SmartPGPApplet-large.cap gpg: key generation failed: Card error

[RobertKosten]

Hi,

I'm trying to generate keys with the SmartPGPApplet-large (Installed via java -jar gp.jar -install SmartPGPApplet-large.cap -create D276000124010304C0FE000000010000). The applet seems to be running fine on the card when using gpg --edit-card, however the generate command fails after the final okay confirmation:

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: key generation failed: Card error
Key generation failed: Card error
gpg: error setting forced signature PIN flag: Card error

I've tried both rsa4096 and rsa2048. I have also reached out to SmartPGP directly: SmartPGP#56

[StarGate01]

Have you switched the key type beforehand? Using the SmartPGP/bin/smartpgp-cli switch-rsa2048 resp. switch-rsa4096 command, see https://github.com/github-af/SmartPGP/blob/master/bin/smartpgp-cli .

[RobertKosten]

I haven't. The documentation says that is only needed when importing a key and explicitly not when generating one (https://github.com/DangerousThings/flexsecure-applets/blob/master/docs/applets/1-pgp.md)

Due to an implementation detail of the SmartPGP applet (github-af/SmartPGP#15), the card has to be configured for a specific algorithm before an existing key can be imported.
...
Generating keys on the card itself can be done for any algorithm without having to pre-configure the algorithm.

Additionally, RSA2048 is the default anyway, no?

(I'm currently traveling, so I can't try it out until next week, sorry)

[RobertKosten]

I have tried all reasonable permutations of

install SmartPGPApplet-default.cap || SmartPGPApplet-large.cap
smartpgp-cli switch-rsa2048 || smartpgp-cli switch-rsa4096 || `key-attr` (RSA, 2048) || `key-attr` (RSA, 4096) ||

I get

gpg: key generation failed: Card error
Key generation failed: Card error
gpg: error setting forced signature PIN flag: Card error

SmartPGPApplet-default.cap	smartpgp-cli switch-rsa2048	key-attr (RSA, 2048)	Card error
			Card error
		key-attr (RSA, 2048)	Card error
			Card error
SmartPGPApplet-large.cap	smartpgp-cli switch-rsa2048	key-attr (RSA, 2048)	Card error
		key-attr (RSA, 4096)	Card error, but no mention of PIN flag
			Card error
	smartpgp-cli switch-rsa4096	key-attr (RSA, 2048)	Card error
		key-attr (RSA, 4096)	Card error, but no mention of PIN flag
			Card error, but no mention of PIN flag
		key-attr (RSA, 2048)	Card error
		key-attr (RSA, 4096)	Card error, but no mention of PIN flag
			Card error

Here's the whole console from SmartPGPApplet-large.cap + smartpgp-cli switch-rsa4096 + key-attr (RSA, 4096):

robert@debian:~/Downloads$ sudo service pcscd stop
Warning: Stopping pcscd.service, but it can still be activated by:
  pcscd.socket
robert@debian:~/Downloads$ sudo service pcscd start
robert@debian:~/Downloads$ java -jar gp.jar -uninstall SmartPGPApplet-large.cap -create D276000124010304C0FE000000010000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
D27600012401 deleted.
Invalid argument: Need --[package, pkg] and --[applet] or --[cap]
robert@debian:~/Downloads$ java -jar gp.jar -install SmartPGPApplet-large.cap -create D276000124010304C0FE000000010000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
SmartPGPApplet-large.cap loaded: fr.anssi.smartpgp D27600012401
robert@debian:~/Downloads$ cd SmartPGP-master/bin/
robert@debian:~/Downloads/SmartPGP-master/bin$ ./smartpgp-cli switch-rsa4096
Select OpenPGP Applet
90 00
Verify Admin PIN
90 00
Switch to RSA4096 (sig)
90 00
Switch to RSA4096 (dec)
90 00
Switch to RSA4096 (auth)
90 00
robert@debian:~/Downloads/SmartPGP-master/bin$ cd -
/home/robert/Downloads
robert@debian:~/Downloads$ gpg --card-edit

Reader ...........: ACS ACR122U 00 00
Application ID ...: D276000124010304C0FE000000010000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: unknown
Serial number ....: 00000001
Name of cardholder: [not set]
Language prefs ...: en
Salutation .......: 
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa4096 rsa4096 rsa4096
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
KDF setting ......: off
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

gpg/card> admin
Admin commands are allowed

gpg/card> key-attr 
Changing card key attribute for: Signature key
Please select what kind of key you want:
   (1) RSA
   (2) ECC
Your selection? 1
What keysize do you want? (4096) 
Changing card key attribute for: Encryption key
Please select what kind of key you want:
   (1) RSA
   (2) ECC
Your selection? 1
What keysize do you want? (4096) 
Changing card key attribute for: Authentication key
Please select what kind of key you want:
   (1) RSA
   (2) ECC
Your selection? 1
What keysize do you want? (4096) 

gpg/card> generate
Make off-card backup of encryption key? (Y/n) n

Please note that the factory settings of the PINs are
   PIN = '123456'     Admin PIN = '12345678'
You should change them using the command --change-pin

Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Robert Kosten
Email address: mail@example.org
Comment: 
You selected this USER-ID:
    "Robert Kosten <mail@example.org>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: key generation failed: Card error
Key generation failed: Card error

gpg/card> quit

[RobertKosten]

And I can reproduce the issue with the "official" SmartPGP-v1.22.2-jc304-rsa_up_to_4096.cap as well, so I'm assuming this is either a hardware issue or something upstream.

[RobertKosten]

Quick update: Upstream has noted my reader (the cheap ACR122U) as the likely culprit SmartPGP#56. I've ordered a better reader and will update this ticket with my results.

[RobertKosten]

Well... Half the problem was the cheap reader, with the better one I can successfully use rsa2048. rsa4096 however is apparently never going to work, because the supplier didn't initialize the chip for it. According to JCAlgTest:

ALG_RSA LENGTH_RSA_512;yes;		0.627000;332;0;0
ALG_RSA LENGTH_RSA_736;yes;		3.017000;420;0;0
ALG_RSA LENGTH_RSA_768;yes;		1.795000;428;0;0
ALG_RSA LENGTH_RSA_896;yes;		1.789000;476;0;0
ALG_RSA LENGTH_RSA_1024;yes;		1.784000;524;0;0
ALG_RSA LENGTH_RSA_1280;yes;		4.606000;620;0;0
ALG_RSA LENGTH_RSA_1536;yes;		13.425000;716;0;0
ALG_RSA LENGTH_RSA_1984;yes;		10.638000;892;0;0
ALG_RSA LENGTH_RSA_2048;yes;		10.301000;908;0;0
ALG_RSA LENGTH_RSA_3072;no;		0.033000;24;0;0
ALG_RSA LENGTH_RSA_4096;no;		0.030000;24;0;0

Given the rsa4096 applet is explicitly provided here, I assume either no one has ever actually tried rsa4096 on the flexsecure before, or the supplier changed things over time, for whatever reason... either way, maybe a big, fat warning sign is in order...

NXP_P71_ALGSUPPORT__3b_8d_80_01_00_31_c1_73_c8_40_00_52_a5_10_00_90_00_70.csv

[StarGate01]

Thanks for your report, the applet is (according to https://github.com/github-af/SmartPGP/blob/master/src/fr/anssi/smartpgp/PGPKey.java#L234) using the KeyBuilder with TYPE_RSA_CRT_PRIVATE and TYPE_RSA_PUBLIC. I did run some AlgTest on the flexSecure chips and testcards quite a while back, but I will check again what is going on.

As a workaround, you can generate keys on your PC and then push them into the chip, as this only seems to affect on-chip key generation.

[RobertKosten]

As a workaround, you can generate keys on your PC and then push them into the chip, as this only seems to affect on-chip key generation.

Hm, might be worth it; I hadn't even considered it, because I like having the key never existing outside the chip, but if I generate it on a properly airgapped clean system...

So far I haven't been able to, both with rsa2048 and rsa4096 (after calling smartpgp-cli switch-rsa4096, of course) I get blocked with a KEYTOCARD failed: Card error (The operations work fine with GnuPG-cards). I guess I have another rabbit-hole to go down :-P