Using nitrokey directly without gpg or other dependancies

Nitrokeys
1

I want to use a nitrokey start as a license token for an application I have written.

To this end I need I way to implement challenge response on a USB stack like libusb or libusbp alone.

  1. I need to ask the nitrokey give me its public key.
  2. I need to ask the nitrokey to sign a nonce using the corresponding private key.
  3. I can then verify the returned signature in the application.

I cannot ask my users to install and set up gpg and all the cruft that comes with it.

Where can I find the documentation for direct access to the nitrokey? Do there exist convenient examples for this use case?

update:

I have done some reading of the pynitrokey source and see that there are iso7816 functions cmd_external_authenticate and cmd_internal_authenticate which i could use for mutual authentication.

These functions should be easy enough to port to my system.

However the input/outputs of these functions are not documented well enough and these functions seem not to be used by pynitrokey itself (grep doesn’t find them being called)

How to determine the keysize/algos etc. being used?

2

If you want to go low level, grab yourself OpenPGP card specification and study it. You can use tools like pkcs11-tool (higher level), openpgp-tool (middle level), pkcs15-tool (lower level) and opensc-explorer (very low level) from OpenSC learn about the PKCS#15 filesystem structure of an OpenPGP card (pretty complicated if you ask me).

Then you can start issuing raw protocol data units (“APDU”) with the tool of your choice. Section 7.1 of the spec gives you some “ISO commands” that can be supported.

Going deeper, your own CCID implementation is possible, too.

1 Like