Hi,

        I have a new Yubikey 5 NFC, and was using ‘gpg --card-edit’  and
‘gpg --edit-key --expert 0x123456789’ to move my gpg subkeys to the Yubikey.

 How to reproduce error mode:
 -----------------------------------------
 % gpg --card-edit
   > admin
   > passwd
     > change admin pin
     > change PIN

 % gpg --edit-key --expert 0x123456789’
   > key 7
   > keytocard
     > 1                    ## (signing key)
     <<gpg passphrese>>
     <<Yubikey Admin PIN>>
  Error failed to import key PIN failed
-----------------------------------------------
 Eventually this results in 3 failures for the ADMIN pin, locking the
Yubikey.  Hypothesis: gpg2 and keytocard do not work with custom
admin pins. Reversing the order of operations  worked:
  + add keys while the ADMIN PIN is 12345678
  + then change the PINs on the Yubikey
  + now signing with the gpg keys living on Yubikey works just fine.
 ---------------------------------------------
 % gpg --card-edit
   > admin
   > factory-reset
      > y
      > yes
% gpg --edit-key --expert 0x123456789’
   > key 7
   > keytocard
     > 1                    ## (signing key)
     <<gpg passphrese>>
     <<Yubikey Admin PIN>>
% gpg --card-edit
   > admin
   > passwd
     > change admin pin
     > change PIN

% lsusb | grep Yubikey
[90587.275149] input: Yubico YubiKey OTP+FIDO+CCID as
/devices/pci0000:00/0000:00:14.0/usb1/1-12/1-12:1.0/0003:1050:0407.0009/input/input23
[90587.339153] hid-generic 0003:1050:0407.0009: input,hidraw8: USB HID
v1.10 Keyboard [Yubico YubiKey OTP+FIDO+CCID] on usb-0000:00:14.0-12/input0
[90587.339962] hid-generic 0003:1050:0407.000A: hiddev2,hidraw9: USB HID
v1.10 Device [Yubico YubiKey OTP+FIDO+CCID] on usb-0000:00:14.0-12/input1

% gpg --card-status
Reader ...........: 1050:0407:X:0
Application ID ...: D2760001240103040006247353380000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: Yubico
Serial number ....: 24735338
Name of cardholder: [not set]
Language prefs ...: [not set]
Salutation .......:
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
KDF setting ......: off
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
---------------------------------------------------------------------
--------------------------------------------------------------------------------

        Thanks,

        Manoj
-- 
Education is an admirable thing, but it is well to remember from time to
time that nothing that is worth knowing can be taught. -- Oscar Wilde,
"The Critic as Artist"
Manoj Srivastava <srivasta@acm.org>
4096R/C5779A1C E37E 5EC5 2A01 DA25 AD20  05B6 CF48 9438 C577 9A1C

Please feel free to re-retitle if i've got the summary wrong.  I've also
forwarded this upstream since it might affect other non-debian users.

Hi Manoj--

I don't know whether you've seen over on the upstream bug but they were
unable to replicate the problem you've described here.  Is it possible
for you to try with a local stock build of GnuPG 2.2.40 (2.2.42) to see
whether you see the same problem?  That might help to rule out any of
the debian patches at least.  I don't have a Yubikey 5 NFC to test this
with, unfortunately.

Hi,

   I will try tomorrow. I do have a second yubikey, brand new, so I can try
and reproduce three exact sequence of commands under typescript.

   Msnoj

On Fri, Sep 29, 2023, 7:05 PM Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote: