Device reinitialized by itself

#1

Hi,

My NitroKey (Storage) seems to have lost all OTP and encrypted data : when plugging it in I get “Warning: Encrypted volume is not secure, Select “Initialize device” option from context menu”, and all OTP slots are wiped. The PGP applet and RSA keys are still fine.

I do not remember interacting with the NitroKey in any special way before that. However, I had noticed that my USB port is having some bad contacts and sometimes the device would re-connect.

Fortunately I did not have any sensitive data stored on the NitroKey, and this is a good occasion to test my OTP recovery tokens.

Is this kind of event known to happen with NitroKeys ?
Could it be that the hardware is faulty ?
Is there any way to backup whatever the key is losing to recover lost data, should this happen again.

Thank you for your help,

#2

Hi pstch,

at first I am sorry for the troubles you had! I thank you for your feedback, because this may help to investigate what went wrong. Can you please help us further by reporting:

  • What firmware version are you using (Nitrokey App -> About Nitrokey)?
  • Shouldn’t be related, but still: What Nitrokey App version you are using (same window)?
  • What USB Ports are you using (USB 1.1, USB 2 or USB 3)?
  • Did you use the “hidden volumes” functions?

Maybe there will be more questions later. I am not fully aware of such case in the past, but maybe there were some issues in the time I didn’t work for Nitrokey.

It seems like the AES key for the encryption got deleted or destroyed somehow. When losing the AES encryption information the standard functions of the OpenPGP Card are not necessarily affected. The AES key is saved on the card but not part of the keys you use for mail encryption.

It is in most cases a good idea to have a backup of some data you save on the key. Hardware fault or lost can indeed happen sooner or later (but hopefully won’t). So luckily you did backup your OTP secrets. What you can do is i) importing a locally created GnuPG key to have a backup of it, instead of creating a key on-card with the ‘generate’ command. But make sure to use a secure system when doing this! ii) may backup the data saved on the key if possible (if necessary on a second Nitrokey or another secure device) iii) backup OTP secrets and saved password (as you did) if this is the only way to get access to the corresponding services (I wouldn’t bother if you can reset the password in case of lost anyway).

The Nitrokey is meant to be as reliable as possible. Nevertheless nobody can rule out a hardware fault entirely. If your specific case is hardware or firmware/software related I can’t say for now.

Kind regards
Alex

#3

Hello nitroalex,

Thank you for your response. The app version is 0.6.3, key firmare is 0.46. The USB port in use is USB2, and the device was connecting in USB2 from what I can see in logs. I had just configured hidden volumes (the day before actually), but was not using them extensively (a few tests).

Indeed, it seems like the AES keys got lost. In the case of the OpenPGP card, we can both backup the key at creation and load an existing key in a card (allowing one to continue to use its backed-up key in the same card, should the RSA keys get corrupted). This does not seem to be possible to do for the AES keys, at least not from the application.

Is this a hardware limitation, or is there a way that this can be implemented, maybe using libnitrokey ?

Anyway, I will take care to have proper backups and will come back here if the issue ever reproduces.

Thank you for your help,
King regards,
Hugo G

PS: As you work for NitroKey, I’ll say it here : I bought a 8GB Storage key, you sent me a 16GB one. Thanks :slight_smile:

1 Like
#4

Hi,

please consider upgrading (if you are not using the NK on macOS) to 0.48 firmware. But I don’t think that the firmware version is related to the issue.

Be careful: the backuped key of the “generate” command is a backup of the encryption subkey only! That means you can decrypt old mails but not sign or authenticate with the old key anymore! This is some limitation of the generate function in GnuPGP.

@szszszsz The AES key can not get extracted out of the OpenPGP Card by design, right? Or do I miss something?

Lucky you :wink:

Kind regards
Alex

1 Like
#5

Hi!
There are no specific to AES key read/write access commands. It can be only generated and manipulated on device. Perhaps it could be found in image created with ‘Export firmware’ (as it is stored in flash memory - in encrypted by Smart Card form), but I would need to confirm that.

1 Like
#6

This is a hardware security feature (=limitation) and can’t be changed from software.

#7

I think this could be a nice evolution to the NitroKey : allowing the user to backup (and restore) the AES keys, in the same manner as it is possible for GnuPG (only when generating the keys).

Anyway, thank you all for your answers and useful information.

#8

What would it be good for?

#9

nitrokeyfehler
nitrokeyfehler.PNG810×711 18.9 KB

Running into the same problem 2019. Nitrokey Storage 2, Firmware 0.54, USB3, last main key exchange: yesterday, last use of encrypted volume: today, no hidden volumes.

Why the encrpyted volume isn’t secure anymore? nevertheless it would be fair to have a chance to download data from encrypted volume before being forced to reinitialize the device. Smartcard with GPG was still available with gpg --card-status since then

#10

after long device init and even much longer format of neue partition…
the positives after first frustration: the non-ecncrypted partition survived and the RSA keys survived;
passwords, totps and obviously the data of encrypted partition are gone … and my confidence of using the device for unbackuped data

#11

You cannot access the encrypted volume after resetting the underlying keys which you probably did here. The key for the encrypted volume resides in the smartcard, thus resetting it deletes the possibility to decrypt.

Or what do you mean by that?

Could we make the consequences of resetting the smartcard/changing keys clearer in our documentation? Where?