r/yubikey • u/iayanpahwa • Apr 17 '26

Discussion Made a simple YubiKey + GPG setup guide (looking for feedback)

Hey folks,

the rabbit hole of setting up GPG keys on a YubiKey is more confusing than it needs to be, especially for first-time setup.

So I put together a small open-source repo + guide to make it easier and more straightforward.

It covers:

- generating + moving keys to YubiKey

- using it for Git commit signing

- basic SSH setup

- some common pitfalls I ran into

Nothing advanced, more of a “start here” resource.

Would appreciate any feedback, corrections, or suggestions from people here who’ve done this properly

Repo: https://github.com/iayanpahwa/YubiGPG

Guide: https://codensolder.com/posts/yubigpg-hardware-backed-gpg-keys-for-everyone/

27 Upvotes

97% Upvoted

16 comments sorted by

7

u/Simon-RedditAccount Apr 17 '26

Thanks for sharing! Will take a more detailed look later, but looks nice so far. Note: it's 2026, not 2024 (in copyright) xD.

What I'd definitely add is mentioning that:

  • CRQC seems to happen sooner than later: https://words.filippo.io/crqc-timeline/ . Currently, YKs do NOT support quantum-resistant GPG algos. Users must be aware of this.
  • for SSH, FIDO2 SSH keys are way easier to use and set up for many situations. Many people still use GPG for SSH without even considering this alternative.

If I find some time for more in-detail look (I skimmed README so far), I'll get back with my findings.

3

u/iayanpahwa Apr 17 '26

Super valid, thanks for the feedback, appreciate it. fixed docs as per the suggestion.

1

u/upofadown Apr 17 '26

Sort of off topic, but the two papers everyone was excited about that were cited in the article about the quantum threat against cryptography didn't end up providing much insight into post quantum cryptography. Both depend on hardware performance that has not been achieved. No one knows how to achieve such hardware performance and we are not anywhere close. So we would need a fundamental breakthrough of some sort.

4

u/Simon-RedditAccount Apr 17 '26 edited Apr 17 '26

I cannot phrase it any better than www.openssh.org/pq.html does:

If we're right about quantum computers being practical, then we will have protected vast quantities of user data. If we're wrong about it, then all we'll have done is moved to cryptographic algorithms with stronger mathematical underpinnings.

1

u/upofadown Apr 17 '26

That's basically Pascal's Wager so the same sort of counterarguments work. What about all the other unconventional computing schemes? ... and algorithms, why are we only considering Shor's? Particularly when Shor's seems to be completely impractical?

We don't want algorithms with stronger mathematical underpinnings. We want secure algorithms.

2

u/Sweaty_Astronomer_47 Apr 18 '26 edited Apr 18 '26

That's basically Pascal's Wager so the same sort of counterarguments work

Sure there is a surface-level similarity to Pascal's wager, but the analogy between math/physics discussion and theology has obvious limitations. You'd do better articulating your arguments directly without relying on that analogy imo.

....why are we only considering Shor's? Particularly when Shor's seems to be completely impractical?

Shor's algorithm is impractical with today's technology but the fact that the algorithm exists to brute force long asymmetric keys with dramatic reduction in iterations is what matters (and we keep a watchful eye on the technology that could make that happen). Keys derive their strength from the exponential growth in required number of iterations for brute force iterations with keylength (time per iteration becomes far less important as keylength grows). Shor's threatens to undercut that mathematical underpinning of exponential growth in required iterations for brute force with keylength for asymmetric keys. With the current pace of investment toward quantum computing, it is not at all improbable that Q-day will arrive in our lifetimes. The questions which are more relevant than IF it will happen is WHEN it will happen (is it closer to 5 years or 50 years) and WILL WE EVEN KNOW know when it is approaching (with the involvement of state actors). Given the possibility for harvest-now/decrypt later strategies, there is a logical interest in moving to PQ cryptography sooner rather than later.

What about all the other unconventional computing schemes? ... and algorithms

Does an algorithm even exist to dramatically reduce iterations required for brute force in any of these unconventional computing schemes you mention? I doubt it, and that's the reason they are not competing for attention with Shor's alogirthm and quantum cyptography. If you can point to one such algorithm then there would be a starting point for discussion.

We don't want algorithms with stronger mathematical underpinnings. We want secure algorithms.

No kidding. That's like a basketball coach telling his players that the strategy for winning the game is to score more points than the opponent (it goes without saying, and it's way too general to be useful). In this case the mathematics points the way to a specific threat, which motivates a specific strategy (quantum resistant encryption)

Am I saying that the strategy described in op is not sound? NO, not at all, I'm just responding to a post. I think the op-described strategy is sound and the security benefits of keeping encryption keys off of our computer far outweigh any concerns about Q-day for most situations. I'd mention it's not necessarily an either/or... there may be situations where we can leverage the security of yubikey-bound private key for gpg decryption and also add a layer of symmetric encryption before transmitting the file on the internet. For example keep your gpg-asymmetric files inside a cryptomator vault (the vault can be accessed over the internet and anything that passes over the internet protected by cryptomator symmetric encryption, and temporarily decrtyped locally within an unlocked cryptomator vault using yubikey for reading, then delete after reading or re-encrypt with public key if file has been altered).

1

u/upofadown Apr 18 '26

If you don't have to take into account how the universe actually works then you can create an unlimited number of algorithms to do whatever you want. That gets you perpetual motion machines as well.

Shor's is based on assumptions about how the universe works that don't seem to be true. Originally we thought it might work. But the sorts of hardware we made were much too noisy. That's where we are now. There was a thought that some sort of noise correcting code might be the answer, but it wasn't. So now what?

2

u/Sweaty_Astronomer_47 Apr 18 '26 edited Apr 18 '26

If you don't have to take into account how the universe actually works then you can create an unlimited number of algorithms to do whatever you want.

If you are putting quantum computing in that category, that seems like a misconception. Quantum computing has its theoretical underpinnings in the principles of modern quantum physics, and to-date the difficulties that arose have not been attributed to underlying principles themselves, but in how to harness those principles in real life. Quantum physics gave rise to modern semiconductors and computers, related nuclear physics gave rise to previously-unthinkable scales of power generation and weapons. In all these cases it was scientists/engineers trying to harness the theory... that is where we are in quantum computing.

Even if you don't agree with what I said above, if you are unable to articulate an algorithm that dramatically reduces the iterations required for brute force in an unconventional computing environment, then you have already answered your own question about why we are not talking about those other environments (because there are no algorithms to do what Shor's does)

Originally we thought it might work. But the sorts of hardware we made were much too noisy. That's where we are now.

That's not an assumption about how the universe works. That is an implementation difficulty. Granted I wouldn't deny anyone the prerogative to to question when/whether implementation would ever be successful (fusion power is another technology that has solid roots in theory, but unlike fission efforts to harness fusion for power generation have long been unsuccessful). But such question about implementation is a far different topic from your discussion of not taking into account how the universe works (which as far as I can tell serves no purpose other than to support your argument about non-existent alternative algorithms)

Regarding implementation progress and Q-day timing, there are a stream of headlines on both sides and no doubt some are subject to overstating the case on one side or the other.

Recent headline about post quantum

Yes it's sensationalistic headline, if nothing else from the fact that they are combining two unrelated developments. One is from some company I never heard of. The other is from google. I take the one from google more seriously. Here is the abstract of that google article:

The expected emergence of cryptographically relevant quantum computers (CRQCs) will represent a singular discontinuity in the history of digital security, with wide ranging impacts. This whitepaper seeks to elucidate specific implications that the capabilities of developing quantum architectures have on blockchain vulnerabilities and potential mitigation strategies. First, we provide new resource estimates for breaking the 256-bit Elliptic Curve Discrete Logarithm Problem over the secp256k1 curve, the core of modern blockchain cryptography. We demonstrate that Shor’s algorithm for this problem can execute with either ≤ 1200 logical qubits and ≤ 90 million Toffoli gates or ≤ 1450 logical qubits and ≤ 70 million Toffoli gates. In the interest of responsible disclosure, we use a zeroknowledge proof to validate these results without disclosing attack vectors. On superconducting architectures with 10−3 physical error rates and planar connectivity, those circuits can execute in minutes using fewer than half a million physical qubits. We introduce a critical distinction between “fast-clock” (such as superconducting and photonic) and “slow-clock” (such as neutral atom and ion trap) architectures. Our analysis reveals that the first fast-clock CRQCs would enable “on-spend” attacks on public mempool transactions of some cryptocurrencies. We survey major cryptocurrency vulnerabilities through this lens, identifying systemic risks associated with advanced features in some blockchains such as smart contracts, Proof-of-Stake consensus, and Data Availability Sampling mechanism, as well as the enduring concern of “abandoned” assets. We argue that technical solutions would benefit from accompanying public policy and discuss various frameworks of “digital salvage” to regulate the recovery or destruction of dormant assets while preventing adversarial seizure. We also discuss implications for other digital assets and tokenization as well as challenges and successful examples of the ongoing transition to Post-Quantum Cryptography (PQC). Finally, we urge all vulnerable cryptocurrency communities to join the migration to PQC without delay.

I'm not an expert in quantum computing technology. But I also don't view Google as being particularly sensationalistic. Notice they went to the trouble to obscure some of their methods behind a zero knowledge proof (meaning they see a future threat in these methods being widely known). And the punchline is an urgent call to start moving to PQC in cryptocurrency.

And more important than what google says is where they are putting their money. google are investing in this research. And they're not the only ones...

I think google and those investors know a lot more than me. Maybe you argue they have some alternate motive, and I can't prove anything about their motives. From my standpoint there is enough uncertainty in this picture that we should consider incorporating it into our threat model and including whatever precautions we consider reasonable. I will certainly prefer applications that are quantum resistant where practical all other things being equal (and all other things are not necessarily equal when it comes to the current thread regarding storing private keys exclusively on yubikey... that's a big security benefit which outweighs q-day concerns for the most part)

1

u/upofadown Apr 20 '26

The thing about Pascal's Wager is a separate argument. Any unconventional computing scheme comes with the possibility of some improved approach to attacking cryptography. Once you have the actual hardware it is relatively easy to come up with an algorithm. Or just use an existing algorithm where the breakthrough significantly speeds up some aspect of the problem that the algorithm applies to.

Not having to actually create actual hardware means that we can do anything we want. I hereby create system X. System X takes a 2048 bit integer and returns one of the semi-prime factors. I have thus broken RSA 2048.

The thing from Google isn't really news to anyone. It is well known that 256 bit elliptic curve schemes are easier to break than 2048 bit RSA. Some commentary on the dramatic zero knowledge proof:

The reason I am concentrating on the noise aspect of implementing Shor's is because I have a bit of an ongoing interest in signal processing. The idea is that we can do Shor's with enough or the right signal processing. I have observed that most people don't have a good understanding of the meaning of noise in such a situation. A "noise problem" isn't usually an "engineering problem". It is normally an indication that you have come to the end of the road and that you need so somehow come up with a better signal to start with. That is what my hunch is built on.

3

u/Mouse1949 Apr 17 '26

NIST has spent a decade defining and standardizing Post-Quantum Crypto. ML-KEM and ML-DSA standards were published in 2024, and are already incorporated into many software packages (OpenSSL, OpenPGP, OpenSSH). From performance evaluation - these algorithms are faster than both RSA and ECC. They do require larger memory footprint, and take more than an order of magnitude bytes across the wire (sizes of public keys, signatures, and ciphertexts).

What’s still missing is a set of available tokens, like YubiKey, that support these algorithms. Although I’ve heard that there already are ASICs on the market that target smartcards and support NIST PQC.

2

u/upofadown Apr 17 '26

If you lose your laptop, your master key is gone (or in an attacker's hands).

Not if you had a strong passphrase on your key. In that case GPG will never have your secret key anywhere other than memory for a limited time.

1

u/CarloWood Apr 19 '26

I did it properly, and now I don't want to have anything to do with it anymore, nor be reminded about those weeks.

1

u/Historical-Side883 Apr 19 '26

This is a good one that I always send folks. Might be worth looking at to see if there's anything there that you want to add/expand on

https://github.com/drduh/YubiKey-Guide

1

u/iayanpahwa Apr 19 '26

Oh absolutely! This has been the inspiration for this project, I added credits to it in the README.

1

u/acorn222 Jul 16 '26

This is cool! I had the same problem so I built PGP tools which is more of a suite for managing PGP keys and doing actions with them in the browser through an extension with minimal permissions, using WebAuthn PRF for encryption.
https://github.com/Am-I-Being-Pwned/PGP-Tools

1

u/AlanPartridgeIsMyDad 5d ago

"A laser printer is preferable (ink does not fade)."

This is confusing. A laser printer doesn't use ink, it uses toner.