Generate a PQC signing key

Generate an OpenPGP v6 signing key with ML-DSA-65/Ed25519 hybrid cipher suite using sequoia-pgp.

Before you begin

You have accessed the automation hub API container and are running commands as the root user inside the temporary container.

About this task

The sequoia-pgp key generation process creates both a private signing key and its matching public certificate. The key is configured for signing only and uses quantum-resistant algorithms.

Procedure

  1. Generate the PQC signing key and initialize the sequoia keystore.

    • Create the key with password protection (recommended for production):

      sq key generate \
  --new-password-file /run/secrets/$SQ_SECRET \
  --cannot-encrypt \
  --cannot-authenticate \
  --home /var/lib/pulp/certs/sequoia  \
  --profile rfc9580 \
  --cipher-suite mldsa65-ed25519 \
  --own-key \
  --name "Alice Smith" \
  --email "<your-email>@example.com"

      Replace Alice Smith and <your-email>@example.com with your actual user ID and email address.

    • Create the key without password protection (for testing only):

      sq key generate \
  --cannot-encrypt \
  --cannot-authenticate \
  --home /var/lib/pulp/certs/sequoia  \
  --profile rfc9580 \
  --cipher-suite mldsa65-ed25519 \
  --own-key \
  --name "Alice Smith" \
  --email "<your-email>@example.com"

      Replace Alice Smith and <your-email>@example.com with your actual user ID and email address.

    Key parameter descriptions:

    • --cannot-encrypt, --cannot-authenticate: Create a signing-only key by removing encryption and authentication capabilities.
    • --profile rfc9580, --cipher-suite mldsa65-ed25519: Configure Post-Quantum Cryptography signature algorithm using OpenPGP v6 standard.
    • --own-key: Mark the key as trusted in the Sequoia local keystore.
    • --new-password-file: Specify password file location for password-protected keys.
  2. If you created a password-protected key, copy the password file to the Pulp volume. 
    cp /run/secrets/$SQ_SECRET /var/lib/pulp/certs/$SQ_SECRET
  3. Verify the key was created successfully. 
    sq cert list --home /var/lib/pulp/certs/sequoia <your-email>

    Replace <your-email> with the email address you used when generating the key.

  4. Copy the key fingerprint from the output and export it as an environment variable. 
    export FINGERPRINT="<your-key-fingerprint>"

    Replace <your-key-fingerprint> with the actual fingerprint displayed in the previous command output.

Results

You have generated a PQC signing key and stored its fingerprint for use in subsequent configuration steps.

What to do next

Export the public key certificate for distribution to systems that will verify signatures.