How to configure and install a YubiKey NEO with GnuPG

install-yubikey-neo-gpg.md

Install YubiKey NEO's GPG Ubuntu 14.04

First of all you need to add the devide to the /etc/libccid_Info.plist file. In order to do so, change the file in this way:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- ... -->
    <key>ifdVendorID</key>
    <array>
        <!-- ... -->
        <string>0x1050</string>
    </array>
    
    <key>ifdProductID</key>
    <array>
        <!-- ... -->
        <string>0x0116</string>
    </array>

    <key>ifdFriendlyName</key>
    <array>
        <!-- ... -->
        <string>Yubico Yubikey NEO OTP+U2F+CCID</string>
    </array>
</dict>

Then the YubiKey should be recognized by the OS. You can check with this command:

$ gpg-connect-agent --hex "scd apdu 00 f1 00 00" /bye

Then you should disable the GNOME Keyring agent for GPG and SSH. Add Hidden=true at the end of the following files:

• /etc/xdg/autostart/gnome-keyring-gpg.desktop
• /etc/xdg/autostart/gnome-keyring-ssh.desktop

Configuring the YubiKey NEO

You can now start tweaking the YubiKey NEO. Open GPG with the command:

$ gpg --card-edit

Enter admin and then passwd. In there, change the Admin PIN and the PIN. Defaults are 123456 for the PIN and 12345678 for the Admin PIN.

Re-insert the YubiKey, re-open GPG, issue admin and then name to change the information in the key. Repeat with sex, url and login.

Now it's time to create the subkeys for the YubiKey. Log into the GPG key editor with:

$ gpg --edit-key 0xYOURKEYID

Issue addcardkey to add the first authentication key, and then the signing key. Finally you need to add an encryption subkey. In order to do so, you should call the addkey command, select encryption key with 2048 bits. Then toggle in order to switch to secret mode, select the last created key with key <num> and finally keytocard. Select encryption mode.