Is there a way to encrypt single files with a Yubikey that doesn't use OpenPGP?

I use my Yubikey for ssh logins and encrypting individual files (password stores.) The Yubikey is operating in CCID mode only (I don't currently use OTP or U2F.) All operations require the physical presence test.

Up until now I've been using my Yubikey as an OpenPGP smart card along with:

  • gpg-agent --enable-ssh-support for ssh support; and
  • gnupg.vim plugin for encrypting files.

GnuPG is clunky, unreliable, and hard to script. I'd like to stop using the Yubikey in this mode.

I have another Yubikey that is configured as a NIST PIV smart card. I use OpenSSH's PKCS11 support and a regular ssh-agent. This is much more reliable than the gpg tools, but it doesn't provide the individual-file-encryption support.

As I see it, there are a few possible options to using a PIV smart card for individual file encryption:

  • some sort of ssh-agent + vim hack?
  • maybe there's a seamless PKCS11 based file encryption tool?
  • using one of the other slots on the yubikey for file encryption, maybe with OpenSC or some of libccid stuff?
  • open source password manager that talks directly to the Yubikey?

1 Answer 1


Here's a python script I wrote to automate the following process:

To encrypt, ssh-agent's wire protocol (see the draft RFC for details) lets you sign arbitrary data with a private key, so:

  • pick a random number
  • ask ssh-agent to sign it
  • use the signature to derive a symmetric key
  • encrypt your data with the symmetric key
  • save the random number and encrypted data (but not the symmetric key) to disk

and to decrypt:

  • read the random number and encrypted data back from disk
  • ask ssh-agent to sign the random number
  • use the signature to derive the same symmetric key used to encrypt the data
  • decrypt the data!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .