documents for both:
Meeting in person to verify each others keys is ideal, but if necessary it can be done remotely. I wrote initial drafts for the docs above, but we can expand them as you see fit.
Just as a side not, if you want to derive all your PGP keys for the org using the same root entropy, you can do that, and I'm happy to write out docs for that, but as of right now I wrote out guides for generating keypairs on a YubiKey, and generating a keyfork mnemonic backed-up PGP keypair, seeded to multiple smart cards. Let me know what path you would prefer to take please.
@scjudd waiting for your feedack on this, otherwise feel free to close.
I'm working on a doc that specifies steps on how to go from nothing to initial set of PGP keys, along with a airgapped machine bundle (laptop, sd card, etc.)