Is key length 4096 really supported for PIV?
When I tried to import key rsa4096 (as *.p12) it failed and said it expects p12 with rsa2048.
Then I tried to generate a private key on the nitrokey. It appears that key generations succeeded.
It also returned CSR. However when I try to self-sign the request there is an error.
Note that if I choose smaller rsa key or ec key then it works all right.
It really appear as if rsa4096 is not supported even when CLI suggests it is.
nitropy nk3 piv --experimental generate-key --algo rsa4096 --subject-name “CN=John Doe” --subject-alt-name-upn “jdoe@example.com” --key 9C --path request.csr
openssl x509 -req \
-in request.csr \
-signkey "pkcs11:id=%02;type=private" \
-out self_signed_cert.crt \
-days 3650 \
-sha256 \
-provider pkcs11 -provider default
The above worked for rsa3072 and nistp256 just fine.
Also output of pkcs11-tool -M suggest that 4096 is not supported.
Obviously this could be Linux implementation shortcoming but somebody has issue also on Windows: Windows nitropy write-certificate: unsupported key length