9

I read here that with the new firmware, a trezor can be used to generate GPG signatures. How does that work? Is there a tutorial? I didn't see anything on the satoshi labs website.

Improve this question

2 Answers 2

Reset to default
8

GPG Keys "TREZOR can now securely generate GPG keys for signing of emails or documents (using the NIST256P1 and Ed25519 curves). Currently, this update does not allow for GPG decryption, a feature planned for next firmware update. For more information check out the great TREZOR Agent by Roman Zeyde."

https://medium.com/@satoshilabs/trezor-firmware-1-3-6-20a7df6e692#.9nmckr4yh

Complete instructions can be found here:

https://github.com/romanz/trezor-agent/blob/master/README-GPG.md

Generate a new GPG identity:

$ trezor-gpg create | gpg2 --import # use the TREZOR to confirm signing the primary key

gpg: key 5E4D684D: public key "John Doe " imported

gpg: Total number processed: 1

gpg: imported: 1

$ gpg2 --edit "${TREZOR_GPG_USER_ID}" trust # set this key to ultimate trust (option #5)

$ gpg2 -k

/home/roman/.gnupg/pubring.kbx

pub nistp256/5E4D684D 2016-06-17 [SC] uid [ultimate] John Doe sub nistp256/A31D9E25 2016-06-17 [E]

Sign and verify GPG messages:

$ echo "Hello World!" | gpg2 --sign | gpg2 --verify

gpg: Signature made Fri 17 Jun 2016 08:55:13 PM IDT using ECDSA key ID 5E4D684D

gpg: Good signature from "Roman Zeyde " [ultimate]"

Improve this answer
1
  • Thanks, this is the right answer so I accepted it but I can't get it to work. Also the README looks a little stale (there is no gpg-agent branch anymore). I just get gpg: can't connect to the agent: IPC connect call failed so I guess I will wait for the next round of dev.
    – user1794469
    Jun 27, 2016 at 2:09
5

(trezor-agent developer here...)

Please take a look at the latest trezor-agent version here. I'd be happy to fix any issue with the documentation, and extend it with more examples to make it more helpful for first-time users :)

EDIT: Make sure to install all the required packages as described here: https://github.com/romanz/trezor-agent/blob/master/INSTALL.md

Improve this answer
2
  • 1
    For the people who aren't used to compile code from the command line, you could perhaps mention that the dev packages of libusb-1.0 and libudev are needed in order to compile the hidapi package (which is part of what happens when you run pip install --user trezor_agent)? In my case, this was the full sequence of commands needed til install it (on Ubuntu 16.04.2 LTS, which is what you get when installing WSL on Win10): sudo apt update sudo apt install python-pip pip install --upgrade pip sudo apt install libusb-1.0-0-dev sudo apt install libudev-dev
    – Martin Lie
    Jul 1, 2017 at 22:24
  • Thanks for the heads-up about the installation procedure :) I have edited my post above.
    – Roman Zeyde
    Aug 4, 2017 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.