Yubikey
YubicoBitwardenGPG ToolsDonate Coffee
General
General
  • Introduction
    • Getting Started
    • Terms
    • FAQ
    • NFC vs FIPS
    • Securing Your Footprint
  • Tutorials
    • ⭕Bitwarden
    • ⭕Bitlocker
    • ⭕Code Signing
    • ⭕EFS
    • ⭕Github Desktop
    • ⭕KeePassXC
    • ⭕SSH + PuTTY-CAC
      • 🟣PIV-PKCS
      • 🟣PIV-CAPI
      • 🟣GPG
      • ⭕Configs
        • 📄gpg.conf
        • 📄gpg-agent.conf
        • 📄scdaemon.conf
    • ⭕Battle.net OTP
    • ⭕Steam OTP
    • ⭕Veracrypt
  • GUIDES
    • ⭕Setting up a New Key
      • 🟣Minimal Version
    • ⭕Securing Your Credentials
    • ⭕Setting up CLI / ykman
    • ⭕Setting up CLI / GPG
    • ⭕Mysterious Certificates
    • ⭕Understanding PINs
      • 🟣FIDO2
      • 🟣GPG
      • 🟣PIV
    • ⭕Yubikey Firmware
  • CHEATSHEETS
    • ⭕Environment Variables
    • ⭕Files/Abbreviations
    • ⭕OpenSSL
      • 🟣slot_9a.cnf
      • 🟣slot_9c.cnf
      • 🟣slot_9d.cnf
      • 🟣slot_9e.cnf
    • ⭕PEM Types
    • ⭕Usage Types
      • 🟣KeyUsage
      • 🟣KeyUsageProperty
      • 🟣extendedKeyUsage
      • 🟣KeyProtection
      • 🟣KeySpec
Powered by GitBook
On this page
  • PIV -> PIN RETRIES
  • PIV -> CHANGE PIN
  • PIV -> CHANGE PUK
  • PIV -> MANAGEMENT KEY
  • PIV -> IMPORT KEYS TO SLOT
  • PIV -> RESET
  • GPG -> PIN RETRIES
  • GPG -> CHANGE PIN
  • GPG -> PERSONAL INFORMATION
  • GPG -> TOUCH POLICIES
  • GPG -> SIGNATURE PIN
  • GPG -> KDF-SETUP
  • GPG -> RESET
  • OTP -> NO ENTER
  • YKMAN -> CHANGE-LOCK-CODE

Was this helpful?

  1. GUIDES
  2. Setting up a New Key

Minimal Version

Provides the same instructions as in the parent guide "Setting up a New Key", however, contains a list of straight to the point commands for people who already know how to enter them.

PreviousSetting up a New KeyNextSecuring Your Credentials

Last updated 2 years ago

Was this helpful?

Open Command Prompt, Terminal, or Powershell:

PIV -> PIN RETRIES

ykman piv access set-retries 5 5

PIV -> CHANGE PIN

default: 123456

ykman piv access change-pin

PIV -> CHANGE PUK

default: 12345678

ykman piv access change-puk

default: 010203040506070801020304050607080102030405060708

ykman piv access change-management-key -g -p
ykman piv access change-management-key -pt -a TDES -n 012203040104040801020305050627080102030405060708
ykman piv access change-management-key -t -a AES256 -n 9000000000000000000000000000000000000000000000000000000000000000

PIV -> IMPORT KEYS TO SLOT

ykman piv keys import --touch-policy ALWAYS --pin-policy ALWAYS 9c "C:\path\cert_9c.pfx"
ykman piv certificates import 9c "C:\path\cert_9c.pfx"

PIV -> RESET

If you mess up and want to reset PIV:

ykman piv reset

ykman openpgp access set-retries 10 5 10

GPG -> CHANGE PIN

default USER PIN: 123456

default ADMIN PIN: 12345678

gpg --card-edit
admin
passwd

-----------------------------------------
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

GPG -> PERSONAL INFORMATION

Type each command in the list below. Enter the information requested after you type each one:

name
login
lang
sex
url
gpg/card> save
gpg/card> quit

GPG -> TOUCH POLICIES

ykman openpgp keys set-touch sig on
ykman openpgp keys set-touch enc on
ykman openpgp keys set-touch aut on
ykman openpgp keys set-touch att on

GPG -> SIGNATURE PIN

$ gpg --card-edit

admin
forcesig

GPG -> KDF-SETUP

To enable KDF, you must enable this before any GPG keys are imported on your Yubikey. If you import GPG keys before enabling KDF and attempt to enable KDF later; you will receive the error:

gpg: error for setup KDF: Conditions of use not satisfied

$ gpg --card-edit

admin
kdf-setup

GPG -> RESET

If you mess up and want to reset GPG:

ykman openpgp reset

OTP -> NO ENTER

Halts Yubikey from automatically pressing "Enter" each time slot 1 or 2 is pressed.

ykman otp settings 1 --no-enter
ykman otp settings 2 --no-enter

YKMAN -> CHANGE-LOCK-CODE

At present time, there appears to be NO way to reset this if you forget the code. You will be completely unable to ever change settings on your Yubikey again. Use at your own risk.

A lock code may be used to protect the application configuration. The lock code must be a 32 characters (16 bytes) hex value.

GENERATE NEW CODE

ykman config set-lock-code --generate

Using a randomly generated lock code: cce9181f4a97bac00459419986510d40
Lock configuration with this lock code? [y/N]: y

SPECIFY NEW LOCK CODE

ykman config set-lock-code --new-lock-code HEX

PIV -> MANAGEMENT KEY

GPG -> PIN RETRIES

To enable KDF after you have already imported GPG keys means that you'll need to and start over.

⭕
🟣
reset your GPG interface
Docs
Docs
Docs
Docs
Docs