shombando/keyoxidizer

Keyoxidizer - Interactive Keyoxide helper

Keyoxidizer - Interactive Keyoxide helper

Objective

This is a simple utility designed to make working with Keyoxide easier. Keyoxidizer guides the user with prompts to gather their (name, email, etc.) and then handles all the details to generate the PGP key and exports it to OpenPGP key server. It will then guide the user in proving ownership their online accounts supported by Keyoxide. Keyoxide will also guide the user through viewing and modifying the proofs (notations) in their key. This is an unofficial helper around Keyoxide but it does not (and may never) support all Keyoxide features. The goal is to lower the barrier to entry so this will remain a single file utility and have no external dependencies aside from bash and gpg.

Security and Privacy

The author is not an authority on security or privacy, please use at your own risk. The current default option will generate a key with a single sub-key both using ed25519 curve, I believe this to be the best option for general usage at this point (2024). However, if you want to generate multiple sub-keys or change other security options, please generate key outside of this script and use this script. If you want to hash your proofs then please consult this Keyoxide blog post. Please take a look at the discussion here for further information and feedback from the community.

Usage

Option 1

Clone the repo. Run the script.

git clone [email protected]:shombando/keyoxidizer.git
cd keyoxidizer
./keyoxidizer.sh

Option 2

Download the keyoxidizer.sh script and put it in a keyoxidizer folder (recommended) and open a terminal window in that location, change the file permission to make it executable and then run it:

chmod +x ./keyoxidizer.sh
./keyoxidizer.sh

The releases link on Github and Codeberg will contain tagged versions with change logs. However, downloading the script from the repo root is recommended since it will be most up to date version with latest bug fix.

Features

• Generate new key pairs
• Load existing key
• Add proofs for Supported Platforms
• List proofs
• Delete proofs (currently requires pasting a command and typing “save” see issue 1)

Supported Platforms

1. Domain/DNS (note: sometimes DNS records take some time to update)
2. Gitea
3. Github
4. Gitlab
5. Mastodon
6. Twitter
7. Reddit
8. Hackernews
9. dev.to
10. IRC
11. Matrix

Roadmap

• Incrementally add support for adding proofs to the supported service providers. They will be listed under the Supported Platforms sections.
• List and delete proofs - done but delete is a bit tedious
• Setup a build pipeline to automate releases for a tagged release.
• Additional security and privacy options.

Contributing

I absolutely welcome feedback in the form of PRs, whether it is improving my shell scripting or adding new functionality. A few guidelines to help me out:

• each PR should be focused on a single aspect (add functionality / improve existing functionality)
• draft PRs are encouraged so we can collaborate better
• if you’re refactoring please explain the changes so I can learn from it

keyoxidizer's Issues

Hash identity proofs

fyi, https://blog.keyoxide.org/hashing-identity-proofs/

Remove bashisms

In order to be more compatible with several operating systems (not all UNIX-like systems have a bash installed), it might be a good idea to get rid of the bashisms and set the shebang to /bin/sh instead. As far as I can see, there is no functionality that would need to be removed:

• echo -e does not seem to be necessary where it occurs -> remove the -e
• read -p would need to be rewritten as printf "some text" ; read -r
• $(...) - inconsequently used in this script anyway - should be replaced with backticks
• the [[ var == text ]] syntax only needs minor changes

The benefit from this would be that nobody would need to use a bash with all of its dependencies -> even lower entry point.

Don't publish "auth" subkeys

Use s.th. like gpg --export-filter "drop-subkey=usage=a" --export ... instead of:

keyoxidizer/keyoxidizer.sh

Line 55 in ff73ee3

gpg --export $keyoxidizer_email | \

GPG remove notation piping in input failing due to control character

GPG doesn't provide unattended notation manipulation capabilities through the cli to my knowledge. While "interactively" sending the notation information works for GPG during adding a notation. GPG rejects deleting the notation since it has to be sent with a control character and GPG has no knowledge that I'm not trying to add this notation. I've not been able to escape the "-" to sneak it past.

The function called deleteNotation is intended to interact with GPG and edit a key to remove a notation. This function is setup exactly the same addNotation^refactor which works just fine. The relevant snippet is here where removeNotation just prepends a "-" to the notation string:

   removeNotation="-$1"
   {
      echo notation
      echo $removeNotation
      echo save
   } | gpg --command-fd=0 --status-fd=1 --edit-key $fingerPrint

The relevant commit is: 5489d68

Here's the output and error:

gpg (GnuPG) 2.2.19; Copyright (C) 2019 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

[GNUPG:] REMOVED THE KEY INFO THAT IS PRINTED

[GNUPG:] GET_LINE keyedit.prompt
[GNUPG:] GOT_IT
[GNUPG:] GET_LINE keyedit.add_notation
[GNUPG:] GOT_IT
gpg: a notation value must not use any control characters

[GNUPG:] GET_LINE keyedit.prompt
[GNUPG:] GOT_IT
Key not changed so no update needed.

I'm opening this issue to seek help from the community.

[refactor]: after this issue is resolved the idea is to refactor to a single modifyNotation function.

Keypair generation not following best practice

Your script creates a keypair which doesn't follow best practice:

pub   rsa3072 2022-11-18 [SCEA] [expires: 2024-11-17]
      853CD87C75BB8597EE443A1763A85AA18D2BCF61
uid           [ultimate] first last (key of first last) <[email protected]>
sub   rsa3072 2022-11-18 [SEA] [expires: 2024-11-17]

This is how a rsa3072 based key should look like (IMO):

pub   rsa3072 2022-11-18 [C] [expires: 2023-01-01]
      42D60F0629CDEF77425A2BE347603971D8A86E34
uid           [ultimate] first last (key of first last) <[email protected]>
sub   rsa3072 2022-11-18 [S] [expires: 2023-01-01]
sub   rsa3072 2022-11-18 [E] [expires: 2023-01-01]
sub   rsa3072 2022-11-18 [A] [expires: 2023-01-01]

In general, I recommend Curve25519 over all other algorithms if hardware limitations don't speak against it.

I have this scripted here:
https://github.com/duxsco/gpg-smartcard#create-a-gnupg-keypair

FYI:
https://dev.gnupg.org/T4514