# With Commandline

<figure><img src="/files/ON59pyRuDUGf4oVP3x3e" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Before getting started, make sure you have configured your Yubikey with PINs that you have assigned and not the default PINs that come with the Yubikey.

\
[**Read about configuring your GPG PINs here.**](/yubikey5/gpg/getting-started/2.-pins.md)
{% endhint %}

{% hint style="info" %}
This guide requires one device of any in the following categories:

* [x] [YubiKey 5 Series](https://www.yubico.com/store/#yubikey-5-series)
* [x] [YubiKey 5 FIPs Series](https://www.yubico.com/store/#yubikey-5-fips-series)
  {% endhint %}

## <mark style="color:red;">❊ Before You Start</mark>

We highly recommend before continuing with this guide that you view the [**GPG Introduction**](/yubikey5/gpg/generate-keys/introduction.md) page for a brief description of what GPG keys do and the differences between Yubikey vs Software generated keys. It only takes a minute.

## <mark style="color:red;">❊ Generating Keys</mark>

This section utilizing the <mark style="color:red;">**gpg command-line**</mark> to generate keys. Be sure to have GPG installed. If  unsure, read the [**GPG installation guide**](/yubikey5/guides/setting-up-cli-gpg.md).

### <mark style="color:blue;">MASTER KEY \[C]</mark>

Launch <mark style="color:blue;">**Command Prompt**</mark>, <mark style="color:blue;">**Terminal**</mark>, or <mark style="color:blue;">**Powershell**</mark>.

Run command:

```
gpg --expert --full-generate-key
```

You will see a list of options:

```properties
Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
>  (8) RSA (set your own capabilities)
   (9) ECC (sign and encrypt) *default*
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (13) Existing key
  (14) Existing key from card
```

Select <mark style="color:blue;">**`(8) RSA (set your own capabilities)`**</mark>

You will be asked a series of questions. Select the options below:

```properties
Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Sign Certify Encrypt

   (S) Toggle the sign capability
>  (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? E

Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Sign Certify

>  (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? S

Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Certify

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
>  (Q) Finished

Your selection? Q
```

When asked for the desired key size, select <mark style="color:blue;">**`4096`**</mark>

```properties
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
```

Specify when you want the key to expire:

```properties
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
    
Key is valid for? (0)    0

Key does not expire at all

Is this correct? (y/N)    y
```

Enter your name, email address, and a comment for the key:

```properties
GnuPG needs to construct a user ID to identify your key.

Real name:           Your Name
Email address:       your@emailaddress.com
Comment:             A comment to recognize your key
```

GPG will then confirm your answers:

```properties
You selected this USER-ID:
    "Oort <johndoe@email.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
```

Select <mark style="color:blue;">**`O`**</mark> for <mark style="color:blue;">**`(O)kay`**</mark>

You will be prompted for a password / passphrase either via a dialog box like the screenshot below, or in the console window:

<figure><img src="/files/7mxsJ73xIT2WL0rlvaov" alt=""><figcaption></figcaption></figure>

Create a strong passphrase and press OK.

If you create a weak password, it will warn you to change it.

GPG will request you to move your mouse:

```properties
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
```

Simply move your mouse, open/close windows. Do as many actions on your device as you can while it generates to help with entropy.

The system will output a path to your revocation certificate. Save this file somewhere.

```properties
gpg: revocation certificate stored as 'C:\\Users\\aetherinox\\AppData\\Roaming\\gnupg\\openpgp-revocs.d\\848103E9F1FFEC33DDD58C2B161C667B11784BF7.rev'
public and secret key created and signed.
```

GPG will display your generated key:

```sas
pub   rsa4096 2023-01-31 [C]
      848103E9F1FFEC33DDD58C2B161C667B11784BF7
uid                      John Doe (My demo key) <johndoe@email.com>
```

You'll notice that this is only the <mark style="color:orange;">**`[C]`**</mark>ertify key.  We're missing <mark style="color:blue;">**`[A]`**</mark>uthentication, <mark style="color:yellow;">**`[S]`**</mark>ignature  and <mark style="color:green;">**`[E]`**</mark>ncryption.

### <mark style="color:blue;">SUBKEY \[S]</mark>

Next, create a subkey with the <mark style="color:yellow;">**`[S]ignature`**</mark> capability.&#x20;

Take note of the <mark style="color:blue;">**`key id`**</mark> that is provided in the console. In this example we'll use <mark style="color:blue;">**`848103E9F1FFEC33DDD58C2B161C667B11784BF7`**</mark>

Execute command:

```livescript
gpg --expert --edit-key 848103E9F1FFEC33DDD58C2B161C667B11784BF7
```

Console will go into gpg edit mode and show your key info:

```sass
sec  rsa4096/161C667B11784BF7
     created: 2023-01-31  expires: never       usage: C
     trust: ultimate      validity: ultimate

[ultimate] (1). John Doe (My demo key) <johndoe@email.com>

gpg>
```

Execute command:

```
addkey
```

You will be presented with a list of options:

```properties
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
  (14) Existing key from card
```

Select <mark style="color:blue;">**`(4) RSA (sign only)`**</mark>

You will then be asked for a key size. Enter <mark style="color:blue;">**`4096`**</mark>

```
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
```

Set an expiration time:

```properties
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
      
Key is valid for? (0) 0
```

Confirm your changes.

