Most tutorials that cover smartcard functionality of the Yubikeys use slots
- 9a (PIV Authentication),
- 9c (Digital Signature) and
- 9d (Key Management).
However, there are also slots 82-95 (Retired Key Management) available:
These slots are only available on the YubiKey 4 & 5. They are meant for previously used Key Management keys to be able to decrypt earlier encrypted documents or emails. In the YubiKey 4 & 5 all 20 of them are fully available for use.
I would like to use more than one slot for digital signatures, so I would use slots 9c and, say, 84 for two different certificates.
My questions are:
- Is this scheme "valid"? (i.e., using slots 82-95 for digital signatures, not encryption/decryption)
- How can I configure slot 84 to use the same PIN policy (require PIN/touch for every action) that slot 9c has?
- How can I use
openssl cato sign data with key/cert from slot 84?