How do I encrypt an email using a Yubikey?

Question

I am fairly new to PGP encryption. I generated a new key pair last week on a Yubikey, while previously I had only used a private key that I generated on my machine. I use thunderbird enigmail for key management. This is probably a stupid question but I don't actually understand how to encrypt an email using the private key stored on my Yubikey. I can decrypt just fine but can't figure out how to compose an encrypted email from the new key. Using my old key pair, it's automatic - how do I actually encrypt using the right private key? At what point do I enter the Yubikey and pin? (I'm not all that technical and I use encryption for one specific project, so I appreciate dumbing down something that is probably very obvious.)

Answer 1

Using keys generated on a Yubikey is a practically identical process to using your old keys, with one extra step of set up.

To use keys stored on a Yubikey, you need "key stubs" registered on your PGP system. Basically, these are references that tell your PGP software "This private key is located on smartcard number #123456." Once you have the stubs to the keys you need, Enigmail should treat the Yubikey-stored keys like any other PGP key.

I'm only familiar with GnuPG, so specifics may vary, but using GPG you need to

1. Have a copy of the public key imported to your system from a key server or the like.

2. Import key stubs from your smart card (in this case, your Yubikey) using:

   gpg --card-status
   

After that, checking your private keyring should reflect that you have stubs pointing to private keys stored on a smart card (denoted by the > after sub). I.E.

gpg --list-secret-keys
----------------------------------------------------
sec#  rsa2048 2018-01-02 [C] [expires: 2020-01-02]
      ABCDEF123456789ABCDEF123456789ABCDEF1234
uid           [ ultimate] My Name (My PGP key) <anAddress@somesite.com>
ssb>  rsa2048 2018-01-02 [S] [expires: 2018-12-31]
ssb>  rsa2048 2018-01-02 [E] [expires: 2018-12-31]
ssb>  rsa2048 2018-01-02 [A] [expires: 2018-12-31]

At this point you can use sub keys of CDEF1234 as if there were on your system. Your PGP software ought to handle checking the card is inserted and dealing with PIN entry.