How do I generate SSH keys inside my yubikey, on Ubuntu?

There seems to be nowhere to look for this info.

  • See developers.yubico.com/SSH
    – mti2935
    Apr 4 at 1:04
  • 2
    Can you generate keys on the Yubikey in any method?
    – schroeder
    Apr 4 at 8:47
  • 2
    Further, what is the threat vector which precludes you from following the linked procedure? Generate it, send it to yubikey and then securely delete it. This would only be unacceptable if the resource generating the key is not completely in your control.
    – foreverska
    Apr 4 at 18:35
  • 3
    Boy, what an attack vector. The private key to an ed25519 key is any given random number. Rolling a 32 sided die gives you a nice 6bits of information per roll, you need 256. I'd start rolling because I can't find reference that it's possible to generate keys inside a yubikey.
    – foreverska
    Apr 5 at 14:50
  • 2
    I'll ask again... "Can you generate keys on the Yubikey in any method?" You ask about doing it on Ubuntu, but does the OS matter? Does the device even have this functionality? I'm thinking that this isn't a security question but a product support question. This sounds like a "does this product have this function?" question. Have you asked Yubikey?
    – schroeder
    Apr 6 at 12:31

1 Answer 1


I asked the question verbatim on reddit r/yubikey and got the following answer, along with another with some reference to gpg.

ssh-keygen -t ed25519-sk -O resident # resident means, that the key will be generated on the yubikey
It produce the following output:

user@pc:~$ ssh-keygen -t ed25519-sk -O resident
Generating public/private ed25519-sk key pair.
You may need to touch your authenticator to authorize key generation.
Enter PIN for authenticator:
Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ed25519_sk
Your public key has been saved in /home/user/.ssh/id_ed25519_sk.pub
The key fingerprint is: SHA256:ztpJ8rTSlo07BQ0LyL6hI2X9/CE9fTdy0EQZhAnxc74 user@pc


  • Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk): wouldn't it generate in the local OS? Apr 9 at 2:44
  • If you have a reddit account, the person in that thread seems to be very knowledgeable. BUT, '-o resident' was explained as the option which forces the yubikey to generate the key on device. Instead of passing back the private key it seems to pass back a "handle" to the key on the device. Per this thread: reddit.com/r/sysadmin/comments/hzxdbf/…
    – foreverska
    Apr 9 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.