Create Smartcard-based PGP Key

Requirements

• OpenPGP-compatible Hardware Security Key (Example: YubiKey 5(C))
• GnuPG CLI installed
• Smartcard-related Drivers installed

 

Key Setup

Prepare Card

Ensure Card is recognized

gpg --card-status

The Output should look something like this

Reader ...........: Yubico YubiKey OTP FIDO CCID 0
Application ID ...: D2760001240100000006379790790000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: Yubico

Configure Card

gpg --card-edit

**If Command is preceeded by `gpg/card>`, you have to be in card edit Mode using `gpg --card-editedit`**

Configure Pin

**For YubiKeys, the default Pin is 123456`123456` and default Puk is 4`4`**

gpg/card> admin
gpg/card> passwd

• Press 1 to edit User-Pin
• Press 3 to edit Admin Pin
• Press q to quit

Set Algorithm to ECC

gpg/card> key-attr

Select Curve 25519 Slot

(1) RSA
(2) ECC

(1) Curve 25519 *standard* <em>standard</em>(4) NIST P-384 (384(6) Brainpool P-256

• ED25519 for Auth/Sign
• CV25519 for Encryption

Generate Key

gpg/card> generate