8

I want to generate a QR code of my 4096-bit armored GPG private key. The key is so big, the program qrencode seems to fail because of its size.

$ gpg --export-secret-keys --armor > ~/private.key
$ ./qrencode -o test.png < ~/private.key

Result:

Failed to encode the input data: Numerical result out of range

How can I make that happen? Are there alternative programs to qrencode which can handle a very big GPG key? I want to print it on paper as this security.SE question suggested.

The comments of @geruetzel and @ cuonglm are addressing this version of my question.

Improve this question
5
  • Remove <, the command is qrencode -o test.png -t png "$( cat private.key)" – cuonglm Apr 30 '16 at 15:53
  • @cuonglm sry, didn't realize that mistake. I updated my answer. – toogley Apr 30 '16 at 16:10
  • i have updated my answer – geruetzel Apr 30 '16 at 17:00
  • 2
    are you coming up against the designed size limit for QR codes? consider searching down to "Maximum character storage capacity" on the wikipedia page: en.wikipedia.org/wiki/QR_code – Theophrastus Apr 30 '16 at 17:03
  • @Theophrastus i just found it out myself. – toogley Apr 30 '16 at 17:04
8

Your error message already gives a hint as to what's wrong!

Your one-liner is providing the actual file content as filename to the qrencode program. Hence the error message.

Try qrencode -o test.png -t png < private.key.

You should take a look at shell input-output redirection. For example, I/O Redirection.

I see that you too have found your way to the developers GitHub repository of qrencode :) There is an explanation why a 4096-bit key cannot be encoded as a QR code:

qrencode is encoding your private GPG key as 8 bit (binary|utf-8), because the key is not pure alphanumeric. It contains special character. the alphanumeric mode only supports those special character .(%*+-./:). So the maximum GPG key can only be 2953 char long.


From https://github.com/fukuchi/libqrencode/issues/31

Improve this answer
1
  • Sry, i didn't realize it that - but still It seems that my gpg key is too big for Qrencode. (I updated my answer to address that issue) – toogley Apr 30 '16 at 16:07
8

The key could not be encoded as a single QR code. But two (or more) could work.

  • Export your key (as before):

    gpg --export-secret-keys --armor > private.key

  • Generate files of a maximun size of 2500 byte:

    split -C 2500 private.key splitkey-

  • Convert each to one QR file (same name with extension .qr)

    for file in splitkey-??; do
    <"$file" qrencode -s 3 -d 150 -o "$file".qr
done

When it is needed to recover the key. You can scan each QR code which will each produce an string. Just concatenate each string in sequence of the filenames. Lets assume that the result key is stored in the file newkey.

And you may test that the internal CRC-24 of the key checks out.

 gpg --dearmor newkey >/dev/null

If there is no error message, the key file has been reconstructed correctly.

Improve this answer
3
  • This is what I was thinking also, why not split the key into three pieces, then create three qr codes that can be scanned and reassembled. – J363 May 3 '16 at 12:20
  • 1
    Why do you specify the dpi in the qrencode command? I'm curious what purpose that serves. Is it necessary? – malan88 Jan 1 '19 at 21:14
  • Just FYI for future readers, 2500 might be sufficiently small to generate the a QR code, but a QR code that dense is very hard to scan with a phone. It's probable that you can still read it by taking a picture and running it through a command line utility like those found in the arch aur but most android apps will have trouble with it. It's not too much more work to set the byte limit to 1000 on the split operation and just generate a few more QR codes. Then it scans like a dream. – malan88 Jan 1 '19 at 22:38
3

I just found out that this is not possible.

% wc -c ~/private.key
6709 /home/toogley/private.key

(-c counts characters.)

to cite from wikipedia:

max characters for alphanumerical characters: 4,296.

Improve this answer
1
  • 1
    Yes and even this limit does not apply to your key - see my answer's update! – geruetzel Apr 30 '16 at 17:34
2

You may be interested in paperkey, which is designed to take a GPG secret key, and transform it into a sequence of bytes that can be printed out on paper. The secret key can be subsequently recovered from the text after scanning it or keying it in.

There's also a discussion of various ways of archiving data on paper which you might find interesting.

Improve this answer
2

I suggest that you minimize your key before encoding it.

gpg --export --export-options export-minimal

Depending on how you've used your key in the past, it may save you old binding signatures.

Improve this answer
1

If you pass the options -Sv40 (40 is a version), qrencode will automatically create multiple images for input that's too large. For example:

qrencode -o private.png -t png -Sv 40 < private.key

will output private-01.png, private-02.png, and private-03.png.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.