Can I use Yubikey to encrypt a file without PGP?

Question

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it.

I know you can save a PGP key onto Yubikey and use it for this purpose. However, I am planning to use the PGP encryption key for something different and would like to narrow the attack surface by not using it to encrypt my file. If there was a way to have two PGP encryption keys on a Yubikey, I would gladly do that, but AFAIK there can only be one encryption PGP key on a Yubikey.

Is there a way to use some other facility that Yubikey 5 Series offers - e.g. PIV, FIDO2 - to encrypt a file?

Answer 1

TL;DR

You don't need access to your YubiKey to encrypt to the secret key stored on your YubiKey. You only need the public key, which need not be stored on (or accessed from) the YubiKey to be used securely.

Analysis

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it.

You don't need your YubiKey to encrypt a file to the secret key stored on your YubiKey. To encrypt, you only need the public part of the key pair, which is not generally considered sensitive and can safely be stored on disk or retrieved on demand from a reliable key server. The only real security considerations are that:

1. You must ensure you are encrypting to the right recipient using the corrrect public key to avoid man-in-the-middle attacks or possible decryption by an incorrect recipient. Typically, verifying the public key's fingerprint (which is not generally considered sensitive data either) is sufficient to ensure you're encrypting to the right recipient such as your stored-on-YubiKey private key.
2. In the general case, encrypting to a given recipient can expose metadata such as the intended recipient, especially if the public key or its fingerprint is widely known, published publicly, or stored on an older key server that is vulnerable to enumeration attacks. NB: You did not define this use case as a threat, but I mention it as some people forget about metadata analysis in their threat modeling.

If you use any version of OpenPGP (e.g. GnuPG) you simply need the public key to encrypt to the recipient. Given any reasonable implementation of OpenPGP, you don't need the YubiKey to perform the encryption. By definition, while the public key can can derived from the secret key material, you don't need access to the secret key stored on the YubiKey in order to encrypt data that will require the YubiKey to decrypt.

Assuming you don't care about the metadata, and assuming your secret key material resides only on the YubiKey itself, then there's no cryptographic reason to avoid encrypting to the YubiKey using its public key. That's likely a better option than most other approaches if you're using public key cryptography in the first place.

The use case you've described is fundamental to the security and value proposition of public key cryptography, so I think you should carefully reconsider why you think you need the physical YubiKey to encrypt. You only need the stored private key material to sign or decrypt, not to encrypt!

After all, anyone else sending data to you wouldn't have access to your YubiKey either. They would only have your public key, hopefully with your public key fingerprint verified securely out-of-band, so it's difficult to understand the specific threat you perceive or are trying to mitigate here.

Answer 2

I am planning to use the PGP encryption key for something different and would like to narrow the attack surface by not using it to encrypt my file

What's your threat model? Public keys are public, that's the whole point. You can use the same public/private key pair for both chatting with your buddies and doing top-secret spy stuff, if you want. In fact, it's sometimes useful to do so, because then the super secret traffic blends in with everything else; some adversary sees a PGP message encrypted to your key and thinks "oh yeah, it's probably just Sergei chatting with his friends again". The only reason to worry about this is if you plan to not actually share the public key for your "something different", and you're worried that somebody will crack the public key (e.g. factor it, if it's RSA). Are both of those actually relevant here (and if so, why)?

---

With that said, technically yes, you can use Yubikeys for other multiple key pairs. A Yubikey 5 might only have one slot for a PGP decryption key in particular, but it has dozens of slots for key pairs in general. https://support.yubico.com/hc/en-us/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with- lists how many keys of each type you can store on the Yubikey; all of them except the OTP keys are public/private key pairs (though some might not directly expose or even support encryption/decryption operations using the key pair, since in most cases the only required behavior is signing and the key type being used internally might not even support encryption).

Smart Cards (Yubikey implements the Personal Identity Verification a.k.a. PIV smart card standard, and maybe more, though I don't know if they specifically support decryption as that is not essential for identity verification) are a notable option, as they not only store key pairs but (if supported) directly expose a decrypt function (no need for an encrypt function, as that uses only the public key and only the private key needs to be kept secret inside the Yubikey). However, smart cards do not natively implement support for bulk data decryption; you'd need a hybrid cryptosystem where the private key is used to decrypt a symmetric key, and the symmetric key is used to decrypt (and verify) the data; this is how OpenPGP works, and how RSA key exchange in TLS and SSH works. See https://crypto.stackexchange.com/questions/34073/use-smart-card-to-decrypt-files for more information about that approach.