You will be prompted to enter the passphrase you selected when you made the [**Masterkey** ](#master-key-c)in the steps above. Enter that passphrase.

Move your mouse around to generate entropy.

We now have a <mark style="color:yellow;">master key</mark> <mark style="color:orange;">**`[C]ertify`**</mark>, and one <mark style="color:yellow;">sub key</mark> <mark style="color:red;">**`[S]ignature`**</mark>:

```sass
sec  rsa4096/161C667B11784BF7
     created: 2023-01-31  expires: never       usage: C
     trust: ultimate      validity: ultimate

ssb  rsa4096/88614F297B2B2542
     created: 2023-01-31  expires: never       usage: S

[ultimate] (1). John Doe (My demo key) <johndoe@email.com>
```

### <mark style="color:blue;">SUBKEY \[E]</mark>

Create a subkey with the <mark style="color:green;">**`[E]ncryption`**</mark> capability.

&#x20;

Execute the command:

```
addkey
```

You will be presented with a list of options:

```properties
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
  (14) Existing key from card
```

Select <mark style="color:blue;">**`(6) RSA (encrypt only)`**</mark>

For key size, enter <mark style="color:blue;">**`4096`**</mark>

```
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
```

Select an expiration time:

```properties
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
      
Key is valid for? (0) 0
```

Confirm your changes.

You will be prompted to enter the passphrase you selected when you made the [**Masterkey** ](#master-key-c)in the steps above. Enter that passphrase.

Move your mouse to generate entropy.

We now have a <mark style="color:yellow;">master key</mark> <mark style="color:orange;">**`[C]ertify`**</mark>, and two <mark style="color:yellow;">sub keys</mark> <mark style="color:red;">**`[S]ignature,`**</mark>**` `**<mark style="color:green;">**`[E]ncryption`**</mark>:

```sass
sec  rsa4096/161C667B11784BF7
     created: 2023-01-31  expires: never       usage: C
     trust: ultimate      validity: ultimate
     
ssb  rsa4096/88614F297B2B2542
     created: 2023-01-31  expires: never       usage: S
     
ssb  rsa4096/3272622E5D653058
     created: 2023-01-31  expires: never       usage: E
     
[ultimate] (1). John Doe (My demo key) <johndoe@email.com>
```

### <mark style="color:blue;">SUBKEY \[A]</mark>

Create a subkey with the <mark style="color:blue;">**`[A]uthenticate`**</mark> capability.

&#x20;

Execute the command:

```
addkey
```

Select the options pasted below:

```properties
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
>  (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
  (14) Existing key from card
  
Your selection? 8

Possible actions for this RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt

>  (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? S

Possible actions for this RSA key: Sign Encrypt Authenticate
Current allowed actions: Encrypt

   (S) Toggle the sign capability
>  (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? E

Possible actions for this RSA key: Sign Encrypt Authenticate
Current allowed actions:

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
>  (A) Toggle the authenticate capability
   (Q) Finished

Your selection? A

Possible actions for this RSA key: Sign Encrypt Authenticate
Current allowed actions: Authenticate

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
>  (Q) Finished

Your selection? Q
```

Select <mark style="color:blue;">**`(6) RSA (encrypt only)`**</mark>

For key size, enter <mark style="color:blue;">**`4096`**</mark>

```
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
```

Select an expiration time:

```properties
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
      
Key is valid for? (0) 0
```

Confirm your changes.

You will be prompted to enter the passphrase you selected when you made the Masterkey in the steps above. Enter that passphrase.

Move your mouse around to generate entropy.

Your list should look similar to the following:

```sass
sec  rsa4096 / 161C667B11784BF7
     created:  2023-01-31  expires: never       usage: C
     trust:    ultimate    validity: ultimate
     
ssb  rsa4096 / 88614F297B2B2542
     created:  2023-01-31  expires: never       usage: S
     
ssb  rsa4096 / 3272622E5D653058
     created:  2023-01-31  expires: never       usage: E
     
ssb  rsa4096 / F8BD0C1A3EB787A2
     created:  2023-01-31  expires: never       usage: A
     
[ultimate] (1). John Doe (My demo key) <johndoe@email.com>
```

Type <mark style="color:blue;">**`save`**</mark> and the word <mark style="color:blue;">**`quit`**</mark>

## <mark style="color:red;">❊ Overview</mark>

You now have a GPG key pair with one master key strictly assigned to certify any new subkeys in the future, and three subkeys.

