ninegua / secure-setup

Secure setup: encrypted USB drive, GnuPG, YubiKey and related practice
7 stars 0 forks source link

Support YubiKey PIV in addition to OpenPGP #4

Open ninegua opened 5 years ago

ninegua commented 5 years ago

We should be able to use the same set of keys in PIV too. However, it is unfortunate that the latest gen of YubiKey 5 does not support RSA4096 for PIV, nor ECDSA keys for OpenPGP. Actually there exists no known method to export ECDSA secret keys from GnuPG in a OpenSSL compatible PEM format.

So it seems in order to use the same set of keys for both PIV and OpenPGP, we'll have to settle on RSA2048 for now. I have not found a lot use case of PIV for myself yet (except one case, Token2Shell supports only PIV but not gpg-agent/Pageant on Windows), but I expect it can be useful for others.