Nitrokey Pro RSA-keys

Nitrokeys
1

I have a basic question: The Nitrokey Pro can store three RSA keys with a key length up to 4096 bit.

With the command key-attr from the admin menu you can set the key length accordingly. The key type and key length can be defined three times. Am I right in assuming that these three keys are the keys:

  • Signature key
  • Encryption key
  • Authentication key

and thus covers e.g. the three RSA keys from the product data sheet?

Or is it possible to generate three independent RSA keys with their respective sub-keys? No, or yes?

1 Like
2

Hi Django,

The Nitrokey Pro can store 3 RSA keypairs. All keys use the same identity, but are used for the 3 different purposes you mentioned: authentication, encryption and signing. A similar answer is available in the FAQ (if you haven’t seen it yet).

If by “three independent RSA keys” you mean 3 different identities, it is not possible. Maybe you will find the answer in this ticket helpful.

You must be able to generate sub-keys from each keypair, and if not, I will confirm this and get back to you asap.

3

HI nitr0z!

Okay, so if the Nitrokey Pro , with the built-in OpenPGP Card 2.1 can store an identity with three RSA4096 keys, do I have to change the keys manually, or is the correct key automatically selected, e.g. for PGP mail encryption or the SSH key for a remote login?

If you use key-attr to change the key properties for the signing subkey, this will automatically apply to all three key pairs, right?

So once an RSA/2048 once an RSA/4096 and then an ECC key would not work. Correct?

4

In that order of things, you would use the encryption key for email encryption, and authentication key for the SSH login. Unless you manually choose the encryption key for login, it should work as specified. I will need to verify this, and get back to you on this point.

I don’t know precisely, but I will get back to you on this point too.

This use case should not be possible.

According to the product specs the combinations are as follows for secure key storage:

  • 3 x RSA 2048-4096 bit or 3 x ECC 256-521 bit
  • 1 x AES-128 or AES-256

If you are looking for the specific use-case of multiple identities with PGP keys, the Nitrokey Start supports this feature as mentioned here.

1 Like
5

thanx for your support => I solved my “problem” as described here: Nitrokey Pro and X.509 certificate for email-encryption

6

This depends on the software you use. For GnuPG you need to specify/change the algorithm and key length for each of the three keys separately. See this blog post as an example, but note it targets Nitrokey Start in particular.

So once an RSA/2048 once an RSA/4096 and then an ECC key would not work. Correct?

You mean to use three different algorithm resp. key lengths? That would work from the device perspective. But chances are that GnuPG or whatever software you are using can’t deal with it.

1 Like
7

HI Jan!

See this blog post as an example, but note it targets Nitrokey Start in particular.

That’s a well known blogpost-article. To the topic particularly to the background information to Elliptic Curves I link also gladly always on the Infoce fon Bruce Schneier : Nitrokey Start in der Praxis unter open SUSE leap 15.2 [Linux - Wissensdatenbank]
and of course also at the point “Generate ED25519 key” also on the link from Nitrokey you quoted: Nitrokey Start in der Praxis unter open SUSE leap 15.2 [Linux - Wissensdatenbank]

But chances are that GnuPG or whatever software you are using can’t deal with it.

The best experience I had so far was simply using different nitrokeys for different usage scenarios. O.K. that probably explains why I have 11 Nitrokeys on my desk right now :wink:

Have a nice Day!
Django