Adding a yubikey GPG key onto a new machine

If you are using a Yubikey encryption scheme and want to add the key onto a new system there's a few hoops to jump through. These instructions are for Ubuntu trusty.

First, get set up for using the yubikey:

sudo apt-get install gnupg-agent scdaemon pcscd pcsc-tools

you probably need to logout and back in. This post has extra setup, but I didn't have to do any of that, perhaps the gnome keyring badness has been fixed now.

Now check your yubikey is recognized:

pcsc_scan
gpg --card-status

Import the public key into the keyring and trust it:

gpg --import mykey_public_only.asc
gpg --expert --edit-key 123456
trust (set to ultimate)
save

You should now be good to go!


One more note: If you have multiple yubikeys for the same secret key and need to switch to using one of the other yubikeys I've had some problems with gpg wanting to see the card with the previous serial number, even if you delete the secret key. On the mac I found the easiest way to clean this up was to quit GPG Keychain and just remove the whole gnupg directory:

rm -rf ~/.gnupg

You should then be able to import the public key again and get it set up with the new yubikey by running:

gpg --card-status