Howdie Alex,
O.K. I don’t want anyone to have to say that I’m not trying. O.K. a little stupid perhaps, but certainly not lazy.
Here are some informations about my environment:
# cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)
The following smartcard-relevant packages are installed:
# rpm -q pcsc-lite pcsc-lite-libs pcsc-tools opensc nitrokey-app
pcsc-lite-1.8.8-7.el7.x86_64
pcsc-lite-libs-1.8.8-7.el7.x86_64
pcsc-tools-1.4.25-1.el7.x86_64
opensc-0.16.0-8.20170227git777e2a3.el7.x86_64
nitrokey-app-1.2-1.el7.centos.x86_64
My user has the right access rights on the desired device file:
# lsusb
Bus 002 Device 021: ID 20a0:4108 Clay Logic
# ll /dev/bus/usb/002/021
crw-rw-r--+ 1 django plugdev 189, 148 19. Nov 17:28 /dev/bus/usb/002/021
As you told me, I made an factory-reset on my Nitrokey Pro 2.
$ gpg-connect-agent < nitrokey-reset.txt
S SERIALNO D276000124010303000500006FDA0000 0
OK
D[0000] 69 82 i.
OK
D[0000] 69 82 i.
OK
D[0000] 69 82 i.
OK
D[0000] 69 83 i.
OK
D[0000] 69 82 i.
OK
D[0000] 69 82 i.
OK
D[0000] 69 82 i.
OK
D[0000] 69 83 i.
OK
D[0000] 90 00 …
OK
D[0000] 90 00 …
OK
card has been reset to factory defaults
So, now I’ve a “virgin” cryptostick:
$ gpg2 --card-status
Application ID …: D276000124010303000500006FDA0000
Version …: 3.3
Manufacturer …: ZeitControl
Serial number …: 00006FDA
Name of cardholder: [nicht gesetzt]
Language prefs …: de
Sex …: unbestimmt
URL of public key : [nicht gesetzt]
Login data …: [nicht gesetzt]
Signature PIN …: zwingend
Key attributes …: 2048R 2048R 2048R
Max. PIN lengths .: 64 64 64
PIN retry counter : 3 0 3
Signature counter : 0
Signature key …: [none]
Encryption key…: [none]
Authentication key: [none]
General key info…: [none]
On a next step, I personalized my stick:
gpg/card> verify
Application ID ...: D276000124010303000500006FDA0000
Version ..........: 3.3
Manufacturer .....: ZeitControl
Serial number ....: 00006FDA
Name of cardholder: Michael Nausch
Language prefs ...: de
Sex ..............: männlich
URL of public key : [nicht gesetzt]
Login data .......: django
Signature PIN ....: zwingend
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 64 64 64
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
Last but not least I tried to generate a key on the stick using gpg2 --card-edit as user django:
gpg/card> generate
Sicherung des Verschlüsselungsschlüssel außerhalb der Karte erstellen? (J/n) n
Welche Schlüssellänge wünschen Sie für den Signatur-Schlüssel? (2048)
Welche Schlüssellänge wünschen Sie für den Verschlüsselungs-Schlüssel? (2048)
Welche Schlüssellänge wünschen Sie für den Authentisierungs-Schlüssel? (2048)
Bitte wählen Sie, wie lange der Schlüssel gültig bleiben soll.
0 = Schlüssel verfällt nie
= Schlüssel verfällt nach n Tagen
w = Schlüssel verfällt nach n Wochen
m = Schlüssel verfällt nach n Monaten
y = Schlüssel verfällt nach n Jahren
Wie lange bleibt der Schlüssel gültig? (0)
Schlüssel verfällt nie
Ist dies richtig? (j/N) j
GnuPG erstellt eine User-ID um Ihren Schlüssel identifizierbar zu machen.
Ihr Name ("Vorname Nachname"): Django aka BOfH
Email-Adresse: secmail@mailserver.guru
Kommentar: Bastard Operator from Hell
Sie haben diese User-ID gewählt:
"Django aka BOfH (Bastard Operator from Hell) <secmail@mailserver.guru>"
Ändern: (N)ame, (K)ommentar, (E)-Mail oder (F)ertig/(A)bbrechen? F
gpg: key generation failed: Kartenfehler
Schlüsselerzeugung fehlgeschlagen: Kartenfehler
gpg: error setting forced signature PIN flag: Eingabe-/Ausgabefehler
I don’t want to say anything, but somehow it’s very weird. It’s not like I’m dealing with a crypto device for the first time. But the ideas go out slowly. Especially I don’t know what I should still try or which information I could get for debugging purposes.
No one here has said that I were stupit or lazy - I was this by my own.
Thanks!
