How to use the command 'ykman openpgp' (with examples)

This article will guide you through various use cases of the command ‘ykman openpgp’, which is used to manage the OpenPGP application on a YubiKey. The OpenPGP application allows for secure key management for encryption and digital signatures. By using the ‘ykman openpgp’ command, you can perform tasks such as displaying general information, setting retry attempts, changing PINs, and performing a factory reset.

Use case 1: Display general information about the OpenPGP application

Code:

ykman openpgp info

Motivation: You might want to know the current configuration and details of the OpenPGP application on your YubiKey, such as version, status, supported algorithms, and key information.

Explanation: The ‘info’ command is used to display general information about the OpenPGP application on the YubiKey.

Example output:

OpenPGP version: 3.4.7
Smart card ID: D2760001240102010005000000070000
Serial number: 12345678
Application version: 4.3.9
PIN retries: 5

Use case 2: Set the number of retry attempts for the User PIN, Reset Code, and Admin PIN

Code:

ykman openpgp access set-retries 3 3 3

Motivation: You may want to customize the number of retry attempts allowed for the User PIN, Reset Code, and Admin PIN according to your security requirements.

Explanation: The ‘access set-retries’ command is used to set the number of retry attempts for the User PIN, Reset Code, and Admin PIN, respectively.

Example output:

Retries updated successfully.

Use case 3: Change the User PIN, Reset Code, or Admin PIN

Code:

ykman openpgp access change-pin|reset-code|admin-pin

Motivation: It is recommended to periodically change PINs to maintain the security of your OpenPGP application. You may also need to change a PIN if you have forgotten it.

Explanation: The ‘access change-pin|reset-code|admin-pin’ command is used to change the User PIN, Reset Code, or Admin PIN, respectively. You will be prompted to enter the current PIN and then set a new PIN.

Example output:

Enter current User PIN:
Enter new User PIN:
Confirm new User PIN:
User PIN changed successfully.

Use case 4: Factory reset the OpenPGP application

Code:

ykman openpgp reset

Motivation: If you exceed the number of retry attempts for the Admin PIN, the YubiKey’s OpenPGP application needs to be factory reset to regain access.

Explanation: The ‘reset’ command is used to perform a factory reset of the OpenPGP application on the YubiKey. This deletes all keys, certificates, and settings stored in the application.

Example output:

OpenPGP application reset successfully.

Conclusion:

The ‘ykman openpgp’ command provides a convenient way to manage the OpenPGP application on a YubiKey. You can use it to display information, configure retry attempts, change PINs, and perform a factory reset. By mastering these use cases, you can effectively manage the security and settings of your YubiKey’s OpenPGP application.