To whom it may concern,
I recently acquired a Nitrokey Pro 2 and set it up with GnuPG and subkeys. When testing to see if the signing subkey worked, I kept getting the error gpg: signing failed: Conditions of use not satisfied. I initially thought this was a problem with using ECC for the keys instead of RSA. However, I discovered that it was to do with my gpg.conf setup instead, which was set to use SHA512 as the preferred digest algorithm. Changing this to SHA384 or SHA256 fixed the problem and I was able to sign files. This is odd to me, as the Nitrokey Pro 2 factsheet states that SHA512 is supported by the device.
Using strace to investigate the problem, I confirmed that it was using SHA512 that was the root of the problem. In the included strace-files, you can see that the only thing that changes is the number used in SETHASH on line 9:
strace-sha512 breaks
execve("/usr/bin/gpg", ["gpg", "-s", "-u", "teh6@st-andrews.ac.uk", "--digest-algo", "SHA512", "test-s.txt"], <...> /* 37 vars */) = 0
<...>
write(4, "SIGKEY <...>"..., 47) = 47
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETKEYDESC Please+enter+the+pass"..., 247) = 247
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETHASH 10 <...>"..., 139) = 139
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "PKSIGN", 6) = 6
write(4, "\n", 1) = 1
read(4, "INQUIRE PINENTRY_LAUNCHED <...> g"..., 1002) = 70
write(4, "END", 3) = 3
write(4, "\n", 1) = 1
read(4, "ERR 100663427 Conditions of use "..., 1002) = 52
write(2, "gpg: signing failed: Conditions "..., 52) = 52
write(2, "\n", 1) = 1
<...>
write(2, "gpg: signing failed: Conditions "..., 52) = 52
write(2, "\n", 1) = 1
close(3) = 0
<...>
exit_group(2) = ?
+++ exited with 2 +++
strace-sha384 works
execve("/usr/bin/gpg", ["gpg", "-s", "-u", "teh6@st-andrews.ac.uk", "--digest-algo", "SHA384", "test-s.txt"], <...> /* 37 vars */) = 0
<...>
write(4, "SIGKEY <...>"..., 47) = 47
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETKEYDESC Please+enter+the+pass"..., 243) = 243
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETHASH 9 <...>"..., 106) = 106
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "PKSIGN", 6) = 6
write(4, "\n", 1) = 1
read(4, "INQUIRE PINENTRY_LAUNCHED <...> g"..., 1002) = 70
write(4, "END", 3) = 3
write(4, "\n", 1) = 1
read(4, "<...>"..., 1002) = 140
<...>
write(6, "<...>"..., 212) = 212
close(6) = 0
close(3) = 0
<...>
exit_group(0) = ?
+++ exited with 0 +++
strace-sha256 works
execve("/usr/bin/gpg", ["gpg", "-s", "-u", "teh6@st-andrews.ac.uk", "--digest-algo", "SHA256", "test-s.txt"], <...> /* 37 vars */) = 0
<...>
write(4, "SIGKEY <...>"..., 47) = 47
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETKEYDESC Please+enter+the+pass"..., 247) = 247
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "SETHASH 8 <...>"..., 74) = 74
write(4, "\n", 1) = 1
read(4, "OK\n", 1002) = 3
write(4, "PKSIGN", 6) = 6
write(4, "\n", 1) = 1
read(4, "INQUIRE PINENTRY_LAUNCHED <...> g"..., 1002) = 70
write(4, "END", 3) = 3
write(4, "\n", 1) = 1
read(4, "<...>"..., 1002) = 142
<...>
write(6, "<...>"..., 213) = 213
close(6) = 0
close(3) = 0
<...>
exit_group(0) = ?
+++ exited with 0 +++
Looking at the GnuPG source definitions, the numbers 8, 9, and 10 correspond to the algorithms SHA256, SHA384, and SHA512 respectively, and it is only SETHASH 10 that causes the error to occur.
typedef enum
{
DIGEST_ALGO_MD5 = 1,
DIGEST_ALGO_SHA1 = 2,
DIGEST_ALGO_RMD160 = 3,
/* 4, 5, 6, and 7 are reserved. */
DIGEST_ALGO_SHA256 = 8,
DIGEST_ALGO_SHA384 = 9,
DIGEST_ALGO_SHA512 = 10,
DIGEST_ALGO_SHA224 = 11,
DIGEST_ALGO_PRIVATE10 = 110
}
digest_algo_t;
I am happy to help investigate this further if need be. It could also be that it is a problem with GnuPG rather than the Nitrokey Pro 2. However, I thought the best start would be to raise an issue here.
My setup is as follows:
- OS: Linux 5.7.11
- Nitrokey Pro 2 version: 3.3
- GnuPG: 2.2.21
- libgcrypt: 1.8.6
- libnitrokey: 3.5
Let me know if you need any further details.
Yours faithfully,
Thomas E. Hansen