News for hackers. Stuff that matters.
Re:Strategies for offline PGP key storage by Tharre on Thursday October 05, 2017 @10:45AM (#15409561)
How do you check that your printer isn't secretly storing your key somewhere? I've looked for open source/open hardware printers some time ago, unsuccessfully. I've written my main key down on paper by hand as a backup, but it's a tedious task.

As you mentioned fire-resistance, do you also use some sort of fire resistant paper? Because I don't think anything in made of paper would survive an actual fire.

Re:Strategies for offline PGP key storage by dom0 on Thursday October 05, 2017 @10:46AM (#15409569)
> I've looked for open source/open hardware printers some time ago

You want a pen plotter. Or its cheaper, more expensive cousin, the Axidraw.

> As you mentioned fire-resistance, do you also use some sort of fire resistant paper? Because I don't think anything in made of paper would survive an actual fire.

Actually there are document safes with built-in insulation which will keep regular paper documents safe for time X under fire conditions Y (it's some EU standard classification). Certain ways of mounting safes makes them intrinsically fire-safe(r) as well.

Re:Strategies for offline PGP key storage by graedus on Thursday October 05, 2017 @12:28PM (#15410448)
> cheaper, more expensive

Huh. It's cheaper (worse quality) but costs more money?

Re:Strategies for offline PGP key storage by dom0 on Thursday October 05, 2017 @08:54PM (#15413710)
Vintage pen plotters (or X-Y recorders) are essentially zero-price items and tend to be built like actual tanks. The ones you can buy today (and afford) are way more expensive than them, yet cheaper (in quality). However, vintage pen plotters tend to not have USB plugs.
Re:Strategies for offline PGP key storage by xelxebar on Thursday October 05, 2017 @03:28PM (#15411921)
I was confused too, so looked up the prices. The pen plotter seems to be in the neighborhood of $225 USD [1] while the AxiDraw is $475 USD [2].

[1] https://www.amazon.com/pen-plotter/s?ie=UTF8&page=1&rh=i%3Aa...

[2] https://shop.evilmadscientist.com/productsmenu/846

Re:Strategies for offline PGP key storage by cuckcuckspruce on Thursday October 05, 2017 @02:42PM (#15411554)
I took it as cheaper to purchase, more expensive to operate.
Re:Strategies for offline PGP key storage by unkown-unknowns on Friday October 06, 2017 @01:05AM (#15414557)
Speaking of plotters, consider engraving the QR code in aluminum instead of having it on paper. If there's any hacker space nearby where you live they might have CNC equipment that they will let you borrow and instruct you how to use.
Re:Strategies for offline PGP key storage by zokier on Thursday October 05, 2017 @01:03PM (#15410709)
> I've written my main key down on paper by hand as a backup, but it's a tedious task.

Elliptic curves are nice because they allow short keys, for example curve25519 uses 32 byte keys that are pretty reasonable to copy manually (44 base64 chars or 64 hexs).

Re:Strategies for offline PGP key storage by jopsen on Thursday October 05, 2017 @10:09PM (#15413960)
Also the keys can be any random secret...

Meaning you could use PBKDF2 of your favorite passphrase as your private key, then keep it in organic memory.

Personally, I would love to see a strategy for generating a private from an analog picture.. But I don't see a good way to do it reliably.. Maybe one could generate it from error correction bits in a QR code.

Re:Strategies for offline PGP key storage by ecesena on Friday October 06, 2017 @01:08PM (#15418377)
I'm not sure you can use a KDF because it requires a salt.

I'm working on a blog post on deterministic passwords (i.e. not keys for ECC), but I guess that if you really want determinism you can do something similar, maybe sha3.512 and "cut" a 256-bit ECC key.

This is the post, still a draft. Hopefully I'll publish it next week, but if you have any comments, they are more than welcome! https://medium.com/@0x0ece/how-i-manage-my-passwords-technic...

