========================================== Set up your passphrase for your Gnuk Token ========================================== Terminology =========== In the OpenPGPcard specification, there are two passwords: one is user-password and another is admin-password. In the specification, user-password is refered as PW1, and admin-password is refered as PW3. Besides, there is reset code, which enable a user to reset PW1. Note that people sometimes use different words than "password" to refer same thing, in GnuPG and its applications. For example, the output explained above includes the word "PIN" (Personal Identification Number), and the helper program for input is named "pinentry". Note that it is OK (and recommended) to include characters other than digits for the case of OpenPGPcard. Besides, some people sometimes prefer the word "passphrase" to "password", as it can encourage to have longer string, but it means same thing and it just refer user-password or admin-password. Set up PW1 and PW3 ================== Invoke GnuPG with the option ``--card-edit``. :: Reader ...........: 234B:0000:FSIJ-1.2.0-87193059:0 Application ID ...: D276000124010200FFFE871930590000 Version ..........: 2.0 Manufacturer .....: unmanaged S/N range Serial number ....: 87193059 Name of cardholder: Yutaka Niibe Language prefs ...: ja Sex ..............: male URL of public key : http://www.gniibe.org/gniibe-20150813.asc Login data .......: gniibe Signature PIN ....: not forced Key attributes ...: ed25519 cv25519 ed25519 Max. PIN lengths .: 127 127 127 PIN retry counter : 3 3 3 Signature counter : 0 Signature key ....: 249C B377 1750 745D 5CDD 323C E267 B052 364F 028D created ....: 2015-08-12 07:10:48 Encryption key....: E228 AB42 0F73 3B1D 712D E50C 850A F040 D619 F240 created ....: 2015-08-12 07:10:48 Authentication key: E63F 31E6 F203 20B5 D796 D266 5F91 0521 FAA8 05B1 created ....: 2015-08-12 07:16:14 General key info..: pub ed25519/E267B052364F028D 2015-08-12 NIIBE Yutaka sec> ed25519/E267B052364F028D created: 2015-08-12 expires: never card-no: FFFE 87193059 ssb> cv25519/850AF040D619F240 created: 2015-08-12 expires: never card-no: FFFE 87193059 ssb> ed25519/5F910521FAA805B1 created: 2015-08-12 expires: never card-no: FFFE 87193059 gpg/card> It shows the status of the card (as same as the output of ``gpg --card-status``). Then, GnuPG enters its own command interaction mode. The prompt is ``gpg/card>``. Firstly, I change PIN of card user from factory setting (of "123456"). Note that, by only changing user's PIN, it enables "admin less mode" of Gnuk. "Admin less mode" means that admin password will become same one of user's. That is, PW1 = PW3. Note that *the length of PIN should be more than (or equals to) 8* for "admin less mode". :: gpg/card> passwd gpg: OpenPGP card no. D276000124010200FFFE871930590000 detected Please enter the PIN Enter PIN: 123456 New PIN Enter New PIN: New PIN Repeat this PIN: PIN changed. The "admin less mode" is Gnuk only feature, not defined in the OpenPGPcard specification. By using "admin less mode", it will be only a sigle password for user to memorize, and it will be easier if a token is used by an individual. (If you want normal way ("admin full mode" in Gnuk's term), that is, user-password *and* admin-password independently, please change admin-password at first. Then, the token works as same as OpenPGPcard specification with regards to PW1 and PW3.) Set up of reset code (optional) =============================== Lastly, we can setup reset code, entering admin mode. Having reset code, we can unblock the token when the token will be blocked (by wrong attempts to entering passphrase). Note that this is optional step. When reset code is known to someone, that person can try to guess your passphrase of PW1 more times by unblocking the token. So, I don't use this feature by myself. If we do, here is the interaction. :: gpg/card> admin Admin commands are allowed gpg/card> passwd gpg: OpenPGP card no. D276000124010200FFFE871930590000 detected 1 - change PIN 2 - unblock PIN 3 - change Admin PIN 4 - set the Reset Code Q - quit Your selection? 4 gpg: 3 Admin PIN attempts remaining before card is permanently locked Please enter the Admin PIN Enter Admin PIN: New Reset Code Enter New PIN: New Reset Code Repeat this PIN: Reset Code set. 1 - change PIN 2 - unblock PIN 3 - change Admin PIN 4 - set the Reset Code Q - quit Your selection? q Then, I quit. :: gpg/card> quit That's all in this step.