yubikey digital signature

install.txt

$ brew install yubico-piv-tool

Go to yubico manager, generate a PIV Digital Signature certificates
- RSA2048
- Self-signed certificate
- Expiration to 2029-12-31
- Management key (default)
- PIN (default 123456)

Generate a certificate
$ yubico-piv-tool -a read-cert -s 9c -K PEM > yk.crt

Export public key
$ openssl x509 -pubkey -in yk.crt --nocert > yk.pub

signer.txt

Sign the file
$ yubico-piv-tool -a verify-pin --sign -s 9c -H SHA512 -A RSA2048 -i file.txt -o file.sig

verify.txt

Verify the signature according to pubkey <> file
$ openssl dgst -sha512 -verify yk.pub -signature file.sig file.txt