YubiTouch
A Bash script for setting or clearing touch requests for cryptographic operations in the OpenPGP application on a YubiKey 4
Note
This tool has been superseded in functionality by YubiKey Manager (currently only the CLI side). However, some people have shown interest in keeping this script around for ease of use and because of its smaller surface / fewer dependencies.
Dependencies
- gpg-connect-agent
- pinentry (any kind, optional)
Usage
Run the tool as:
./yubitouch.sh {sig|aut|dec} {off|on|fix} [admin_pin]where the parameters indicate the following:
{sig|aut|dec} Signature, authentication or decryption key
{off|on|fix} Value of the option
[admin_pin] The Admin PIN of the YubiKey (optional)
Setting the touch option to fix will cause any subsequent invocation
of this script on that same subkey to do nothing. The only way to
reset this is by generating or importing a new key for that slot.
If the Admin PIN is not provided through the command line, the tool
will ask the user for it. If a version of pinentry is available it
will be used, otherwise it will fall back to reading standard input.
Personalization advice
To mitigate the fact that this tool needs to interact with the Admin
PIN of a device, it is advisable to run the script after having
generated/imported keys, but before doing the full device
personalization. Specifically, using this tool on a YubiKey that still
has the default Amin PIN (12345678) set.