[sosthene-nitrokey]

Other algorithm are still not supported in firmware

[robin-nitrokey]

Looks good but I think we should reduce the duplication with the other commands.

[n0xena]

in reference to my #715 : this should be done more generic instead of fixing on rsa2048

[sosthene-nitrokey]

Currently only RSA2048 is supported in the firmware of the Nitrokey 3 for key import.

[31KM]

So I just build the branch as a package on Arch with the following PKGBUILD:

_name=pynitrokey
pkgname=python-pynitrokey
pkgver=0.11.4
pkgrel=1
pkgdesc="A command line interface for the Nitrokey FIDO2, Nitrokey Start, Nitrokey 3 and NetHSM"
arch=(any)
url="https://github.com/Nitrokey/pynitrokey"
license=(
...
)
depends=(
...
)
makedepends=(
...
)
# NOTE: there are no tests to run
optdepends=(
...
)
source=(
  "$_name::git+$url.git#branch=piv-import"
)
sha512sums=('SKIP')
b2sums=('SKIP')
validpgpkeys=(
...
)

build() {
  cd $_name
  python -m build --wheel --skip-dependency-check --no-isolation
}

package() {
  cd $_name
  python -m installer --destdir="$pkgdir" dist/*.whl
  install -vDm 644 README.md -t "$pkgdir/usr/share/doc/$pkgname/"
  install -vDm 644 LICENSES/*.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
}

After I installed it I tried the feature like this:

# Generate the key + cert
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout test.key -out test.crt -days 1 -subj "/CN=TestKey"

# Bundle key + cert into PKCS#12 file
# The command asks for a password, I used 'test'
openssl pkcs12 -export -out test.p12 -inkey test.key -in test.crt

# Import
nitropy nk3 piv --experimental import-key --key 8E --path test.p12 --admin-key [MANAGEMENT_KEY]

That fails with:

Command line tool to interact with Nitrokey devices 0.11.3
Critical error:
An unhandled exception occurred
	Exception encountered: ValueError('Invalid password or PKCS12 data')

I'm by no means an expert with this stuff, but I assume its caused by the fact that there is no option to specify the PKCS#12 password ('test')? See also here

Looking at the PR code I see this code:

        with open(path, "rb") as key_file:
            private_key, certificate, _ = pkcs12.load_key_and_certificates(
                key_file.read(), password=None
            )

So there is no way to pass a password to the PKCS#12 load operation. I think it would make sense to add one.

Some other remarks:

• This message should probably be "Admin key is expected to be an hexadecimal string", as key is also the argument name for the key slot, which makes this quite confusing
• This help string should probably be "Path to the .p12 file containing the private key", as .p12 is also used here

[31KM]

I also tried to bundle the PKCS#12 file without a password:

openssl pkcs12 -export -out test.p12 -inkey test.key -in test.crt -password pass:

But that fails during import with:

Command line tool to interact with Nitrokey devices 0.11.3
Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00
Critical error:
An unhandled exception occurred
	Exception encountered: StatusError(27265)

Not sure it is relevant, but:

nitropy nk3 version

v1.8.3

[mirko]

According to source the firmware meanwhile gained RSA-4096 support (as well as RSA-3072) - though to slot 9D only (why?!). Anyway, would be nice if nitropy would follow up on that.

PS: The restriction of importing RSA keys only into slot 9D also appears to apply to RSA-2048. Still/Again: why?
Especially given trussed-dev/piv-authenticator#56 would not introduce such a restriction for ECC keys.