NK3 public key cannot be exported

Nitrokeys FIDO2 / Nitrokey 3
1

I used my NK3 in the past about a year ago. It contains signature, encryption and authentication keys.

Now, I am trying to set NK3 up on a new Fedora 44 computer.

gpg2 --card-status shows correct card details. pcsc_scan -r also successfully sees NK3.

Problem is I cannot export public key from the card.

Whenever I run gpg2 --armor --export it always shows gpg: WARNING: nothing exported

I tried passing in NK3 “Serial number”, “Application ID”, “Signature key” (40 character long fingerprint). Nothing has ever been exported.

I tried gpgsm --learn-card - NK3 blinked but gpg2 -k still returns nothing.

I also tried using Card Manager in GPA but it was never able to see the NK3.

In case it is relevant, firmware version is 1.5.0

2

Version 1.8.3 is recent with 1.9.0 looming. So you may consider to update the firmware.

3

Do you think it will resolve the issue without losing the keys?

I use the key to encrypt some important information and really hoping to be able to decrypt it.
If there is even a small risk of data loss, I would rather export the key first, decrypt the data and then update the firmware.

4

No one will give you a 100% error free guarantee. Never work with encryption keys without a unencrypted backup of your worthy data.

You may get the results you expected on an older system. Your firmware version is about 4years old, some things are evolving.

5

In case you created the GPG key to device, you cannot restore a public key from the data that gets exposed by the Nitro key. Unfortunately, the public key gets derived onetime during creation based on the asymmetric secret material that never leaves the token. So a full backup includes the saved public key that gets created together with the private key. Without that, you can still use the GPG key for ssh but not for receiving GPG encrypted messages.

6

Reading something like that on a forum run by a company that makes its living selling security products is, of course, complete nonsense!

If I can’t rely on such products, why do I need them AT ALL, as long as there are software solutions that have been working for decades?

It’s also less about providing guarantees that no one will ever be able to compromise a product, since that would likely be nearly impossible.

However, the fact that a product functions in such a way that it can never lose the user’s data should not only be the standard, but must also finally be enshrined in law!