Nitrokey 3C NCF generation RSA-Key failed with Card error

Nitrokeys FIDO2 / Nitrokey 3
1

I tried to generate RSA-4096 on my Nitrokey 3C NFC with gpg2:
$ gpg2 --card-edit

In the admin menue I did:
`gpg/card> generate
Make off-card backup of encryption key? (Y/n)

Please note that the factory settings of the PINs are
PIN = ‘123456’ Admin PIN = ‘12345678’
You should change them using the command --change-pin

Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: john.doe@example.com
Comment:
You selected this USER-ID:
“John Doe john.doe@example.com”

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: key generation failed: Card error
Key generation failed: Card error

gpg/card> quit
My Nitrokey:$ nitropy nk3 version
Command line tool to interact with Nitrokey devices 0.4.27
v1.4.0`

My environment:
`$ gpg2 --version
gpg (GnuPG) 2.2.27
libgcrypt 1.9.4
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later https://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/django/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2`

2

Working with Key attributes …: ed25519 cv25519 ed25519 all works as expected:
Make off-card backup of encryption key? (Y/n) n

Please note that the factory settings of the PINs are
PIN = ‘123456’ Admin PIN = ‘12345678’
You should change them using the command --change-pin

Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: john.doe@example.com
Comment:
You selected this USER-ID:
“John Doe john.doe@example.com”

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: key 944C908987158269 marked as ultimately trusted
gpg: revocation certificate stored as ‘/home/django/.gnupg/openpgp-revocs.d/DD7CCCA64B92ECBEDAFDC684944C908987158269.rev’
public and secret key created and signed.

gpg/card> quit
pub ed25519 2023-05-11 [SC]
DD7CCCA64B92ECBEDAFDC684944C908987158269
uid John Doe john.doe@example.com
sub ed25519 2023-05-11 [A]
sub cv25519 2023-05-11 [E]

But why won’t it work with RSA4096 keys? O.K. I tried it only for a BLOG page in Djangos WIKI - in normal life I workd with ecliptic curve based keys.

3

I think this is a limitation of opencard-rs v1.0.0.
Here it says:

RSA-4096 (no key generation, key import only)

btw, importing a RSA-4096 key works here as expected.

4

Thanks for the tip and the link.

Importing keys is not a desired way for me, because my understanding is that when using a crypto stick, the secret key should never leave the stick. Generating an ED25519 key is quite sufficient for me. the RSA4096 was just an attempt for documentation purposes.