Keeping (some information of) gpg --card-status private

[Werner Koch]

Hi!

It is right that OpenPGP has wildcard keyids and thus I understand that
you want something similar for the smartcard.  However, there are
practical problems with that.  The only case were this could work
smoothly is that you have exactly _one smartcard_ and use it it only for
_one device_: You know which smartcard to insert for the device.  Now
consider what happens if you have several smartcards: You device will
request that you insert the smartcard - you enter the PIN and the device
will either "unlock" or throw and error.  Then you need to use the
second card and so on.  This will be quite annoying.

One of the best features in GnuPG we introduced recently was the support
to work with several plugged in smartcards - it makes life much easier.
Of course this requires some identification of the keys on the card to
make sense.

We have lot of experience with the OpenPGP wildcard keyids
(--throw-keyid) and it can quickly turn out to be annoying exercise to
decrypt something if you have several keys or worse several smartcards:
gpg needs to do a lot of trial decryptions and you need to swap
smartcards like we swapped floppies back then when we installed Netware
3.0.

If you want to hide which key was used to encrypt a partition you can
use --throw-keyid and gpg will already ask you to start entering
passphrases and swapping smartcards.  I am not sure whether LUKS offers
this option because I use g13 which supports this.
 

Shalom-Salam,

   Werner


-- 
#  Please read:  Daniel Ellsberg - The Doomsday Machine  #
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20180728/0c104987/attachment-0001.sig>