The Yubikey is small USB device which can be used as a simple HSM for use with GPG. Above this it can also be used as a generator for OTPs etc.

Basic Usage as HSM

Detection

To check if the device is detected use gpg --card-status

The result should look something like this:

Reader ...........: xxxx:xxxx:X:0
Application ID ...: Dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: xxxxxxxx
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

Interactive Use via GPG

Then go into interactive mode to configure the card gpg --card-edit. Then type admin to activate admin commands. ? will show the available commands.

quit           quit this menu
admin          show admin commands
help           show this help
list           list all available data
name           change card holder's name
url            change URL to retrieve key
fetch          fetch the key specified in the card URL
login          change the login name
lang           change the language preferences
sex            change card holder's sex
cafpr          change a CA fingerprint
forcesig       toggle the signature force PIN flag
generate       generate new keys
passwd         menu to change or unblock the PIN
verify         verify the PIN and list all data
unblock        unblock the PIN using a Reset Code
factory-reset  destroy all keys and data

Signing a File

The command gpg --sign -u **keyID** **filename** can be used to create a signature for a file.

gpg --sign -u 793D4D2929B2CEC7 test.txt

This will create a file called test.txt.gpg.

Change PIN

To set a PIN use passwd

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection?

The default PINs should be

Please note that the factory settings of the PINs are
   PIN = '123456'     Admin PIN = '12345678'

You will have to set both a user and an admin PIN.

Generating Keys

The generate command can be used to generate keys.

gpg/card> generate
Make off-card backup of encryption key? (Y/n) n

Please note that the factory settings of the PINs are
   PIN = '123456'     Admin PIN = '12345678'
You should change them using the command --change-pin

What keysize do you want for the Signature key? (2048) 
What keysize do you want for the Encryption key? (2048) 
What keysize do you want for the Authentication key? (2048) 
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 2y
Key expires at So 07 Apr 2019 11:14:33 CEST
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Tester
E-mail address: tester@nope.nope
Comment: Only for testing
You selected this USER-ID:
    "Tester (Only for testing) <tester@nope.nope>"

Change (N)ame, (C)omment, (E)-mail or (O)kay/(Q)uit? O
gpg: key 793D4D2929B2CEC7 marked as ultimately trusted
gpg: revocation certificate stored as '/home/Tester/.gnupg/openpgp-revocs.d/72CEC465A553A414A2C4B760793D4D2929B2CEC7.rev'
public and secret key created and signed.

Listing Keys

The list command will show all keys.

Signature key ....: 72CE C465 A553 A414 A2C4  B760 793D 4D29 29B2 CEC7
      created ....: 2017-04-07 09:15:37
Encryption key....: 3D51 6E23 CFE5 45FB B7C6  EAD2 4D63 9B15 8768 F01B
      created ....: 2017-04-07 09:15:37
Authentication key: 2768 B94E F631 B636 806F  B98C C511 AD6A 09C2 6A66
      created ....: 2017-04-07 09:15:37
General key info..: pub  rsa2048/793D4D2929B2CEC7 2017-04-07 Tester (Only for testing) <tester@nope.nope>
sec>  rsa2048/793D4D2929B2CEC7  created: 2017-04-07  expires: 2019-04-07
                                card-no: 0006 05029630
ssb>  rsa2048/C511AD6A09C26A66  created: 2017-04-07  expires: 2019-04-07
                                card-no: 0006 05029630
ssb>  rsa2048/4D639B158768F01B  created: 2017-04-07  exxpires: 2019-04-07
                                card-no: 0006 05029630