How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.

My first 2 pet theories are:

  • There's some way to chunk up GPG operations or use some magic to stream data into and out of the device live.
  • You have to create a one time use subkey.
  • 2
    You did not ask for it, since you are concerned with the signing (which operates on a constant size small hash as answered below) but with chip cards you might need to pay attention to the capabilities of the card reader. Some built-on ones can only handle 3kbit keys and not extended-ADPUs (protocol units) which would be needed for larger key sizes. In that Case I think it’s the public key transported with the signature which messes up things.
    – eckes
    Apr 11, 2022 at 16:49

1 Answer 1


The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, and then pass the hash digest to the hardware saying "hey, sign this with key X". There's your signature!

Similarly for decryption, GPG (like nearly all asymmetric encryption schemes) actually uses "hybrid encryption" where the public key only ever encrypts a randomly-generated, unique, per-message symmetric key, which isn't very long. This is done primarily because asymmetric encryption/decryption is extremely slow, but it also helps when handling the private key using external devices like Yubikeys. The symmetric key is used for bulk data encryption/decryption using a fast cipher such as AES.

So, when you receive an encrypted message, and all you need your private key for is to decrypt the symmetric key (which is probably 128-256 bits, shorter than many hash digests). No big deal to hand that off to a hardware token. The bulk decryption - just like the bulk encryption - can be done in software, since the key is ephemeral and unique. The asymmetric part of the encryption is also a single operation on a small piece of data (the symmetric key), but that doesn't even need the Yubikey because you encrypt using a public key, so that can safely be done in software (the Yubikey exposes the public key - but not the private key - when it is plugged in).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .