Generating RSA keys on Yubikeys is a delight many of us have enjoyed, and it's fine for a single key. Once you start doing more than key, say an organisation's worth, it quickly gets less enjoyable.
Being able to programmatically generate keys with as little human interaction as possible (there remains some, due to fragility and the real world). It even has JSON output if need be, so you can feed use it as part of another script.
- Python 3.
- pinentry-hax from pinentry-hax in the same directory. Needed for setting the PIN unattended.
- ykneomgr "brew install ykneomgr"
- ykpers "brew install ykpers"
- gnupg2 version 2.0.27 only tested. "brew install gnupg2"
- Some Yubikey Neo Nanos
Firmware version of the Yubikey is very important. The versions that have worked with this are 3.3.7. Earlier have had different PIN requirements, later, well, who knows. This isn't the most reliable or rugged process.
There's a lot of unplugging and plugging back in involved.
gpg2 --card-status can help kick it, if it can't find the card. Also waiting until the light turns off.
See also Ben Hughes' blog on the subject.
usage: gpg_gener8.py [-h] --name "Mr. Etsy" --email "email@example.com" [--json] [--overwrite] [--pin 1234] [--adminpin 12345] [--newpin 4321] [--newadminpin 54321] [--randomnewpin] [--randomnewadminpin] [--forcecard neo-nano] gpg_gener8.py: error: the following arguments are required: --name/-n, --email/-e
Run the simple, not unwieldly at all:
localtoast% python3 gpg_gener8.py --name 'Isabel Tate' --email 'firstname.lastname@example.org' --pin 123456 --adminpin 123456 --randomnewpin --randomnewadminpin
Which, after some prompting, will output:
For name "Isabel Tate", email: email@example.com Yubikey serial: 3281265 PIN set to: 793574 Admin PIN set to: 23457830 Public key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== cardno:000202925496
There's the JSON output too, if you wish to feed to it in to something else.
Please do! See Contributing
Almost certainly, see the issue tracker on github.
Thanks to ecraven for pinentry-emacs.
Thanks to @antifuchs for assisting with battling pinentry and GPG.