GoWiki | wiki | Nitrokey

# Nitrokey

Default User PIN: `123456`  
Default Admin PIN: `12345678`

## Udev

Install libccid:

* Arch Linux: `pacman -S ccid`

```
cat <<EOF> /etc/udev/rules.d/41-nitrokey.rules
# Nitrokey U2F
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0664", GROUP="plugdev", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="f1d0"

SUBSYSTEM!="usb", GOTO="gnupg_rules_end"
ACTION!="add", GOTO="gnupg_rules_end"

# USB SmartCard Readers
## Crypto Stick 1.2
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4107", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Pro
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4108", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Storage
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4109", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey Start
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4211", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"
## Nitrokey HSM
ATTR{idVendor}=="20a0", ATTR{idProduct}=="4230", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg", GROUP+="plugdev", TAG+="uaccess"

LABEL="gnupg_rules_end"
EOF
```

Check the file `/etc/libccid_Info.plist`

```
   <key>ifdVendorID</key>
   <array>
      <string>0x20A0</string>
      <string>0x20A0</string>
      <string>0x20A0</string>
      <string>0x20A0</string>
   <key>ifdProductID</key>
   <array>
      <string>0x4108</string>
      <string>0x4109</string>
      <string>0x4211</string>
      <string>0x4230</string>
   <key>ifdFriendlyName</key>
   <array>
      <string>Nitrokey Pro</string>
      <string>Nitrokey Storage</string>
      <string>Nitrokey Start</string>
      <string>Nitrokey HSM</string>
```

Restart udev:

* Arch Linux: `sudo systemctl restart systemd-udevd`
* Other: `sudo service udev restart`

## gpg-agent

Add this to your .bashrc/.profile:

```
ssh_sock=~/.ssh/ssh_auth_sock
if [ ! -S ${ssh_sock} ]; then
  eval `gpg-agent --daemon --enable-ssh-support`
  ln -sf "$SSH_AUTH_SOCK" ${ssh_sock}
fi
export SSH_AUTH_SOCK="${ssh_sock}"
```

Reload the gpg-agent (replace .bashrc with .profile if needed):

```
pkill gpg-agent
source ~/.bashrc
```

## Smartcard

### Status

```
gpg --card-status

The output should look like this:

### Config

Now we will configure the smartcard.
Comments, instructions and placeholders are written in angle brackets: `<some comment>`

```
gpg --card-edit

gpg/card> admin
Admin commands are allowed

gpg/card> name
Cardholder's surname: <your surname>
Cardholder's given name: <your name>
<enter the default admin pin (12345678)>

gpg/card> sex
Sex ((M)ale, (F)emale or space): M

gpg/card> forcesig
<enter the default admin pin (12345678)>

gpg/card> passwd
gpg: OpenPGP card no. <long number> detected

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 1
<enter the default pin (123456)>
<enter your new pin>
<repeat your new pin>

PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 3
<enter the default admin pin (12345678)>
<enter your new admin pin>
<repeat your new admin pin>

PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 4
<enter your admin pin>
<enter your new reset code>
<repeat your new reset code>

Reset Code set.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? q

gpg/card> generate
Make off-card backup of encryption key? (Y/n) Y
What keysize do you want for the Signature key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
Note: There is no guarantee that the card supports the requested size.
      If the key generation does not succeed, please check the
      documentation of your card to see what sizes are allowed.
What keysize do you want for the Encryption key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
<enter your admin pin>
What keysize do you want for the Authentication key? (2048) 4096
The card will now be re-configured to generate a key of 4096 bits
<enter your admin pin>
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: <your name> <your surname>
Email address: <your email address>
Comment: <optional comment>
You selected this USER-ID:
    "<your name> <your surname> <<your email address>>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
<enter your admin pin>
<gpg is now generating the keys. be patient this will take a while>

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: Note: backup of card key saved to '<file path>'
<enter your backup encryption passphrase>
<repeat your backup encryption passphrase>
gpg: key 39B0CCD7186E0DF4 marked as ultimately trusted
gpg: revocation certificate stored as '<file path>'
public and secret key created and signed.

gpg/card> list

Reader ...........: Nitrokey Nitrokey Pro (<long number>) 00 00
Application ID ...: <long number>
Version ..........: 2.1
Manufacturer .....: ZeitControl
Serial number ....: <number>
Name of cardholder: <your name> <your surname>
Language prefs ...: de
Sex ..............: <your sex>
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa4096 rsa4096 rsa4096
Max. PIN lengths .: 32 32 32
PIN retry counter : 3 3 3
Signature counter : 4
Signature key ....: <signature key id>
      created ....: <creation date>
Encryption key....: <encryption key id>
      created ....: <creation date>
Authentication key: <authentication key id>
      created ....: <creation date>
General key info..: pub  rsa4096/<signature key id> <creation date> <your name> <your surname> <<your email address>>
sec>  rsa4096/<signature key id>  created: <creation date>  expires: never     
                                card-no: 0005 <number>
ssb>  rsa4096/<authentication key id>  created: <creation date>  expires: never     
                                card-no: 0005 <number>
ssb>  rsa4096/<encryption key id>  created: <creation date>  expires: never     
                                card-no: 0005 <number>

gpg/card> q
pub   rsa4096/<signature key id> <creation date> [SC]
      <long signature key id>
      Key fingerprint = <signature key fingerprint>
uid                            <your name> <your surname> <<your email address>>
sub   rsa4096/<authentication key id> <creation date> [A]
sub   rsa4096/<encryption key id> <creation date> [E]

```

Delete the private key inside your gpg-keyring:

```
gpg --delete-secret-key $(gpg --card-status | awk '/General/{print $5}' | cut -b 9-)
gpg (GnuPG) 2.1.20; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

sec  rsa4096/<your key id> <creation date> <your name> <your surname> <<your email address>>

Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
```

Reload the gpg-agent as descriped above: [gpg-agent](/wiki/Nitrokey#gpg-agent)

Now create a test signature:

```
cat <<EOF> example_text.txt
This is a example document, I want to sign.
EOF
gpg --clearsign example_text.txt
# enter your pin
cat example_text.txt.asc
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This is a example document, I want to sign.
-----BEGIN PGP SIGNATURE-----

# long encoded signature
-----END PGP SIGNATURE-----
```

## SSH

Export ssh public key:

New gpg versions can export the public ssh key format:

```
gpg --export-ssh-key $(gpg --card-status | awk '/General/{print $5}' | cut -b 9-)

ssh-rsa <long encoded key> cardno:<number>
```

Another option is to use `ssh-add`:

```
ssh-add -L
ssh-rsa <long encoded key> openpgp:<key id>
```