Is there a way to encrypt single files with a Yubikey that doesn't use OpenPGP?
I use my Yubikey for ssh logins and encrypting individual files (password stores.) The Yubikey is operating in CCID mode only (I don't currently use OTP or U2F.) All operations require the physical presence test.
Up until now I've been using my Yubikey as an OpenPGP smart card along with:
gpg-agent --enable-ssh-supportfor ssh support; and
- gnupg.vim plugin for encrypting files.
GnuPG is clunky, unreliable, and hard to script. I'd like to stop using the Yubikey in this mode.
I have another Yubikey that is configured as a NIST PIV smart card. I use OpenSSH's PKCS11 support and a regular ssh-agent. This is much more reliable than the gpg tools, but it doesn't provide the individual-file-encryption support.
As I see it, there are a few possible options to using a PIV smart card for individual file encryption:
- some sort of
- maybe there's a seamless PKCS11 based file encryption tool?
- using one of the other slots on the yubikey for file encryption, maybe with OpenSC or some of libccid stuff?
- open source password manager that talks directly to the Yubikey?