How to Encrypt, Decrypt, Sign & Verify with Your GPG + Yubikey

This is a guide to using YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can also be used for SSH. Many of the principles in this document are applicable to other smart card devices.

Keys stored on YubiKey are non-exportable (as opposed to file-based keys that are stored on disk) and are convenient for everyday use. Instead of having to remember and enter passphrases to unlock SSH/GPG keys, YubiKey needs only a physical touch after being unlocked with a PIN code. All signing and encryption operations happen on the card, rather than in OS memory.

I forgot to mention how to set up the touch feature of the yubikey, here are the commands:
$ ykman openpgp touch aut on
$ ykman openpgp touch sig on
$ ykman openpgp touch enc on

Get Tails:

Get a Chaos Key:

Get at least 1 Yubikey:

Get at least 3 USB sticks.

If you learned something valuable, donate Bitcoin to Max: 3DqEnU6dW6bZesrVdThrrQjQKgN7dpY5vv
Support the show by buying bitcoin on

Check out the GPG series by 402 Payment Required:

Listen to WCN Audio Podcasts:

Check out the brand new
Find out more about Max

Follow WCN on Twitter:

Follow Max on Twitter:

Contribute to Max’s Bachelor Thesis on Multi Signature in Lightning Network Payments:

Bitcoin to the Max:

Read Rothbard ~ Use Bitcoin:

Open Source Everything:

Hackers Congress Paralelni Polis 2018:

Baltic Honeybadger 2018:

Nodl Personal Bitcoin Assistant:

Bisq Decentralized Exchange:

ColdCard Wallet:

Purism:

Bitcoin Op Tech Newsletter:

What Has Government Done to Our Money? By Murray Rothbard:
Mises University:

Hayek Summer Workshop: