YubiKey Neo + Putty SSH + Windows

I have been using Yubikey Neo to manage my OpenSSH key in a CCID at work. I have made it work in Ubuntu and MacOS with relative ease, but most of my colleagues are on Windows and wondered how this could be done on the M$ platform. So I decided to give it a shot and try it out on their newly released Windows 10 (or shall we call it WinOS X )

Step 0: Get YubiKey Neo configured as CCID

Of course you have to buy this hardware before we can even begin. Before your Yubikey appears as a CCID  you will need to use YubiKey Neo Manager to enable it. See the following screenshot. 

You cannot have a password for your Yubikey when you are changing the modes. If you do then you will have to delete that configuration with YubiKey personalization tool. Make sure to exit the GUI applications before you start using console later.

Step 1: Check if you Yubikey works.

You will need have gpg executable installed. Gpg4Win to interact with your Yubikey

C:\>gpg --card-edit
gpg: detected reader `Yubico Yubikey NEO OTP+U2F+CCID 0'
Application ID ...: REDACTED
Version ..........: 2.0
Manufacturer .....: unknown
Serial number ....: REDACTED
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
gpg/card>

A caveat here is that a few months back there was an advisory regarding Yubikeys with OpenPGP applet version ≤ 1.0.9 being compromised. See the website to make sure that the key you have has non compromised version. 

Step 2: Generate Keys

Now you can do things in steps described in some blog entries. Just make sure that you use the correct PINs the first time (the console will tell you default pins, otherwise you may have to RESET your applet)

gpg/card> generate
Make off-card backup of encryption key? (Y/n) n

Please note that the factory settings of the PINs are
   PIN = `123456'     Admin PIN = `12345678'
You should change them using the command --change-pin

gpg: 3 Admin PIN attempts remaining before card is permanently locked

Please enter the Admin PIN

Please enter the PIN
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at 08/02/16 15:18:08
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: User Name
Email address: user@email.com
Comment: Department
You selected this USER-ID:
    "User Name <user@email.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? C
Comment: Department2
You selected this USER-ID:
    "User Name (Department 2) <user@email.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (25 seconds)
gpg: signatures created so far: 0
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (26 seconds)
gpg: signatures created so far: 1
gpg: signatures created so far: 2
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (34 seconds)
gpg: signatures created so far: 3
gpg: signatures created so far: 4
gpg: C:/Users/hatsha/AppData/Roaming/gnupg\trustdb.gpg: trustdb created
gpg: key 60C2B662 marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2016-08-02
pub   REDACTED/REDACTED 2015-08-03 [expires: 2016-08-02]
      Key fingerprint = 5ABF D138 BB53 3F9C 133D  DD9A 793B D949 60C2 B662
uid                  User Name (Department 2) <user@email.com>
sub   2048R/REC2015-08-03 [expires: 2016-08-02]
sub   2048R/D0AD1A73 2015-08-03 [expires: 2016-08-02]

Step 3: Use Keys

Next step is to use the generated SSH Key. The easiest way I have found on  Windows is to use an agent that requires a registration. The fee is nominal (1 Euro)/key. After following the instructions you can start the agent and should see keys in the agent if Yubikey pgp is working

While you can export the SSH key out of pgp (so you can put it in your servers/opsworks stack). I just take the easy route and login to a server with password and do an ssh-add -L to get the keys. Don't forget to forward your key from putty though.