Most tutorials that cover smartcard functionality of the Yubikeys use slots

  • 9a (PIV Authentication),
  • 9c (Digital Signature) and
  • 9d (Key Management).

However, there are also slots 82-95 (Retired Key Management) available:

These slots are only available on the YubiKey 4 & 5. They are meant for previously used Key Management keys to be able to decrypt earlier encrypted documents or emails. In the YubiKey 4 & 5 all 20 of them are fully available for use.

I would like to use more than one slot for digital signatures, so I would use slots 9c and, say, 84 for two different certificates.

My questions are:

  • Is this scheme "valid"? (i.e., using slots 82-95 for digital signatures, not encryption/decryption)
  • How can I configure slot 84 to use the same PIN policy (require PIN/touch for every action) that slot 9c has?
  • How can I use openssl ca to sign data with key/cert from slot 84?
  • isn't this a question for Yubikey support?
    – LvB
    Jan 4, 2022 at 17:32
  • Answers from developers with experience in this space would also be welcome. Jan 4, 2022 at 19:56

1 Answer 1


Heads up: usually YubiKey is used with gpg, and uses the pgp format, it supports various bells and whistles. YubiKey PIV slots use raw RSA or ECC key and cert[0].

Additionally, while the common 4 pgp slots support 4096 bit keys, the PIV slots are spec-ed[1] up to 2048 bits.

  1. Generate raw RSA key. You can use puttygen or any other tool instead.

openssl genrsa -out secret.pem 2048

  1. Extract the public key:

openssl rsa -in secret.pem -pubout -out public.pem

  1. Upload the secret key to the PIV slot, using the YubiKey SDK, yubico-piv-tool or YubiKey Manager CLI:

ykman piv keys import --pin 123456 --pin-policy NEVER --touch-policy ALWAYS 95 secret.pem

  1. Encrypt a test message using the public key:

echo "hello world" | openssl rsautl -inkey public.pem -pubin -encrypt -oaep -out msg.encrypted

  1. Decrypt using the SDK:
using Yubico.YubiKey;
using Yubico.YubiKey.Piv;
using Yubico.YubiKey.Cryptography;

var msg_encrypted = File.ReadAllBytes("msg.encrypted");

var device = YubiKeyDevice.FindAll().First();

using (var piv = new PivSession(device))
    var decrypted_raw = piv.Decrypt(0x95, msg_encrypted);

    byte[] output;

    RsaFormat.TryParsePkcs1Oaep(decrypted_raw, RsaFormat.Sha1, out output);

    Console.WriteLine(System.Text.Encoding.UTF8.GetString(output)); // "hello world"

If you are only interested in signing, you may not need the SDK[2].

[0] https://docs.yubico.com/yesdk/users-manual/application-piv/slots.html

[1] https://github.com/Yubico/yubico-piv-tool/issues/58

[2] https://developers.yubico.com/yubico-piv-tool/Actions/signing.html

  • 2
    Although this is useful information, I don't see how it answers the question.
    – Mark
    Dec 28, 2022 at 4:14
  • Since the question is specifically about signing, can you modify your answer to talk about that?
    – schroeder
    Dec 28, 2022 at 14:37
  • Nope. I don't use Yubikey for signing and have no direct experience with it. This question was unanswered for 11 months. It asked about how to use the extra slots. I shared my experience and gave enough direction for those interested in signing to know where to look at. Only to be downvoted, terrible website. Dec 28, 2022 at 23:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .