How do GPG smart card devices handle large GPG operations?

Question

How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.

My first 2 pet theories are:

• There's some way to chunk up GPG operations or use some magic to stream data into and out of the device live.
• You have to create a one time use subkey.

Answer 1

The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, and then pass the hash digest to the hardware saying "hey, sign this with key X". There's your signature!

Similarly for decryption, GPG (like nearly all asymmetric encryption schemes) actually uses "hybrid encryption" where the public key only ever encrypts a randomly-generated, unique, per-message symmetric key, which isn't very long. This is done primarily because asymmetric encryption/decryption is extremely slow, but it also helps when handling the private key using external devices like Yubikeys. The symmetric key is used for bulk data encryption/decryption using a fast cipher such as AES.

So, when you receive an encrypted message, and all you need your private key for is to decrypt the symmetric key (which is probably 128-256 bits, shorter than many hash digests). No big deal to hand that off to a hardware token. The bulk decryption - just like the bulk encryption - can be done in software, since the key is ephemeral and unique. The asymmetric part of the encryption is also a single operation on a small piece of data (the symmetric key), but that doesn't even need the Yubikey because you encrypt using a public key, so that can safely be done in software (the Yubikey exposes the public key - but not the private key - when it is plugged in).