blob: fc98d946f8607ae24fe9d3446d7b7a026c462ddc (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
# yubicrypt
An easy to use command-line public key encryption program for your YubiKey.
Supported YubiKey algorithms:
For encryption with slot 9d:
RSA: 2048, 3072, 4096 bits
For signing with slot 9c:
ECC: P-256, P-384, Ed25519
Simply use Yubico Authenticator to create your signing and
encryption certificate and export your encryption certificate,
to give it to your friends. You don't have to export your signing
certificate, because it is not needed for signature verification.
If you use Linux (Debian/Ubuntu) you may have to do the following
in order that yubicrypt works.
Install PC/SC daemon and tools
sudo apt update
sudo apt install pcscd pcsc-tools
Start the PC/SC daemon
sudo systemctl start pcscd
Enable it to start automatically on boot
sudo systemctl enable pcscd
Check the status to ensure it's running
sudo systemctl status pcscd
## CLI usage
Build the CLI:
```sh
go build -o yubicrypt .
```
Commands:
```sh
./yubicrypt help
./yubicrypt cards
./yubicrypt encrypt --key alice.crt -i msg.txt -o msg.yc
printf '%s\n' "$PIV_PIN" | ./yubicrypt decrypt --pin-stdin -i msg.yc -o msg.txt
printf '%s\n' "$PIV_PIN" | ./yubicrypt sign --pin-stdin -i msg.txt -o msg.sig.txt
./yubicrypt verify -i msg.sig.txt --public-key
./yubicrypt pad --text "message" -o padded.txt
./yubicrypt unpad -i padded.txt -o message.txt
```
PIN options for `decrypt` and `sign`:
- `--pin-stdin`: read the PIV PIN from the first stdin line.
- `--pin-file FILE`: read the PIV PIN from the first line of a file.
- `--pin PIN`: pass the PIV PIN directly. This is less safe because it can leak through shell history or process listings.
- `--card-index N`: select the YubiKey index shown by `./yubicrypt cards`. The default is `0`.
Common IO options:
- `-i, --input FILE`: input file, or `-` for stdin.
- `-o, --output FILE`: output file, or `-` for stdout.
- `--text TEXT`: use literal text instead of reading input.
- `--quiet`: suppress status output on stderr.
## GUI build
The old Fyne GUI is still available as an explicit build target:
```sh
go build -tags gui -o yubicrypt-gui .
```
The copy signature component is intended for usage of my [identicons](https://github.com/Ch1ffr3punk/identicons) program,
so that you can create your yubicrypt identicon for websites etc.
If you like yubicrypt consider a small donation
in crypto currencies or buy me a coffee.
```
BTC: bc1qkluy2kj8ay64jjsk0wrfynp8gvjwet9926rdel
Nym: n1f0r6zzu5hgh4rprk2v2gqcyr0f5fr84zv69d3x
XMR: 45TJx8ZHngM4GuNfYxRw7R7vRyFgfMVp862JqycMrPmyfTfJAYcQGEzT27wL1z5RG1b5XfRPJk97KeZr1svK8qES2z1uZrS
```
<a href="https://www.buymeacoffee.com/Ch1ffr3punk" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-yellow.png" alt="Buy Me A Coffee" height="41" width="174"></a>
yubicrypt is dedicated to Alice and Bob.
|
