When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information?
If so, what information would that be?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply?
The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations:
An operation not supported is extracting keys, the idea of OpenPGP smart cards is limiting impact on breaches to the time the card/key is connected to the machine. This also means that if you want a backup copy, you'd have to create the key on a computer and then load it to the smart card/YubiKey.
All this is explained in Yubico's blog entry YubiKey NEO and OpenPGP:
WARNING: You cannot backup the secret keys – so if you lose the YubiKey NEO, re-generate another key pair or other lose the key pair there is no way to retrieve it! When you encrypt a file, make sure you have a plain text backup.
You can (but do not have to) store some personal information on OpenPGP smart cards, also the vendor could do so (for example, the FSFE signs the key's original contents with their own key, including some personal information they pre-programmed). I'm not sure whether the YubiKey implements the whole OpenPGP smart card standard and I don't have my YubiKey with me right now, but I'd guess it does. Information that is always stored are the serial number and as soon as keys are created their fingerprints and creation dates. There is a signature counter that might indicate key/card usage. Furthermore, you can (but do not have to) set the card holder's name, language, sex, public key's URI and some login data.
The YubiKey actually is a full computer, and all the smart card operations are implemented in software. There might be bugs and other issues, and you cannot really verify the software, on non-development products you cannot even install your own software (which of course also applies to hardware tokens, which also could include bugs and backdoors, where you also need to trust the vendor, but software is usually more complex, less well understood and more likely to have issues).
The YubiKey (Neo) was already affected by an issue, allowing to perform crypto operations without knowledge of the user's PIN. Extracting keys was not possible because of this issue.
A very sophisticated attacker might even be able to crack open the device and read the stored information (which also applies to "dedicated" smart cards for OpenPGP and other protocols, of course).
An alternative claiming to be open source hardware and software (which would in theory enable verification, while producing your own device is probably out of scope) is the Nitrokey. I'm not sure though how to verify the software running on the device and whether you could exchange the whole software with the self-compiled (and assessed?) source code, at least you should be able to do so for the individual applications (like OpenPGP).