The YubiKey 4 is a multi-purpose USB key produced by Yubico.
It can be used for 2-factor authentication (OTP, U2F, OATH and static password) and as a CCID smartcard (both PIV and OpenPGP), visit the Yubico product page for a full list of features and a comparison with previous versions.
Contents
Configuration
Yubico develops various software to access the key, among them:
YubiKey Personalization to configure all the 2-factor authentication protocols
- you need at least the version in stretch, i.e. 1.17.2-1
Yubico PIV (Privilege and Identification Verification) for PKCS #11
OTP
The key does not have a battery, so for TOTP you need an external tools:
yubikey-totp to generate a TOTP code from a secret stored on the key.
- you need at least the version in stretch, i.e. 1.3.1-1
Yubico Authenticator to generate OATH-HOTP and OATH-TOTP one-time password codes from secretes protected by the key
PIV
Check also Debian SSO (Single Sign-On) with a YubiKey.
OpenPGP
To access the cards you need GnuPG, GnuPG Agent and GnuPG Smartcard Daemon.
If you want to use 4096-bits RSA keys, you need GnuPG 2.x, with the corresponding gpg-agent and scdaemon, at least the version in wheezy-backports, i.e. 2.0.25-1~bpo70+1.
OpenSSH authentication
This works out-of-the box on wheezy when GnuPG Agent is acting also as an SSH agent (option enable-ssh-support in ~/.gnupg/gpg-agent.conf).
Once the key has been plugged in, you can check if its authentication key has been added to the SSH agent via the ssh-add -L command.
License
This document is licensed under the terms of the GNU General Public License (GPL), version 2 or (at your option) any later version.