Using a hardware GPG key with dom0

User Support General
1

oops, What I should have done, duckduckgo, search

qubes documentation, hardware gpg key , how to use with dom0

Which leads to:

To use a hardware GPG key with dom0 in Qubes OS, you need to attach the USB device to a disposable VM and then run the necessary GPG commands within that VM. This allows you to securely manage your GPG keys without exposing dom0 directly to the hardware. Make sure to use the command qvm-usb attach to connect the device to the disposable VM.

ajmartinez.com Read the Docs

Using a Hardware GPG Key with dom0 in Qubes OS

To securely use a hardware GPG key with dom0 in Qubes OS, follow these steps:

Step-by-Step Instructions

  1. Attach the USB Device
    Use the command to attach your hardware GPG key to a disposable VM:
qvm-usb attach <disposable-vm-name> <usb-device>
  1. Access the Disposable VM
    Open the disposable VM where the USB device is attached.
  2. Run GPG Commands
    Inside the disposable VM, you can run GPG commands to manage your keys. For example, to check the status of the GPG card, use:
gpg --card-status

Important Notes

  • Security: This method keeps dom0 secure by isolating the hardware interaction within a disposable VM.
  • Disposable VMs: These VMs are ephemeral, meaning they do not retain data after they are closed, enhancing security.

Example Command Usage

Command Description
qvm-usb attach disp4632 sys-usb:2-1 Attaches the USB GPG key to the disposable VM named disp4632.
gpg --card-status Displays the status of the GPG card in the disposable VM.

By following these steps, you can effectively use your hardware GPG key with dom0 while maintaining the security features of Qubes OS.

doc.qubes-os.org ajmartinez.com

Explore More

I need to drink more coffee before writing.

2

That’s not what @hewhois is asking. But it leads me to another question, why duckduckgo gave you this link:

https://parulin-qubes-doc.readthedocs.io/en/tutorials/project-security/security-pack.html

…instead of the official one? :grimacing: I can’t reproduce with the same search.

3

I have had no problem using my hardware key in non-dom0, to achieve which I simply need to qvm-usb attach. Using the hardware key in dom0 directly seems to be a bad idea, because I will need additional software for it, so I never tried that.

Anyway, it’s not what I wanted to ask. I wanted to ask why split gpg forbids key certification by design and alternative way to do that, since it’s forbidden.

5

no offense meant.