Default User PIN: 123456
Default Admin PIN: 12345678
Install libccid:
Arch Linux: pacman -S ccid
cat <<EOF> /etc/udev/rules.d/41-nitrokey.rules
# Nitrokey U2F
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0664", GROUP="plugdev", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="f1d0"
SUBSYSTEM!="usb", GOTO="gnupg_rules_end"
ACTION!="add", GOTO="gnupg_rules_end"
# USB SmartCard Readers
## Crypto Stick 1.2
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4107", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Pro
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4108", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Storage
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4109", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Start
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4211", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey HSM
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4230", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
LABEL="gnupg_rules_end"
EOF
Check the file /etc/libccid_Info.plist
<key>ifdVendorID</key>
<array>
<string>0x20A0</string>
<string>0x20A0</string>
<string>0x20A0</string>
<string>0x20A0</string>
<key>ifdProductID</key>
<array>
<string>0x4108</string>
<string>0x4109</string>
<string>0x4211</string>
<string>0x4230</string>
<key>ifdFriendlyName</key>
<array>
<string>Nitrokey Pro</string>
<string>Nitrokey Storage</string>
<string>Nitrokey Start</string>
<string>Nitrokey HSM</string>
Restart udev:
sudo systemctl restart systemd-udevdsudo service udev restartAdd this to your .bashrc/.profile:
ssh_sock=~/.ssh/ssh_auth_sock
if [ ! -S ${ssh_sock} ]; then
eval `gpg-agent --daemon --enable-ssh-support`
ln -sf "$SSH_AUTH_SOCK" ${ssh_sock}
fi
export SSH_AUTH_SOCK="${ssh_sock}"
Reload the gpg-agent (replace .bashrc with .profile if needed):
pkill gpg-agent
source ~/.bashrc
gpg --card-status
The output should look like this:
Reader ...........: Nitrokey Nitrokey Pro (<long number>) 00 00
Application ID ...: <long number>
Version ..........: 2.1
Manufacturer .....: ZeitControl
Serial number ....: <number>
Name of cardholder: [not set]
Language prefs ...: de
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 32 32 32
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
Now we will configure the smartcard.
Comments, instructions and placeholders are written in angle brackets: <some comment>
gpg --card-edit
<card information like above>
gpg/card> admin
Admin commands are allowed
gpg/card> name
Cardholder's surname: <your surname>
Cardholder's given name: <your name>
<enter the default admin pin (12345678)>
gpg/card> sex
Sex ((M)ale, (F)emale or space): M
gpg/card> forcesig
<enter the default admin pin (12345678)>
gpg/card> passwd
gpg: OpenPGP card no. <long number> detected
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 1
<enter the default pin (123456)>
<enter your new pin>
<repeat your new pin>
PIN changed.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 3
<enter the default admin pin (12345678)>
<enter your new admin pin>
<repeat your new admin pin>
PIN changed.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 4
<enter your admin pin>
<enter your new reset code>
<repeat your new reset code>
Reset Code set.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? q
gpg/card> generate
Make off-card backup of encryption key? (Y/n) Y
What keysize do you want for the Signature key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
Note: There is no guarantee that the card supports the requested size.
If the key generation does not succeed, please check the
documentation of your card to see what sizes are allowed.
What keysize do you want for the Encryption key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
<enter your admin pin>
What keysize do you want for the Authentication key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
<enter your admin pin>
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: <your name> <your surname>
Email address: <your email address>
Comment: <optional comment>
You selected this USER-ID:
"<your name> <your surname> <<your email address>>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
<enter your admin pin>
<gpg is now generating the keys. be patient this will take a while>
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: Note: backup of card key saved to '<file path>'
<enter your backup encryption passphrase>
<repeat your backup encryption passphrase>
gpg: key 39B0CCD7186E0DF4 marked as ultimately trusted
gpg: revocation certificate stored as '<file path>'
public and secret key created and signed.
gpg/card> list
Reader ...........: Nitrokey Nitrokey Pro (<long number>) 00 00
Application ID ...: <long number>
Version ..........: 2.1
Manufacturer .....: ZeitControl
Serial number ....: <number>
Name of cardholder: <your name> <your surname>
Language prefs ...: de
Sex ..............: <your sex>
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa4096 rsa4096 rsa4096
Max. PIN lengths .: 32 32 32
PIN retry counter : 3 3 3
Signature counter : 4
Signature key ....: <signature key id>
created ....: <creation date>
Encryption key....: <encryption key id>
created ....: <creation date>
Authentication key: <authentication key id>
created ....: <creation date>
General key info..: pub rsa4096/<signature key id> <creation date> <your name> <your surname> <<your email address>>
sec> rsa4096/<signature key id> created: <creation date> expires: never
card-no: 0005 <number>
ssb> rsa4096/<authentication key id> created: <creation date> expires: never
card-no: 0005 <number>
ssb> rsa4096/<encryption key id> created: <creation date> expires: never
card-no: 0005 <number>
gpg/card> q
pub rsa4096/<signature key id> <creation date> [SC]
<long signature key id>
Key fingerprint = <signature key fingerprint>
uid <your name> <your surname> <<your email address>>
sub rsa4096/<authentication key id> <creation date> [A]
sub rsa4096/<encryption key id> <creation date> [E]
Delete the private key inside your gpg-keyring:
gpg --delete-secret-key $(gpg --card-status | awk '/General/{print $5}' | cut -b 9-)
gpg (GnuPG) 2.1.20; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
sec rsa4096/<your key id> <creation date> <your name> <your surname> <<your email address>>
Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
Reload the gpg-agent as descriped above: gpg-agent
Now create a test signature:
cat <<EOF> example_text.txt
This is a example document, I want to sign.
EOF
gpg --clearsign example_text.txt
# enter your pin
cat example_text.txt.asc
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
This is a example document, I want to sign.
-----BEGIN PGP SIGNATURE-----
# long encoded signature
-----END PGP SIGNATURE-----
Export ssh public key:
New gpg versions can export the public ssh key format:
gpg --export-ssh-key $(gpg --card-status | awk '/General/{print $5}' | cut -b 9-)
ssh-rsa <long encoded key> cardno:<number>
Another option is to use ssh-add:
ssh-add -L
ssh-rsa <long encoded key> openpgp:<key id>