Nitrokey Pro and PKCS#11 support on Linux

[jan]

@milgner

Now my firmware is 0.7 and I saw on Github that there’s a 1.0 release. Would upgrading help? Can I flash a new firmware without erasing the stored keys?

Don’t worry, you have the latest firmware (just confusing numbers). Also a firmware update of Nitrokey Pro is not possible.

@milgner

So I’m making progress but I think the official documentation could do with some serious improvements if an advanced user with crypto (though not smartcard) experience like me needs to experiment that much to get things working.

I agree. It would really help us if you could suggest specific steps or aspects which helped you (and should be documented).

@milgner

One thing that isn’t yet 100% clear to me is how PKCS11, 15 and OpenGPG data relate to another. Since I already created keys with GnuPG, how do I best use these with PKCS11 or 15? Do I just need to import a X.509 certificate? With or without public and/or private key? Associate them with multiple keys?

Nitrokey Pro has space for 3 RSA keys (encryption, signing, authentication) and one X.509 certificate. RSA keys can be used for both OpenPGP and X.509/PKCS#11. Now, for your existing key you should generate a Certificate Signing Request and send it to your CA. You can store the returned X.509 certificate into your Nitrokey Pro.