{"id":293,"date":"2018-01-03T21:55:02","date_gmt":"2018-01-03T20:55:02","guid":{"rendered":"http:\/\/www.ingby.com\/?p=293"},"modified":"2018-01-03T21:55:02","modified_gmt":"2018-01-03T20:55:02","slug":"pgp-and-yubikey","status":"publish","type":"post","link":"https:\/\/www.ingby.com\/?p=293","title":{"rendered":"PGP and Yubikey"},"content":{"rendered":"

I was trying to implement client side encryption of files backed up to AWS S3 using Duplicity<\/a>, with keys on my Yubikey Neo<\/a> created on an air gapped installation<\/a>. It worked with local PGP keys, but I didn’t get it to decrypt using my PGP key on the Yubikey<\/p>\n

TL;DR<\/h2>\n

Verify that you have the right pin and or it hasn’t been blocked…<\/p>\n

Testing<\/h2>\n

To rule out Duplicity I performed a simple encryption<\/p>\n

Encrypt
\n$ echo \"Hello\" |gpg2 -e > test.enc
\nCurrent recipients:
\nrsa2048\/2ABD****<\/strong> 2017-07-17
\n<\/code><\/p>\n

Decrypt
\n$ gpg2 -d < test.enc
\ngpg: encrypted with 2048-bit RSA key, ID 2ABD****, created 2017-07-17
\ngpg: public key decryption failed: Card error
\ngpg: decryption failed: No secret key<\/code><\/p>\n

Issuing this command prompted me for my pin. However, the error wasn’t clear on that the pin was wrong or blocked.<\/p>\n

Troubleshooting gpg agent<\/h2>\n

First I killed the existing gpg-agent and started a new one in the console with debug logging:
\n
\n$ ps aux|gpg-agent
\n$ kill 12345
\n$ gpg-agent --daemon --no-detach -v -v --debug-level advanced --homedir ~\/.gnupg
\n<\/code><\/p>\n

which gave me this information:
\n
\ngpg-agent[20808]: DBG: chan_5 -> INQUIRE PINENTRY_LAUNCHED 25484
\ngpg-agent[20808]: DBG: chan_5 <- END\ngpg-agent[20808]: DBG: chan_6 -> [ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...(76 byte(s) skipped) ]
\ngpg-agent[20808]: DBG: chan_6 -> END
\ngpg-agent[20808]: DBG: chan_6 <- ERR 100663404 Card error
\ngpg-agent[20808]: smartcard decryption failed: Card error
\ngpg-agent[20808]: command 'PKDECRYPT' failed: Card error
\ngpg-agent[20808]: DBG: chan_5 -> ERR 100663404 Card error
\ngpg-agent[20808]: DBG: chan_5 <- [eof]\ngpg-agent[20808]: DBG: chan_6 -> RESTART
\ngpg-agent[20808]: DBG: chan_6 <- OK\n<\/code><\/p>\n

This command 'PKDECRYPT' failed: Card error<\/em> originally got me wandering of in the wrong direction, but let's keep the story short(er).<\/p>\n

I checked if my Yubikey actually have that key 2ABD****:<\/p>\n


\n$ gpg2 --card-status <\/p>\n

Reader ...........: Yubico Yubikey NEO OTP U2F CCID 01 00
\nApplication ID ...: ****************
\nVersion ..........: 2.0
\nManufacturer .....: Yubico
\nSerial number ....: 01234567
\nName of cardholder: Christer Barreholm
\nLanguage prefs ...: sv
\nSex ..............: unspecified
\nURL of public key : **************
\nLogin data .......: christer
\nSignature PIN ....: forced
\nKey attributes ...: rsa2048 rsa2048 rsa2048
\nMax. PIN lengths .: 127 127 127
\nPIN retry counter : 0 3 3<\/b>
\nSignature counter : 1
\nSignature key ....: **** **** **** **** **** **** **** **** 7E86 ****
\n created ....: 2017-07-17 12:28:59
\nEncryption key....: **** **** **** **** **** **** **** **** 2ABD ****
\n created ....: 2017-07-17 12:29:13
\nAuthentication key: **** **** **** **** **** **** **** **** 55FD ****
\n created ....: 2017-07-17 12:31:46
\nGeneral key info..: sub rsa2048\/7E866DD0 2017-07-17 Christer Barreholm
\nsec# rsa4096\/A56F**** created: 2017-07-17 expires: 2018-01-16
\nssb> rsa2048\/7E86**** created: 2017-07-17 expires: 2018-01-16
\n card-no: 0006 01234567
\nssb> rsa2048\/2ABD**** created: 2017-07-17 expires: 2018-01-16<\/b>
\n card-no: 0006 01234567
\nssb> rsa2048\/55FD**** created: 2017-07-17 expires: 2018-01-16
\n card-no: 0006 01234567
\n<\/code><\/p>\n

The key is there, but then I noticed PIN retry counter: 0 3 3. <\/p>\n


\n$ gpg2 --change-pin
\ngpg: OpenPGP card no. ******************************* detected<\/p>\n

1 - change PIN
\n2 - unblock PIN
\n3 - change Admin PIN
\n4 - set the Reset Code
\nQ - quit<\/p>\n

Your selection? 2
\nPIN unblocked and new PIN set.
\n<\/code><\/p>\n


\n$ gpg2 --card-status
\n...
\nPIN retry counter : 3 3 3
\n...
\n<\/code><\/p>\n

Looks better.<\/p>\n

Another try to decrypt:
\n
\n$ gpg2 -d < test.enc \ngpg: encrypted with 2048-bit RSA key, ID 2ABD****, created 2017-07-17\nHello\n<\/code><\/p>\n

Success!<\/p>\n

Event longer story<\/h2>\n

I tried this back in July, but eventually gave up. There were indications that the issue was related to stubbed keys in the keyring.
\nBelow are some of the resources that got me in the wrong direction, but still interesting.<\/p>\n

Issues with primary key & subkeys on different smartcards<\/a>
\n[Resolved] Trouble with GPG --card-status<\/a>
\nYubiKey Guide<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I was trying to implement client side encryption of files backed up to AWS S3 using Duplicity, with keys on my Yubikey Neo created on an air gapped installation. It worked with local PGP keys, but I didn’t get it to decrypt using my PGP key on the Yubikey TL;DR Verify that you have the … Forts\u00e4tt l\u00e4sa PGP and Yubikey<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[28],"tags":[],"_links":{"self":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/293"}],"collection":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=293"}],"version-history":[{"count":3,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/293\/revisions"}],"predecessor-version":[{"id":296,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/293\/revisions\/296"}],"wp:attachment":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}