# yubicrypt

An easy to use command-line public key encryption program for your YubiKey.

Supported YubiKey algorithms:

For encryption with slot 9d:

RSA: 2048, 3072, 4096 bits

For signing with slot 9c:

ECC: P-256, P-384, Ed25519

Simply use Yubico Authenticator to create your signing and   
encryption certificate and export your encryption certificate,     
to give it to your friends. You don't have to export your signing   
certificate, because it is not needed for signature verification.    

If you use Linux (Debian/Ubuntu) you may have to do the following  
in order that yubicrypt works.  

Install PC/SC daemon and tools  
sudo apt update  
sudo apt install pcscd pcsc-tools  
  
Start the PC/SC daemon   
sudo systemctl start pcscd  

Enable it to start automatically on boot  
sudo systemctl enable pcscd  

Check the status to ensure it's running  
sudo systemctl status pcscd  

## CLI usage

Build the CLI:

```sh
go build -o yubicrypt .
```

Commands:

```sh
./yubicrypt help
./yubicrypt cards
./yubicrypt encrypt --key alice.crt -i msg.txt -o msg.yc
printf '%s\n' "$PIV_PIN" | ./yubicrypt decrypt --pin-stdin -i msg.yc -o msg.txt
printf '%s\n' "$PIV_PIN" | ./yubicrypt sign --pin-stdin -i msg.txt -o msg.sig.txt
./yubicrypt verify -i msg.sig.txt --public-key
./yubicrypt pad --text "message" -o padded.txt
./yubicrypt unpad -i padded.txt -o message.txt
```

PIN options for `decrypt` and `sign`:

- `--pin-stdin`: read the PIV PIN from the first stdin line.
- `--pin-file FILE`: read the PIV PIN from the first line of a file.
- `--pin PIN`: pass the PIV PIN directly. This is less safe because it can leak through shell history or process listings.
- `--card-index N`: select the YubiKey index shown by `./yubicrypt cards`. The default is `0`.

Common IO options:

- `-i, --input FILE`: input file, or `-` for stdin.
- `-o, --output FILE`: output file, or `-` for stdout.
- `--text TEXT`: use literal text instead of reading input.
- `--quiet`: suppress status output on stderr.

## GUI build

The old Fyne GUI is still available as an explicit build target:

```sh
go build -tags gui -o yubicrypt-gui .
```

![yubicrypt](img/1.png)

The copy signature component is intended for usage of my [identicons](https://github.com/Ch1ffr3punk/identicons) program,    
so that you can create your yubicrypt identicon for websites etc.  

If you like yubicrypt consider a small donation  
in crypto currencies or buy me a coffee.
```  
BTC: bc1qkluy2kj8ay64jjsk0wrfynp8gvjwet9926rdel    
Nym: n1f0r6zzu5hgh4rprk2v2gqcyr0f5fr84zv69d3x     
XMR: 45TJx8ZHngM4GuNfYxRw7R7vRyFgfMVp862JqycMrPmyfTfJAYcQGEzT27wL1z5RG1b5XfRPJk97KeZr1svK8qES2z1uZrS      
```
<a href="https://www.buymeacoffee.com/Ch1ffr3punk" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-yellow.png" alt="Buy Me A Coffee" height="41" width="174"></a>

yubicrypt is dedicated to Alice and Bob.