<table><thead><tr><th width="226">Key ID</th><th width="192">Type</th><th width="140">Capability</th><th width="92">Master</th><th>Sub</th></tr></thead><tbody><tr><td><mark style="color:red;"><strong><code>161C667B11784BF7</code></strong></mark></td><td>[<mark style="color:red;"><code>sec</code></mark>] Secret Key</td><td>Certify</td><td><img src="/files/XnVmEp1PgZ0Vb0YwfNIT" alt=""></td><td></td></tr><tr><td><mark style="color:red;"><strong><code>88614F297B2B2542</code></strong></mark></td><td>[<mark style="color:red;"><code>ssb</code></mark>] Secret Sub</td><td>Sign</td><td></td><td><img src="/files/XnVmEp1PgZ0Vb0YwfNIT" alt=""></td></tr><tr><td><mark style="color:red;"><strong><code>3272622E5D653058</code></strong></mark></td><td>[<mark style="color:red;"><code>ssb</code></mark>] Secret Sub</td><td>Encrypt</td><td></td><td><img src="/files/XnVmEp1PgZ0Vb0YwfNIT" alt=""></td></tr><tr><td><mark style="color:red;"><strong><code>F8BD0C1A3EB787A2</code></strong></mark></td><td>[<mark style="color:red;"><code>ssb</code></mark>] Secret Sub</td><td>Authenticate</td><td></td><td><img src="/files/XnVmEp1PgZ0Vb0YwfNIT" alt=""></td></tr></tbody></table>

## <mark style="color:red;">❊ Export</mark>

Export your keys to a location on your device with the command:

```
gpg --list-secret-keys --keyid-format=short
```

A list of your keys will appear:

```
sec   rsa4096/11784BF7 2023-01-31 [C]
      848103E9F1FFEC33DDD58C2B161C667B11784BF7
uid         [ultimate] John Doe (My demo key) <johndoe@email.com>
ssb   rsa4096/7B2B2542 2023-01-31 [S]
ssb   rsa4096/5D653058 2023-01-31 [E]
ssb   rsa4096/3EB787A2 2023-01-31 [A]
```

Copy the <mark style="color:yellow;">**key id**</mark> on the top key labeled <mark style="color:red;">**`sec`**</mark>

### <mark style="color:blue;">PUBLIC KEY</mark>

Export your public key, enter your key id and tell the command where to export:

```
gpg --output "C:\path\yourkey_pub.gpg" --export 11784BF7
```

### <mark style="color:blue;">PRIVATE KEY</mark>

Export your private key, enter your key id and tell the command where to export:

```
gpg --output "C:\path\yourkey_priv.gpg" --export-secret-key 11784BF7
```

{% hint style="info" %}
Take note of the command difference between exporting your public and private keys.

To export your public key, use the command <mark style="color:red;">**`--export`**</mark>\
To export your private key, use the command <mark style="color:red;">**`--export-secret-key`**</mark>
{% endhint %}

### <mark style="color:blue;">SUBKEY</mark>

To export a subkey, use the command below and change the path / key id.

```
gpg --output "C:\path\yourkey_subkey_priv.gpg" --export-secret-subkeys 7B2B2542
gpg --output "C:\path\yourkey_subkey_priv.gpg" --export-secret-subkeys 5D653058
gpg --output "C:\path\yourkey_subkey_priv.gpg" --export-secret-subkeys 3EB787A2
```

### <mark style="color:blue;">OPENSSH</mark>

Export your SSH key, copy your master key id and execute:

```
gpg --output "C:\path\yourkey_ssh_rsa.pub" --export-ssh-key 11784BF7
```

{% hint style="info" %}
When exporting your SSH key, you can use either your **master key** id, or your **\[A]uthenticate** key id. You cannot export an SSH key using the \[S] and \[E] keys.
{% endhint %}

### <mark style="color:blue;">UPLOAD TO KEYSERVER</mark>

To upload your GPG key to an online keyserver; you can utilize one of the following commands. Be sure to replace <mark style="color:red;">**`11784BF7`**</mark> with your master key id.

```
gpg --send-key 11784BF7
gpg --keyserver pgp.mit.edu --send-key 11784BF7
gpg --keyserver keys.gnupg.net --send-key 11784BF7
gpg --keyserver hkps://keyserver.ubuntu.com:443 --send-key 11784BF7
```

If you'd like to upload your exported GPG key to a keyserver using a physical interface, check out the list of keyserver websites on the [**`GPG Introduction page`**](/yubikey5/gpg/generate-keys/introduction.md#popular-keyservers).

## <mark style="color:red;">❊ Import to Yubikey</mark>

Unlike the PIV interface, there is no GUI (graphical user interface) that allows you to directly import your GPG keys using a program such as Yubikey Manager.

Select your method of importing:

{% content-ref url="/pages/YsVoLhZ30MF8iHuxtSyW" %}
[With Commandline](/yubikey5/gpg/import-to-yubikey/with-commandline.md)
{% endcontent-ref %}

{% content-ref url="/pages/HBlghcDqmSylMuGpG2q5" %}
[With Kleopatra](/yubikey5/gpg/import-to-yubikey/with-kleopatra.md)
{% endcontent-ref %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://yubico.gitbook.io/yubikey5/gpg/generate-keys/with-commandline.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.