Skip to main content

Create Smartcard-based PGP Key

Requirements

  • OpenPGP-compatible Hardware Security Key (Example: YubiKey 5(C))
  • GnuPG CLI installed
  • Smartcard-related Drivers installed

 

Key Setup

Prepare Card

Ensure Card is recognized
gpg --card-status

The Output should look something like this

Reader ...........: Yubico YubiKey OTP FIDO CCID 0
Application ID ...: D2760001240100000006379790790000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: Yubico
Configure Card
gpg --card-edit

If Command is preceeded by gpg/card>, you have to be in card edit Mode using gpg --card-edit

Configure Pin

For YubiKeys, the default Pin is 123456 and default Puk is 4

gpg/card> admin
gpg/card> passwd
  • Press 1 to edit User-Pin
  • Press 3 to edit Admin Pin
  • Press q to quit

Set Algorithm to ECC

gpg/card> key-attr

Select Curve 25519 Slot

(1) RSA
(2) ECC

(1) Curve 25519 *standard*
(4) NIST P-384
(6) Brainpool P-256
  • ED25519 for Auth/Sign
  • CV25519 for Encryption

Generate Key

gpg/card> generate

 

 

Back to top