5

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I do have to reencrypt everything to the new key, is there documentation on how to do this?

Note that I am using a key that is generated directly on the device itself, so that it is more secure.

Improve this question
6
  • Considering your second question -- this one is very different from your first question, and this does not fit the Stack Exchange Q&A model very well. Please ask another question instead. Also be aware it might be considered off topic here as it is very specific to tool usage (Super User or the Unix Stack Exchange might be better places to ask instead), and you will have to be more specific on the actual use case.
    – Jens Erat
    Jan 7, 2018 at 16:59
  • You can just extend the expiration date on your key. There's no reason why you'd need to create a new one unless you suspect your old one has been somehow compromised.
    – mricon
    Jan 7, 2018 at 17:25
  • There are a few reasons why I might need to create a new key. If I did create a new key, I would still want to be able to decrypt old files/email/etc.
    – Jacob Brown
    Jan 8, 2018 at 16:39
  • Here are some example reasons why I might want to create a new key. 1. My old key could be compromised like you suggested. 2. My key could have been generated with a flawed library such as the ROCA vulnerability, which some Yubikey 4 do have. yubico.com/support/security-advisories/ysa-2017-01 There is potential that other unknown vulnerabilities do exist. 3. The cipher may contain flaws in the future that would make us switch to another cipher. For example, If quantum computing causes all RSA keys to become obsolete, I would switch from RSA to epileptic curve.
    – Jacob Brown
    Jan 8, 2018 at 16:39
  • @JensErat Yes, maybe I should have waited until I found out that I can only have one key, and then once I find out that answer, create a second stack exchange question for "reencrypting" everything. You imply that I should have used another stack exchange for asking the question. Are hardware security devices or encryption not covered under security.stackexchange.com ?
    – Jacob Brown
    Jan 8, 2018 at 16:46

1 Answer 1

Reset to default
3

Then OpenPGP smart card standard explicitly reserves each slot to the respective usage. If you use the Yubikey as OpenPGP smart card (so it can be used with GnuPG, ...), you will not be able to upload keys to "incompatible" slots.

I just tried to upload a signing key to my card/Yubikey (which just holds an authentication key up to now), and was only able to choose among the signing and authentication slots (the encryption slot was not offered).

Improve this answer
2
  • 1
    Do you happen to know of any documentation that states this? The reason I ask is that for the PIV functionality of the device, it does support multiple encryption keys: Slot 82-95: Retired Key Management developers.yubico.com/PIV/Introduction/Certificate_slots.html . It would be sad if the OpenPGP functionality of this device doesn't also support that feature.
    – Jacob Brown
    Jan 8, 2018 at 16:48
  • 1
    I failed at properly posting the URI to the specification (I already intended to, but messed up the markup) which I just corrected. The Yubikey implements the standard in an additional applet on the device, so there is not much of relevance of what it supports for other standards. The OpenPGP smart card interface simply does not propose multiple encryption keys.
    – Jens Erat
    Jan 8, 2018 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .