12

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But if I would lose the Key I would have a Problem, because the main private key was solely stored on the Yubikey. So I tried another approach. I created a key on my Computer and used it to generate three subkeys, one for signing, one for authentication and one for encryption. Then I moved the three subkeys on the Yubikey. I wanted to store my Master Key in a safe place and wanted the Yubikey for daily use. I used RSA 4096 for my Master key and RSA 2048 for the subkeys because the Yubikey does not support greater keys. This worked as well.

Question:

GPG supports ECC in newer versions. Is it possible to create a Master key using ECC instead of RSA (Subkeys would still be RSA) and will I be able to communicate with other people (using my subkeys) who use systems that don't yet support ECC? And will they be able to sign my Key and I theirs without problems?

Improve this question
2
  • 1
    FYI: Yubikey now supports 4096 bit keys.
    – Jonathan Cross
    Commented Feb 19, 2016 at 16:11
  • @JonathanCross only the YukiKey 4 which is not available with NFC. So if you want to use your GPG keys on your phone/tablet, you have to stay with the NEO and 2048bit
    – Josef
    Commented Jul 4, 2016 at 9:27

1 Answer 1

Reset to default
8

First of all, be aware that the Yubikey does not support ECC keys (but I don't read from your question that you assumed that).

If you use an ECC primary key, others using older implementations of GnuPG not supporting ECC keys (thus, everything before GnuPG 2.1) will not be able to verify your primary key nor signatures issued by you, as it does not understand the new algorithms. So all in all, people running pre-ECC-versions of GnuPG will be able to

  • sign your key
  • receive messages encyrpted by you (your key is not involved at all)
  • send signed messages to you (your key is not involved at all)

but not be able to

  • verify signatures/certifications issued by you
  • validate your key (which includes verifying a self-signature)
  • verify signatures issued by your RSA subkey, as the subkey's binding signature must be validated before
  • send encrypted messages to an ECC encryption subkey
  • send encrypted messages to an RSA encryption subkey, as the subkey's binding signature must be validated before

Signing your key is possible, as no cryptography with your public key must be performed, but the signee is just calculating a signature (using his own key) over your key's fingerprint.

PS: I verified those operations between GnuPG 1.4 and 2.1, as I had some expectations, but was not sure whether GnuPG actually meets them.

Improve this answer
10
  • Okay thanks. So I guess I will keep using RSA for some time and wait till ECC is more commonly used.
    – Max
    Commented Aug 11, 2015 at 10:43
  • 1
    FYI: The new YubiKey 4 supports ECC keys. But the OpenPGP applet is not Open Source as it was in the older NEO devices :-(
    – Jonathan Cross
    Commented Jun 7, 2016 at 22:23
  • 1
    Looking at my YubiKey Neo 4 through gpg2 --card-edit, it says Version ..........: 2.1. ECC support was not added to the protocol specification before version 3.0, thus the YubiKey Neo 4 should not support ECC for OpenPGP. I wasn't able to create any non-RSA keys on the YubiKey using GnuPG 2.1, either.
    – Jens Erat
    Commented Jun 11, 2016 at 17:48
  • 1
    This would have better been validating (I changed that now), but sometimes people also use the term verifying for keys. Validating OpenPGP keys means nothing else than verifying the certifications (signatures) on it. This usually includes self-certificates from your own key on your own key, and at the latest at this point GnuPG pre-2.1 will fail at validating the key.
    – Jens Erat
    Commented Jun 15, 2016 at 7:07
  • 3
    ECC support has been added to YubiKeys in firmware version 5.2.3. support.yubico.com/support/solutions/articles/…
    – steinybot
    Commented Apr 19, 2020 at 3:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .