How do I generate SSH keys inside my yubikey, on Ubuntu?

There seems to be nowhere to look for this info.

  • See developers.yubico.com/SSH
    – mti2935
    Apr 4, 2022 at 1:04
  • 2
    Can you generate keys on the Yubikey in any method?
    – schroeder
    Apr 4, 2022 at 8:47
  • 2
    Further, what is the threat vector which precludes you from following the linked procedure? Generate it, send it to yubikey and then securely delete it. This would only be unacceptable if the resource generating the key is not completely in your control.
    – foreverska
    Apr 4, 2022 at 18:35
  • 3
    Boy, what an attack vector. The private key to an ed25519 key is any given random number. Rolling a 32 sided die gives you a nice 6bits of information per roll, you need 256. I'd start rolling because I can't find reference that it's possible to generate keys inside a yubikey.
    – foreverska
    Apr 5, 2022 at 14:50
  • 3
    I'll ask again... "Can you generate keys on the Yubikey in any method?" You ask about doing it on Ubuntu, but does the OS matter? Does the device even have this functionality? I'm thinking that this isn't a security question but a product support question. This sounds like a "does this product have this function?" question. Have you asked Yubikey?
    – schroeder
    Apr 6, 2022 at 12:31

2 Answers 2


I asked the question verbatim on reddit r/yubikey and got the following answer, along with another with some reference to gpg.

ssh-keygen -t ed25519-sk -O resident # resident means, that the key will be generated on the yubikey
It produce the following output:

user@pc:~$ ssh-keygen -t ed25519-sk -O resident
Generating public/private ed25519-sk key pair.
You may need to touch your authenticator to authorize key generation.
Enter PIN for authenticator:
Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ed25519_sk
Your public key has been saved in /home/user/.ssh/id_ed25519_sk.pub
The key fingerprint is: SHA256:ztpJ8rTSlo07BQ0LyL6hI2X9/CE9fTdy0EQZhAnxc74 user@pc


  • Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk): wouldn't it generate in the local OS? Apr 9, 2022 at 2:44
  • If you have a reddit account, the person in that thread seems to be very knowledgeable. BUT, '-o resident' was explained as the option which forces the yubikey to generate the key on device. Instead of passing back the private key it seems to pass back a "handle" to the key on the device. Per this thread: reddit.com/r/sysadmin/comments/hzxdbf/…
    – foreverska
    Apr 9, 2022 at 3:05

Type the following commands on the command line:

gpg --edit-card
  • 2
    Your answer could be improved with additional supporting information. Could you explain what do the different commands do, and how this answer could complement or correct already existing answers.
    – Yuriko
    Oct 18, 2022 at 5:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .