These instructions are base on: https://github.com/drduh/YubiKey-Guide

Key managment:

As you will need to use copy and paste in screen to copy passphrase remember that keybindings are Ctrl+a [ and Ctrl+a]

Requirements:

• Empty USB stick
• SD card with encrypted keys
• Creating and booting bootable image
  • Build image with bootable nixos from nix-profiles repo.
  • Write image to USB stick using dd
  • Boot USB stick, usually in UEFI mode.
  • Find SD card with encrypted keys (SD card disks are usually named mmcblk0)
  • Mount encrypted partition on /mnt/enc
  • Mount plain partition on /mnt/plain
  • Boot image on clean laptop not connected to the internet

Key generation

• Generate master passphrase: gpg --gen-random -a 0 24 > /mnt/enc/gpg/gatehub/passphrase
• Create master key: gpg --expert --full-generate-key
  • (8) RSA (set your own capabilities)
  • (E) Toggle the encrypt capability
  • (S) Toggle the sign capability
  • (Q) Finished
  • 0 = key does not expire
• Export key ID: export KEYID=0xFF3E7D88647EBCDB
• Create subkeys: gpg --expert --edit-key
  • Signin subkey:
    • addkey
    • (4) RSA (sign only)
    • Keysize 4096 (if you have old yubikey use keysize 2048)
    • 1y = key expires in n years
  • Encryption subkey:
    • addkey
    • (6) RSA (encrypt only)
    • Keysize 4096 (if you have old yubikey use keysize 2048)
    • 1y = key expires in n years
  • Authentication subkey:
    • addkey
    • (8) RSA (set your own capabilities)
    • (S) Toggle the sign capability
    • (E) Toggle the encrypt capability
    • (A) Toggle the authenticate capability
    • (Q) Finished
    • Keysize 4096 (if you have old yubikey use keysize 2048)
    • 1y = key expires in n years

Verify and backup:

• $ gpg -K /tmp.FLZC0xcM/pubring.kbx --------------------------------—--------------------------------------- sec rsa4096/0xFF3E7D88647EBCDB 2017-10-09 [C] Key fingerprint = 011C E16B D45B 27A5 5BA8 776D FF3E 7D88 647E BCDB uid Dr Duh <[email protected]> ssb rsa4096/0xBECFA3C1AE191D15 2017-10-09 [S] [expires: 2018-10-09] ssb rsa4096/0x5912A795E90DD2CF 2017-10-09 [E] [expires: 2018-10-09] ssb rsa4096/0x3F29127E79649A3D 2017-10-09 [A] [expires: 2018-10-09]
• Export master key gpg --armor --export-secret-keys $KEYID > /mnt/enc/gpg/project/mastersub.key
• Export master subkeys gpg —armor --export-secret-subkeys $KEYID > /mnt/env/project/sub.key
• Export public key gpg --armor --export $KEYID | tee /mnt/public/$KEYID-$(date +%F).txt

Configure yubikey: