opcard-rs

opcard is a Rust implementation of the OpenPGP smart card specification v3.4 using the Trussed framework for modern cryptographic firmware. It is developed for the Nitrokey 3 but can be used with any device supporting Trussed.

Usage

See the Nitrokey 3 documentation.

Features

opcard currently supports the basic OpenPGP Card functionality (key generation, key import, signing, decrypting, card administration).

Here are the currently supported algorithms:

• RSA-2048
• RSA-3072
• RSA-4096
• EcDSA and ECDH for:
• secp256r1 (NIST P-256)
• secp384r1 (NIST P-384)
• secp521r1 (NIST P-521)
• secp256k1 (Koblitz/Bitcoin curve)
• brainpoolp256r1
• brainpoolp384r1
• brainpoolp512r1
• EdDSA and ECDH for Curve25519

Development

Opcard uses virtualsmartcard for testing. make test will run opcard on the host through virtualsmartcard and test it.

make dangerous-real-card-test will instead run the tests against a real card. The vendor id and serial numbers can be configured with variables:

• OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR configures the USB vendor ID of the device
• OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT configures the USB product ID of the device

Those can be obtained by lsusb. In the line Bus 003 Device 010: ID 20a0:42b2 Clay Logic Nitrokey 3, 20a0 is OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR and 42b2 is OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT.

• OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR configures the PGP vendor ID of the device
• OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL configures the PGP serial number of the device.

Those can be obtained by opgpcard status. In the line OpenPGP card 000F:566F86B0 (card version 3.4), 000F is OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR and 566F86B0 is OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL.

Be aware that due to conflicts between gpg-agent and pcscd (the smartcard daemon), this test suite will start then stop pcscd

make dangerous-real-card-test \
  OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR="20A0" \
  OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT="42B2" \
  OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR="0000" \
  OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL="A020DF77" \
  OPCARD_DANGEROUS_TEST_CARD_NAME="test card"

To ensure backward compatibility, the test suite contains tests that the persistent state of the application can still be loaded from previous versions. Whenever the version is bumped in Cargo.toml, new "reference" files must be generated for the new version. This can be done with TEST_STATE_CAN_CREATE=true cargo test.

Bug reports

If you encounter a bug or have a feature request, please inform us on our forum. Please include the output of gpg --card-status so for context.

License

This project is licensed under the GNU Lesser General Public License (LGPL) version 3. Configuration files and examples are licensed under the CC0 1.0 license. For more information, see the license header in each file. You can find a copy of the license texts in the LICENSES directory.

This project complies with version 3.0 of the REUSE specification.

Funding

This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.