Re:Strategies for offline PGP key storage by zokier on Friday October 06, 2017 @11:50AM (#15417731)
> Personally, I would love to see a strategy for generating a private from an analog picture.. But I don't see a good way to do it reliably.. Maybe one could generate it from error correction bits in a QR code

Not clear exactly what you meant, but but deriving a key from a photograph shouldn't be that difficult. A good perceptual hash should work, maybe some preprocessing is needed (straighten/crop/normalize/resize). It helps that the amount of data in an image is absolutely massive compared to typical key size.

Re:Strategies for offline PGP key storage by im3w1l on Thursday October 05, 2017 @04:54PM (#15412506)
For RSA keys shouldn't it be possible to store some 256 bit seed and then use a deterministic algorithm to convert that to a 4096 bit key?
Re:Strategies for offline PGP key storage by ecesena on Friday October 06, 2017 @01:10PM (#15418399)
Prime number generation is typically done like this. Pick a random number, then add 2 until you get a prime.

So you can do something similar. Pick a deterministically generated bit string, and use as key the next prime number (you need to do it twice, for p and q).

You certainly get less security and I unfortunately don't have any reference to quantify that.

As I was saying in another post, I'm writing about deterministic password generation (i.e. not RSA keys). Draft here: https://medium.com/@0x0ece/how-i-manage-my-passwords-technic...

Re:Strategies for offline PGP key storage by icebraining on Thursday October 05, 2017 @06:05PM (#15412920)
Even if there is, such a key would be much less safe (assuming the attacker knew the algorithm, which must be assumed, otherwise why keep the key in a safe?)
Re:Strategies for offline PGP key storage by sigjuice on Thursday October 05, 2017 @01:34PM (#15410923)
Engrave it on stone or etch it on metal or both :)
Re:Strategies for offline PGP key storage by nosuchthing on Thursday October 05, 2017 @07:14PM (#15413284)
M-DISC's are archival grade DVDs/Blurays, and when properly stored M-DISC DVD recordings are claimed to last 1000 years.

https://en.wikipedia.org/wiki/M-disc

Re:Strategies for offline PGP key storage by sigjuice on Thursday October 05, 2017 @09:36PM (#15413846)
I think I have more faith in the people who built the Pyramids than those peddling these fancy optical discs :)
Re:Strategies for offline PGP key storage by digikata on Thursday October 05, 2017 @12:17PM (#15410350)
Encrypt before sending it to QR code?
Re:Strategies for offline PGP key storage by brandmeyer on Thursday October 05, 2017 @12:28PM (#15410445)
The GPG private key should be password-protected. Its basically symmetric encryption keyed off of the password using something akin to scrypt.
Re:Strategies for offline PGP key storage by digikata on Thursday October 05, 2017 @12:33PM (#15410490)
Oh, then a printer secretly storing that representation of the key doens't matter, correct?
Re:Strategies for offline PGP key storage by Fire-Dragon-DoL on Thursday October 05, 2017 @04:52PM (#15412494)
Can't you buy a 50 printer, print it and destroy it after that?
Re:Strategies for offline PGP key storage by Grollicus on Thursday October 05, 2017 @04:25PM (#15412321)
Of course, because that drastically reduces the key space.

Before: 2^2048, After: 256^20 = 2^160 (when using a 20 key password. Obviously you could use looong random generated passphrases, but then you could just base64encode your key?)

Re:Strategies for offline PGP key storage by palunon on Thursday October 05, 2017 @06:55PM (#15413187)
2^160 is still a massive key space for symetric encryption.

Symetric and asymmetric encryption don't have the same key length standards.

Re:Strategies for offline PGP key storage by oh_sigh on Thursday October 05, 2017 @01:48PM (#15411026)
What's the point of encrypting it? It seems like just another thing to mess up, and much more likely that you'll forget the password versus someone breaks into your house, goes into your safe, and knows what a private key is.