Kevin De Baerdemaeker

How to create SSH resident keys from Yubikey

Modified 2026-07-19

Disable all the unused features. 

ykman config usb --disable otp --disable piv --disable openpgp --disable u2f --disable hsmauth
ykman config nfc --disable otp --disable piv --disable openpgp --disable u2f --disable hsmauth

Set fido pind 

ykman fido access change-pin

Create resident key 

ssh-keygen -t ed25519-sk -O resident -O verify-required -O application=ssh:general -f ~/.ssh/personal_yubi
ssh-keygen -t ed25519-sk -O resident -O verify-required -O application=ssh:work -f ~/.ssh/work_yubi
cat ~/.ssh/newkey_yubi

References