I have a Yubikey Neo and I have reset the GPG card applet so it has no config and no
keys (like a new key).
If I try to generate keys on this card, AND make off-card backup of encryption keys it
*always* fails. Here is an example session. It was doing key generation for about 1
minute:
/tmp/gnupg (master ✔)$ gpg2 --card-edit
Reader ...........: 1050:0116:X:0
Application ID ...: D2760001240102000006030154560000
Version ..........: 2.0
Manufacturer .....: Yubico
Serial number ....: MY_SERIAL_NUM
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
gpg/card> verify
Reader ...........: 1050:0116:X:0
Application ID ...: D2760001240102000006030154560000
Version ..........: 2.0
Manufacturer .....: Yubico
Serial number ....: MY_SERIAL_NUM
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 2 3 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
gpg/card> admin
Admin commands are allowed
gpg/card> generate
Make off-card backup of encryption key? (Y/n) Y
Please note that the factory settings of the PINs are
PIN = '123456' Admin PIN = '12345678'
You should change them using the command --change-pin
Please specify how long the key should be valid.
0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years
Key is valid for? (0) 1
Key expires at Sun Jan 10 14:15:18 2016 PST
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Test User
Email address: test@example.com
Comment: Test Key
You selected this USER-ID:
"Test User (Test Key) <test@example.com>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
Key generation failed: Not supported
gpg/card> list
Reader ...........: 1050:0116:X:0
Application ID ...: D2760001240102000006030154560000
Version ..........: 2.0
Manufacturer .....: Yubico
Serial number ....: MY_SERIAL_NUM
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 2
Signature key ....: 92D8 2373 6B3D C5C9 A025 8321 C4D4 5338 ED82 FD55
created ....: 2016-01-09 22:15:44
Encryption key....: [none]
Authentication key: A276 5F40 9270 71D1 F908 E180 A99D BCAA AB8B 0941
created ....: 2016-01-09 22:15:44
General key info..: [none]
gpg/card>
As you can see, it failed with 'Key generation failed: Not supported' but interestingly
it did generate a signature and authentication key. It *always* fails to generate the
Encryption key and never saves anything off-card.
If I do the generation again, but this time state that I do not want to save keys
offline, it appears to work and creates all three keys on the card. Obviously this is a
problem though since it is impossible to backup the private keys. Here is a session
where it creates the keys on card, but with no backup requested.
gpg/card> generate
Make off-card backup of encryption key? (Y/n) n
gpg: Note: keys are already stored on the card!
Replace existing keys? (y/N) y
Please note that the factory settings of the PINs are
PIN = '123456' Admin PIN = '12345678'
You should change them using the command --change-pin
Please specify how long the key should be valid.
0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years
Key is valid for? (0) 1
Key expires at Sun Jan 10 14:23:17 2016 PST
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Test User
Email address: test@example.com
Comment: Test Key
You selected this USER-ID:
"Test User (Test Key) <test@example.com>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
gpg: key 0xCF046C339AF48254 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, TOFU+PGP trust model
gpg: depth: 0 valid: 5 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 5u
gpg: depth: 1 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 1f, 0u
gpg: next trustdb check due at 2016-01-10
gpg/card> list
Reader ...........: 1050:0116:X:0
Application ID ...: D2760001240102000006030154560000
Version ..........: 2.0
Manufacturer .....: Yubico
Serial number ....: MY_SERIAL_NUM
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 4
Signature key ....: 8788 A73A B385 0A18 F938 C696 CF04 6C33 9AF4 8254
created ....: 2016-01-09 22:23:36
Encryption key....: 5F94 B5A9 7D22 4322 CB59 1082 8918 AD50 4F1E CBC2
created ....: 2016-01-09 22:23:36
Authentication key: 9EA3 4B82 E40A DA3A 6D08 BD4B 2D9B 7DC6 CEFA B3A4
created ....: 2016-01-09 22:23:36
General key info..: pub rsa2048/0xCF046C339AF48254 2016-01-09 Test User (Test Key)
<test@example.com>
sec> rsa2048/0xCF046C339AF48254 created: 2016-01-09 expires: 2016-01-10
card-no: 0006 03015456
ssb> rsa2048/0x2D9B7DC6CEFAB3A4 created: 2016-01-09 expires: 2016-01-10
card-no: 0006 03015456
ssb> rsa2048/0x8918AD504F1ECBC2 created: 2016-01-09 expires: 2016-01-10
card-no: 0006 03015456
gpg/card>
Oh, and by the way, its impossible to remove the public key for this card unless I use
the --expert option which I stumbled upon when looking at the source code. I didn't
see it documented anywhere that I could find that I needed to add this to remove pub
keys associated with a card. It may be intentional, but it is not very user friendly.
Took me almost an hour to figure it out. A hint in the error message would have been
very helpful. Here is an example:
$ gpg2 --delete-keys 0xCF046C339AF48254
gpg (GnuPG) 2.1.10; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
gpg: there is a secret key for public key "0xCF046C339AF48254"!
gpg: use option "--delete-secret-keys" to delete it first.
$ gpg2 --delete-secret-keys 0xCF046C339AF48254
gpg (GnuPG) 2.1.10; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
sec rsa2048/0xCF046C339AF48254 2016-01-09 Test User (Test Key) <test@example.com>
Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
gpg: deleting secret key failed: Not possible with a card based key
gpg: deleting secret subkey failed: Not possible with a card based key
gpg: deleting secret subkey failed: Not possible with a card based key
gpg: 0xCF046C339AF48254: delete key failed: Not possible with a card based key
$ gpg2 --expert --delete-keys 0xCF046C339AF48254
gpg (GnuPG) 2.1.10; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub rsa2048/0xCF046C339AF48254 2016-01-09 Test User (Test Key) <test@example.com>
Delete this key from the keyring? (y/N) y
$
(yes, deleted pub key)