linuxboot / linuxboot/heads-wiki
How to use existing keys on a YubiKey with a fresh install
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 96
- Forks
- 58
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 11
Description
From https://github.com/osresearch/heads/pull/1282:
> It's not obvious how to store your private keys on a YubiKey. `OEM Factory Reset / Re-Ownership -->` is NOT your friend. Instead, you want to go under `GPG Options -->` → `Add GPG key to running BIOS and reflash`, which will prompt you to insert a USB drive containing your GPG public key. Then, the next time you select `Update checksums and sign all files in /boot`, Heads will prompt you to insert your GPG smartcard.
`OEM Factory Reset / Re-Ownership -->` will generate keys on the device, OR, will prompt you to generate keys on a hardware token which led me to accidentally wipe my YubiKey.
I'm imagining some sort of guided menu that asks "Would you like to use an existing GPG key pair?" And then walks the user through flashing their public key to the BIOS, etc.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the documented GPG Options → Add GPG key to running BIOS and reflash path, the OEM Factory Reset / Re-Ownership menu, and the workflow quoted from PR #1282. Done means the documentation or guided flow clearly explains how to use an existing key pair without accidentally generating or wiping keys.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100