multiple yubikeys and gnupg stubs

[iandstanley]

I thought you might be interested in ....

re your section:

_GPG only supports one card pointer per shadow/stub key

This is a GnuPG limitation that will be fixed by T2291. Unfortunately this didn't make it into the GnuPG-2.2. We work around this limitation by generating seaprate $GNUPGHOME folders for each smartcard being used. You then only import the main one you would use day to day on a given device, but if the need arises you're still able to switch to using the other smartcard by deleting your key shadows/stubs (hint: gpg --delete-secret-and-public-keys 0xKEY_ID), then re-importing the other shadows/stubs and registering them with the gpg --card-status command._

I'm using gpg 2.3.1 and your keyring can support multiple yubikeys per stub. If you don't SAVE after you have run keytocard to transfer your keys to your yubikey the private key is not deleted. This allows you to add a second yubikey and run keytocard again before finally entering SAVE to save the second yubikey and remove the full key leaving the stub.

You can then run a simple command to switch between the yubikeys
gpg-connect-agent "scd serialno" "learn --force" /bye

I added a script and the documented use on how to do this to drduh's yubikey guide

https://github.com/drduh/YubiKey-Guide/blob/master/switch-to-backup-yubikey

I've added a section to drduh's yubikey guide

Switching between two or more Yubikeys.

When you add a GPG key to a Yubikey using the keytocard command, GPG deletes the key form your keyring and adds a stub pointing to that exact Yubikey (the stub identifies the GPG KeyID and the Yubikey's serial number).

However, when you do this same operation for a second Yubikey, the stub in your keyring is overwritten by the keytocard operation and now the stub points to your second Yubikey. Adding more repeats this overwriting operation.

In other words, the stub will point ONLY to the LAST Yubikey written to.

When using GPG key operations with the GPG key you placed onto the Yubikeys, GPG will request a specific Yubikey asking that you insert a Yubikey with a given serial number (referenced by the stub). GPG will not recognise another Yubikey with a different serial number without manual intervention.

You can force GPG to scan the card and re-create the stubs to point to another Yubikey.

Having created two (or more Yubikeys) with the same GPG key (as described above) where the stubs are pointing to the second Yubikey:

Insert the first Yubikey (which has a different serial numnber) and run the following command:

$ gpg-connect-agent "scd serialno" "learn --force" /bye

GPG will then scan your first Yubikey for GPG keys and recreate the stubs to point to the GPG keyID and Yubikey Serial number of this first Yubikey.

To return to using the second Yubikey just repeat (insert other Yubikey and re-run command).

Obviously this command is not easy to remember so it is recommended to either create a script or a shell alias to make this more user friendly.