Mention Key Derived Format

[basbebe]

YubiKey 5.2.3 supports KDF which might be worth mentioning (?):

Key Derived Format

To remove the transmission and on-card storage of OpenPGP PINs in plain text, the YubiKey supports the Key Derived Function (KDF) functionality. With the KDF function enabled, the PIN is stored as a hash on the YubiKey. When entering the PIN to the OpenPGP Smart Card, the OpenPGP client will only pass the hashed value, never passing the PIN directly. KDF functionality is set on the card itself, and communicated to the client; it is transparent to the user. Should the KDF functionality not be enabled, the PIN function will work as previously. The KDF function is listed in section 4.3.2 of the OpenPGP Smart Card 3.4 spec.

Current stable releases (2.2.20) of gnupg support enabling KDF.

• Enable KDF

$ gpg --edit-card
gpg/card> admin
gpg/card> kdf-setup
gpg/card> passwd
gpg: OpenPGP card no. D2760001240103030006294453760000 detected

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 1
PIN changed.

YubiKey 5.2.3 Enhancements to OpenPGP 3.4

OpenPGP Smart Card 3.4 Spec

[vistrcm]

Nice feature.

Unfortunately not working on my 5C Nano:

gpg/card> admin
Admin commands are allowed

gpg/card> kdf-setup
gpg: error for setup KDF: Conditions of use not satisfied

Does it limited to specific versions of yubikey?

[TheZoc]

@vistrcm what is the firmware version of your key?

[vistrcm]

@vistrcm what is the firmware version of your key?

Firmware: 5.2.4

[basbebe]

I'm using a 5C NFC, firmware 5.2.7

As someone also pointed out in this guide, it seems to be important to enable KDF before anything else is set (or right after a reset).

When I enabled it after the PIN was set (I think), I could't change touch behavuior anymore because ykman wouldn't accept my Admin PIN.

It also wasn't able to enable KDF after keys had been moved to the card in another case.

So on two cards I had to do a reset of the PGP module to get it to work

[vistrcm]

Good point. In my case keys already moved to the card.

[drduh]

Interesting feature. Can someone work on a PR?