Repository navigation
Subrosa - #636
Open
alexgithublab wants to merge 5 commits into
Open
Subrosa#636alexgithublab wants to merge 5 commits into
alexgithublab wants to merge 5 commits into
Conversation
space space space space space
|
The successful documentation build for de975a9 was deployed for preview: generated by workflow run 39269363917 (attempt 1) |
jans23
requested changes
Oct 16, 2026
| GnuPG with Fedora <fedora-gnupg-configuration> | ||
| Change Pins <change-pins> | ||
| Additional Decryption Subkeys (ADSK) with GnuPG <adsk> | ||
| sub rosa <../../../nitrophone/sub-rosa> |
Member
There was a problem hiding this comment.
I suggest a more explanatory name such as "Android app sub rosa"
| Frequently Asked Questions <faq> | ||
| Headwind MDM (HMDM) <hmdm/index> | ||
| FIDO2 on Android / NitroPhone <../nitrokeys/features/fido2/nitrophone> | ||
| sub rosa <sub-rosa> |
| .. product-table:: nk3 pro start storage | ||
|
|
||
|
|
||
| sub rosa allows you to program a static password onto a hardware security key, which can act as a keyboard when touched. |
|
|
||
| Simple: no need to memorize multiple complex passwords. No need to carry multiple devices either — you can program a hardware security key with a password, use it, and then program it with a different password whenever needed. Nowadays, hardware security keys come in various form factors: from models small enough to remain in your phone's USB-C port to larger, NFC-enabled keys. | ||
|
|
||
| sub rosa can program an OpenPGP key onto your hardware key, allowing you to encrypt, decrypt, cryptographically sign documents, or authenticate to remote servers via SSH. An OpenPGP key acts as your digital identity. |
|
|
||
| For further information or issue/feature proposal, please refer to the source repository `here <https://github.com/naive-HA/subrosa>`__. | ||
|
|
||
| Install sub rosa |
|
|
||
| In the source repository `here <https://github.com/naive-HA/subrosa>`__. | ||
|
|
||
| Supported Features |
| :width: 100% | ||
|
|
||
|
|
||
| Use Your Security key for SSH Authentication |
Comment on lines
+169
to
+258
| When generating a new OpenPGP key with OpenKeychain, select **Change key configuration** and **add an Authentication subkey**. | ||
| Then import this OpenPGP key into sub rosa and write it to your security key. | ||
|
|
||
| On a clean Debian machine, ensure all required packages are installed: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| sudo apt update | ||
| sudo apt install openssh-client gnupg scdaemon pinentry-curses pcscd | ||
|
|
||
| Identify where ``pinentry`` is installed: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| which pinentry | ||
|
|
||
| The output should look similar to: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| /usr/bin/pinentry | ||
|
|
||
| Take note of that path, then configure ``gpg-agent`` to enable SSH support and use that ``pinentry`` binary: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| echo "enable-ssh-support" > ~/.gnupg/gpg-agent.conf | ||
| echo "pinentry-program /usr/bin/pinentry" >> ~/.gnupg/gpg-agent.conf | ||
|
|
||
| Restart the agent to apply the configuration: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| gpgconf --kill gpg-agent | ||
| gpgconf --launch gpg-agent | ||
| gpgconf --list-dirs agent-ssh-socket | ||
|
|
||
| This should output a path like: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| /run/user/1000/gnupg/S.gpg-agent.ssh | ||
|
|
||
| Note this path and add it to your ``~/.ssh/config``: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| echo "Host *" > ~/.ssh/config | ||
| echo " IdentityAgent /run/user/1000/gnupg/S.gpg-agent.ssh" >> ~/.ssh/config | ||
|
|
||
|
|
||
| .. note:: | ||
| Be sure to replace ``/run/user/1000/gnupg/S.gpg-agent.ssh`` with the actual path output on your system. | ||
|
|
||
| Now query the security key: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| gpg-connect-agent "scd learn --force" /bye | ||
|
|
||
| This displays details of the OpenPGP key written to your security key. The output will look similar to: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| S KEYPAIRINFO 5BBF795A5F93498C2FF6C6CD3ABF896302DC9FA0 OPENPGP.1 sc 1782525925 ed25519 | ||
| S KEYPAIRINFO D1B359A6A77A68B1776ABFA085E65AFA1582E6D6 OPENPGP.2 e 1782525925 cv25519 | ||
| S KEYPAIRINFO 36F40BE75662CEA929402AAA360A64F448E35ABB OPENPGP.3 a 1782525925 ed25519 | ||
| OK | ||
|
|
||
| To configure SSH to use the authentication key, add its keygrip to ``~/.gnupg/sshcontrol``: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| echo "36F40BE75662CEA929402AAA360A64F448E35ABB" >> ~/.gnupg/sshcontrol | ||
| gpgconf --kill gpg-agent | ||
| export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) | ||
| ssh-add -L | ||
|
|
||
| .. note:: | ||
| Replace ``36F40BE75662CEA929402AAA360A64F448E35ABB`` with the keygrip of your specific Authentication subkey (the line ending in ``a``). | ||
|
|
||
| The ``ssh-add -L`` command should display your public key card identifier, for example: | ||
|
|
||
| .. code-block:: bash | ||
|
|
||
| ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGfZlzyF4mwdtAnUNJVz1TxOkotdHNizIaA56IOepfA/ cardno:000F_D52FD320 | ||
|
|
||
| Copy this line and add it to ``~/.ssh/authorized_keys`` on your remote server. | ||
|
|
||
| When logging into your remote server via SSH, you will be prompted for a PIN. This is the **User PIN** (default: ``123456``), not the Admin PIN (default: ``12345678``). |
Member
There was a problem hiding this comment.
Numbered steps give a better overview.
alexgithublab
force-pushed
the
subrosa
branch
from
October 19, 2026 14:04
e91dc5d to
c53bb91
Compare
alexgithublab
force-pushed
the
subrosa
branch
from
October 19, 2026 14:25
c53bb91 to
9f04e10
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
the name in the index files needs to be changed to something more understandable