[solved] Nitrokey Pro - RHEL / CentOS 7 - Key generation failed: Card error

I don’t want anybody to say that I’m not going to bother. :sunglasses:

Since the generation of the key material on the smartcard currently does not work, I simply generated a new key as usual. The three keys for encrypting, signing and authorizing were moved to the Nitrokey Pro.

Application ID ...: D276000124010303000500006FDA0000
Version ..........: 3.3
Manufacturer .....: ZeitControl
Serial number ....: 00006FDA
Name of cardholder: Django aka BOfH
Language prefs ...: de
Sex ..............: männlich
URL of public key : [nicht gesetzt]
Login data .......: django
Signature PIN ....: zwingend
Key attributes ...: 4096R 4096R 4096R
Max. PIN lengths .: 64 64 64
PIN retry counter : 3 0 3
Signature counter : 2
Signature key ....: 2FF4 8288 4984 7D27 3CBF  69EF 421B 7A5D 1621 AC49
      created ....: 2018-11-17 22:51:18
Encryption key....: 1789 99D5 59DC 65B2 D81F  EEB1 BC80 7D20 08FE 8997
      created ....: 2018-11-17 22:44:20
Authentication key: 9B00 F5F6 0678 4C13 B8D3  C505 2833 72B3 7392 86FC
      created ....: 2018-11-17 22:51:50
General key info..: pub  4096R/1621AC49 2018-11-17 Django aka BOfH (Bastard Operator from Hell) <secmail@mailserver.guru>
sec#  4096R/05619F16  erzeugt: 2018-11-17  verfällt: niemals   
ssb>  4096R/08FE8997  erzeugt: 2018-11-17  verfällt: niemals   
                      Kartennummer:0005 00006FDA
ssb>  4096R/1621AC49  erzeugt: 2018-11-17  verfällt: niemals   
                      Kartennummer:0005 00006FDA
ssb>  4096R/739286FC  erzeugt: 2018-11-17  verfällt: niemals   
                      Kartennummer:0005 00006FDA

But if I try to sign a file this will fail unexpectedly.

$ gpg --sign -u 08FE8997 testdokument 
gpg: Prüfung der erstellten Signatur ist fehlgeschlagen: Falsche Unterschrift
gpg: Beglaubigung fehlgeschlagen: Falsche Unterschrift
gpg: signing failed: Falsche Unterschrift

I now assume that the communication between the firmware and the smartcard on the cryptostick works basically. Am I right in assuming that the communication fails somewhere between gnupg, the libccid and the firmware on the stick? Otherwise I can’t really explain it. :woozy_face:

… any idea or hint?