If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11.

But what is the point of using a Yubikey with OpenPGP applet if the computer needs to read the private key out of it to sign or encrypt? Isn't it the same as storing my private keys in a usb stick and protect it with a password?


With Yubikey the private key does not leave the stick. Any cryptographic operations which need the private key are executed on the Yubikey itself. This is the same concept you have with other kinds of smartcards.

Contrary to an encrypted USB stick the private key is thus never accessible on the computer. If an attacker has compromised the system he can at most trick you into signing something you don't want with Yubikey plugged in. But with the encrypted USB stick mounted the attacker can actually steal your private key and thus use it whenever he wants even outside of your system.

  • This is weird, because in the yubico site, is the Yubihsm that offers encryption/decryption, the yubikey spec doesn't inform which kind of encryption/decryption it supports. If the yubikey does all operations inside the stick, I don't understand what yubihsm is for then – Lilás Nov 2 '16 at 11:06
  • 1
    @Lilás: Yubikey implements OpenPGP card. From wikipedia about OpenPGP card: "Private keys and passwords cannot be read from the card with any command or function...However, a new key pair may be loaded onto the card at any time, overwriting the existing one.". yubihsm instead is a real HSM, i.e. a tamperproof encryption module for a server with much more power than a yubikey - since a server requires more crypto operations per time. – Steffen Ullrich Nov 2 '16 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.