Using a Yubikey for GPG and SSH
As a Yubikey fanboi since 2013, who was very excited about the prospect of using it for airgapping GPG and SSH keys circa 2014, 2018 me says: &quot;you almost certainly don&#x27;t want to do this&quot;<p>Let&#x27;s start with SSH. It&#x27;s just plain unstable. If you try to set this up, you WILL have constant stability problems. I can assure you I have both personally experienced them and asked several other people who have attempted it to confirm that they too have various timeouts or other errors.<p>One alternative is PIV. PIV is even more of a pain in the ass to get set up, and has similar stability problems.<p>If I have a prescriptive recommendation for SSH, set up Duo for 2FA and use Yubikey-AES in &quot;long press&quot; mode (putting the key in slot 2). This gives you a strong hardware-backed authentication factor and protection against &quot;Yubispam&quot; (i.e. accidental credential leakage, a problem more severe than most would consider it)<p>As for GPG, well... GPG is a tire fire. I also went through the Yubikey GPG PIN bypass (not their fault, but since Yubikeys cannot be field patched, this involved physically rotating every key, which Yubico replaced for free, but still). GPG suffers similar random faults, and gpg-agent can die in a fire, but at least unlike SSH you&#x27;re probably not using it as frequently. Still, getting things set up is ridiculously arcane, thanks to gpg being a byzantine tool and the crazy mutable state nature of ~&#x2F;.gnupg<p>If you end up attempting to replicate this sort of setup, I can bet you dollars to donuts you will wind up asking yourself &quot;Why did I think this would be a good idea?&quot; after a few months