Using "Retired"/Extra slots (82-95) on Yubikey

Question

Most tutorials that cover smartcard functionality of the Yubikeys use slots

• 9a (PIV Authentication),
• 9c (Digital Signature) and
• 9d (Key Management).

However, there are also slots 82-95 (Retired Key Management) available:

These slots are only available on the YubiKey 4 & 5. They are meant for previously used Key Management keys to be able to decrypt earlier encrypted documents or emails. In the YubiKey 4 & 5 all 20 of them are fully available for use.

I would like to use more than one slot for digital signatures, so I would use slots 9c and, say, 84 for two different certificates.

My questions are:

• Is this scheme "valid"? (i.e., using slots 82-95 for digital signatures, not encryption/decryption)
• How can I configure slot 84 to use the same PIN policy (require PIN/touch for every action) that slot 9c has?
• How can I use openssl ca to sign data with key/cert from slot 84?

Answer 1

Heads up: usually YubiKey is used with gpg, and uses the pgp format, it supports various bells and whistles. YubiKey PIV slots use raw RSA or ECC key and cert[0].

Additionally, while the common 4 pgp slots support 4096 bit keys, the PIV slots are spec-ed[1] up to 2048 bits.

1. Generate raw RSA key. You can use puttygen or any other tool instead.

openssl genrsa -out secret.pem 2048

2. Extract the public key:

openssl rsa -in secret.pem -pubout -out public.pem

3. Upload the secret key to the PIV slot, using the YubiKey SDK, yubico-piv-tool or YubiKey Manager CLI:

ykman piv keys import --pin 123456 --pin-policy NEVER --touch-policy ALWAYS 95 secret.pem

4. Encrypt a test message using the public key:

echo "hello world" | openssl rsautl -inkey public.pem -pubin -encrypt -oaep -out msg.encrypted

5. Decrypt using the SDK:

using Yubico.YubiKey;
using Yubico.YubiKey.Piv;
using Yubico.YubiKey.Cryptography;

var msg_encrypted = File.ReadAllBytes("msg.encrypted");

var device = YubiKeyDevice.FindAll().First();

using (var piv = new PivSession(device))
{
    var decrypted_raw = piv.Decrypt(0x95, msg_encrypted);

    byte[] output;

    RsaFormat.TryParsePkcs1Oaep(decrypted_raw, RsaFormat.Sha1, out output);

    Console.WriteLine(System.Text.Encoding.UTF8.GetString(output)); // "hello world"
};

If you are only interested in signing, you may not need the SDK[2].

[0] https://docs.yubico.com/yesdk/users-manual/application-piv/slots.html

[1] https://github.com/Yubico/yubico-piv-tool/issues/58

[2] https://developers.yubico.com/yubico-piv-tool/Actions/signing.html