@maaattes Problem described in your comment (Probleme mit Nitrokey Start nach Firmwareupdate auf RTM.9 – Veränderte Kartenummer) has reproduced for me.
Initial investigation shows that with the current implementation of both GnuPG and Nitrokey Start, the latter has to have default PINs set to enable the KDF-DO, and it has to be empty (just after factory reset). There is already a patch in queue for the GnuPG to handle switching it with the non-default settings - see ticket:
Solution is merged to the main branch, however there is no information currently when it will be available in the actual release (to be requested). I was expecting it will be in the next GnuPG release, when you were asking last time.
Current procedure:
- Run factory reset
- Set up KDF
- Change Admin PIN (optional; without keys only Admin PIN change is possible)
- Import / generate keys
- Change User and Admin PIN
Tested with:
- gpg (GnuPG) 2.2.20 / 2.2.25
- Nitrokey Start RTM.10
- Curve 25519 keys
Regarding the card failure error (caused by the forbidden request of changing the KDF state when the Nitrokey is already populated), here are the GnuPG’s 2.2.25 scdaemon logs (for completeness):
2021-01-26 12:35:01 scdaemon[22] 3 Admin PIN attempts remaining before card is permanently locked
2021-01-26 12:35:01 scdaemon[22] DBG: check_pcsc_pinpad: command=20, r=27265
2021-01-26 12:35:01 scdaemon[22] DBG: asking for PIN '|A|Please enter the Admin PIN%0A%0ANumber: FFFE 87042524%0AHolder: '
2021-01-26 12:35:01 scdaemon[22] DBG: chan_7 -> [ 49 4e 51 55 49 52 45 20 4e 45 45 44 50 49 4e 20 ...(70 byte(s) skipped) ]
2021-01-26 12:35:05 scdaemon[22] DBG: chan_7 <- [ 44 20 31 32 33 34 35 36 37 38 00 00 00 00 00 00 ...(76 byte(s) skipped) ]
2021-01-26 12:35:05 scdaemon[22] DBG: chan_7 <- END
2021-01-26 12:35:05 scdaemon[22] DBG: send apdu: c=00 i=CA p1=00 p2=F9 lc=-1 le=256 em=0
2021-01-26 12:35:05 scdaemon[22] DBG: PCSC_data: 00 CA 00 F9 00
2021-01-26 12:35:05 scdaemon[22] DBG: response: sw=9000 datalen=0
2021-01-26 12:35:05 scdaemon[22] DBG: dump:
2021-01-26 12:35:05 scdaemon[22] DBG: send apdu: c=00 i=20 p1=00 p2=83 lc=8 le=-1 em=0
2021-01-26 12:35:05 scdaemon[22] DBG: PCSC_data: 00 20 00 83 08 31 32 33 34 35 36 37 38
2021-01-26 12:35:05 scdaemon[22] DBG: response: sw=9000 datalen=0
2021-01-26 12:35:05 scdaemon[22] DBG: dump:
2021-01-26 12:35:05 scdaemon[22] DBG: send apdu: c=00 i=DA p1=00 p2=F9 lc=110 le=-1 em=0
2021-01-26 12:35:05 scdaemon[22] DBG: PCSC_data: 00 DA 00 F9 6E 81 01 03 82 01 08 83 04 02 80 00 00 84 08 C2 35 03 19 6A A7 DC EB 85 08 71 5D 2D D6 06 C1 A7 8A 86 08 9D EB 8D 7C 4F 8F 0A BF 87 20 23 E2 3D E0 55 DF 8F 8B 18 FF 25 BE 96 38 1F 08 FF 52 5F F3 73 72 CA F4 64 B4 DF 7B BF 07 92 0C 88 20 66 26 33 D4 D4 87 9B E4 5D 36 92 2F 61 B2 6D BD 62 BF 19 F1 DC 26 22 CA CD B4 22 8A A6 A4 A8 70
2021-01-26 12:35:05 scdaemon[22] DBG: response: sw=6F00 datalen=0
2021-01-26 12:35:05 scdaemon[22] failed to set 'KDF': Card error
2021-01-26 12:35:05 scdaemon[22] DBG: chan_7 -> ERR 100663404 Card error
Edit: the mentioned GnuPG patch is unfortunately for other devices than Nitrokey Start.
