- [Replace ssh-agent with gpg-agent](#replace-ssh-agent-with-gpg-agent)
- [Copy public key to server](#copy-public-key-to-server)
- [Connect with public key authentication](#connect-with-public-key-authentication)
- [Requiring touch to authenticate](#requiring-touch-to-authenticate)
- [Using multiple Yubikeys for same GPG-keyset](#using-multiple-yubikeys-for-same-gpg-keyset)
- [Troubleshooting](#troubleshooting)
- [Yubikey OTP Mode and cccccccc....](#yubikey-otp-mode-and-cccccccc)
- [Yubikey OTP Mode and cccccccc....](#yubikey-otp-mode-and-cccccccc)
- [References](#references)
# Purchase YubiKey
@ -150,7 +151,9 @@ You will need to install the following software:
1. [Homebrew](https://brew.sh/) package manager
2. The following brew packages:
$ brew install gnupg yubikey-personalization
```
$ brew install gnupg yubikey-personalization
```
# Creating keys
@ -1203,6 +1206,27 @@ To require a touch for the signing and encrypting keys as well:
The Yubikey will blink when it's waiting for the touch.
## Using multiple Yubikeys for same GPG-keyset
To use multiple Yubikeys (backup etc.) with same GPG-keyset repeat part [Transfer keys](#transfer-keys) for each additional key.
When executing `gpg --card-status` the inserted Yubikeys serial number will be associated to the secret keys and form stub keys. (This can be shown by running `gpg -K`, the # in sec# and the > in ssb> indicate keys are stubs and are stored on a smartcard.) If another Yubikey with different serial number is used after that this error will be shown:
`Please insert the car with serial number: [Assosiated serial number]`
The way around this is to remove the old association by deleting the files holding it and run `gpg --card-status` again. To make this handy use the script below when connecting a new Yubikey. The script needs to be **modified** to match your specific keys and having correct path to the `gpg` executable. The key filenames can be found by using `gpg --with-keygrip -K`, look for "keygrip =" and compare it to files found in `~/.gnupg/private-keys-v1.d/`