3 ms·

U2F should work with your Yubikeys, irrespective of your slot 1/2 configurations. U2F does not depend on slot provisioning. Unlike your slot/gpg keys, U2F authe

U2F should work with your Yubikeys, irrespective of your slot 1/2 configurations. U2F does not depend on slot provisioning. Unlike your slot/gpg keys, U2F authenticators are unique to each individual hardware component and cannot be replicated between Yubikeys.

jlgaddis 9y ago
I thought as much. I'm mostly curious about any possible "inter-op" issues with GnuPG and U2F functionality (for example, I have heard reports that gpg-agent would "reset" after a U2F auth and so would require a PIN on next use regardless of any timeouts; that's not a problem for me, just something I'd like to be aware of beforehand). Thanks!
- subway 9y ago
  Be prepared to pull and replace the Yubikey when switching between applets. I currently use a key configured with U2F, gpg (and ssh via gpg-agent), and oath totp. Usually it switches between applets seamlessly, requiring pin entry for gpg any time I switch back to gpg. Occasionally whichever applet I'm attempting to use will appear unavailable, requiring the token be pulled and reseated.
  - jlgaddis 9y ago
    Yeah, I've heard similar reports before and that's exactly the kind of thing I was wanting to hear about because, e.g., the Nano can be a PITA to remove sometimes -- especially on my workstation, where it is plugged into one of the USB ports on the "back" of a Das Keyboard. I don't mind punching in my PIN all the time (I already use short timeouts anyways), but removing and reinserting the Nano several times a day is inconvenient and will get annoying real quick. Thanks.
    - pfg 9y ago
      I used to run into this regularly as well, usually with gpg-agent refusing to work. I recently switched to a 4C Nano, which made it quite cumbersome to pull the key, so I looked into it and found out that reloading gpg-agent does the trick as well. I use this alias to do that quickly: alias gpgpls='gpg-connect-agent reloadagent /bye' I haven't needed to pull the key since. I'm on macOS and use gpg-agent, U2F and yubioath-desktop.
      - jlgaddis 9y ago
        Oh, excellent, that's great to know. I run Arch Linux on these particular machines but, in this case, it probably doesn't matter. Thank you.

jlgaddis 9y ago

I thought as much. I'm mostly curious about any possible "inter-op" issues with GnuPG and U2F functionality (for example, I have heard reports that gpg-agent would "reset" after a U2F auth and so would require a PIN on next use regardless of any timeouts; that's not a problem for me, just something I'd like to be aware of beforehand). Thanks!

subway 9y ago
Be prepared to pull and replace the Yubikey when switching between applets. I currently use a key configured with U2F, gpg (and ssh via gpg-agent), and oath totp. Usually it switches between applets seamlessly, requiring pin entry for gpg any time I switch back to gpg. Occasionally whichever applet I'm attempting to use will appear unavailable, requiring the token be pulled and reseated.
- jlgaddis 9y ago
  Yeah, I've heard similar reports before and that's exactly the kind of thing I was wanting to hear about because, e.g., the Nano can be a PITA to remove sometimes -- especially on my workstation, where it is plugged into one of the USB ports on the "back" of a Das Keyboard. I don't mind punching in my PIN all the time (I already use short timeouts anyways), but removing and reinserting the Nano several times a day is inconvenient and will get annoying real quick. Thanks.
  - pfg 9y ago
    I used to run into this regularly as well, usually with gpg-agent refusing to work. I recently switched to a 4C Nano, which made it quite cumbersome to pull the key, so I looked into it and found out that reloading gpg-agent does the trick as well. I use this alias to do that quickly: alias gpgpls='gpg-connect-agent reloadagent /bye' I haven't needed to pull the key since. I'm on macOS and use gpg-agent, U2F and yubioath-desktop.
    - jlgaddis 9y ago
      Oh, excellent, that's great to know. I run Arch Linux on these particular machines but, in this case, it probably doesn't matter. Thank you.