This application implements "The OpenPGP card" specification revision 3.0. This specification is available in *doc* directory and at https://g10code.com/p-card.html .
This application implements "The OpenPGP card" specification revision 3.3.
This specification is available in *doc* directory and at <https://g10code.com/p-card.html>.
The application supports:
- RSA with key up to 4096 bits
- ECDSA with secp256k1
- EDDSA with Ed25519 curve
- ECDH with secp256k1 and curve25519 curves
- RSA with key up to 4096 bits
- ECDSA with secp256k1
- EDDSA with Ed25519 curve
- ECDH with secp256k1 and curve25519 curves
This release has known missing parts (see also Add-on) :
* Ledger Blue support
* Seed mode ON/OFF via apdu
- Ledger Blue support
- Seed mode ON/OFF via apdu
## Installation and Usage
See the full doc at https://github.com/LedgerHQ/blue-app-openpgp-card/blob/master/doc/user/blue-app-openpgp-card.pdf
See the full doc at <https://github.com/LedgerHQ/blue-app-openpgp-card/blob/master/doc/user/blue-app-openpgp-card.pdf>
## Add-on
The GnuPG application implements the following addon:
- serial modification
- on screen reset
- 3 independent key slots
- seeded key generation
Technical specification is available at https://github.com/LedgerHQ/blue-app-openpgp-card/blob/master/doc/developper/gpgcard3.0-addon.rst
- serial modification
- on screen reset
- 3 independent key slots
- seeded key generation
Technical specification is available at <https://github.com/LedgerHQ/blue-app-openpgp-card/blob/master/doc/developer/gpgcard3.0-addon.rst>
This activation remains effective until *set off* is selected or the application
ends.
The key management remains the same if seed mode is on or off, i.e. key are stored in memory key containers. So their is no perfomance inpact when using seeded keys.
The key management remains the same if seed mode is on or off, i.e. key are stored in memory key containers. So there is no performance impact when using seeded keys.
Seeded keys are generated as follow:
@ -133,7 +133,7 @@ Generate RSA key pair as usual.
- n = p*q
- d = inv(e) mod (p-1)(q-1)
*ECC key genration* :
*ECC key generation* :
Generate one seed Sd in step2 with :
- i = 1
@ -188,16 +188,18 @@ For a given length *L* and seed *S*:
Key Backup & Restore
~~~~~~~~~~~~~~~~~~~~
In order to backup/restore private key the commands `put_data` and
`get_data` accept the tag `B6` (signature key), `B8`(encryption key),
`A4` (authentication).
In order to backup/restore private key the commands `put_data` and
`get_data` accept the tags:
- `B6` (signature key)
- `B8`(encryption key)
- `A4` (authentication).
put_data command accept the exact output of get_data. The get_data command
`put_data` command accept the exact output of `get_data`. The `get_data` command
return both the public and private key.
For security and confidentiality private key is returned encryped in AES.
The key used is derived according to previously described AES key derivation
with name 'key'.
For security and confidentiality, private key is returned encrypted in AES.
The key used is derived according to previously described AES key derivation
with name 'key'.
The data payload is formatted as follow:
@ -227,7 +229,7 @@ APDU Modification
Key Slot management
~~~~~~~~~~~~~~~~~~~~
Key slots are managed by data object 01F1 and 01F2 witch are
Key slots are managed by data object *01F1* and *01F2* witch are
manageable by PUT/GET DATA command as for others DO and organized as follow.
On application reset, the *01F2* content is set to *Default Slot* value
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -53,9 +53,9 @@ The application supports:
- RSA with key up to 4096 bits
- ECDSA with secp256k1, secp256r1, brainpool 256r1 and brainpool 256t1 curves
- EDDSA with Ed25519 curve
- ECDH with secp256k1, secp256r1, brainpool 256r1, brainpool 256t1 and
- ECDH with secp256k1, secp256r1, brainpool 256r1, brainpool 256t1 and
curve25519 curves
This release has known missing parts (see also [GPGADD]) :
- Ledger Blue support
@ -78,14 +78,14 @@ Use the "Ledger Manager" Chrome App. See https://www.ledgerwallet.com/apps/manag
As the "OpenPGP card" application is not fully compliant with UI and documentation guidelines, the application is in developer section: click on "Show developers items" on the bottom right corner to see it.
- Launch the Ledger Manager. See `Ledger Manager <https://www.ledgerwallet.com/apps/manager>`_
and ` <https://ledger.groovehq.com/knowledge_base/topics/ledger-manager>`_
- Launch the Ledger Manager. See `Ledger Manager <https://www.ledgerwallet.com/apps/manager>`_
and ` <https://ledger.groovehq.com/knowledge_base/topics/ledger-manager>`_
for details about installing and using the manager;
- Connect your Nano S or your Blue, enter your PIN, and stay on the
- Connect your Nano S or your Blue, enter your PIN, and stay on the
dashboard;
- Click on *show developer items* on the bottom right corner;
- Click on the green bottom arrow icon near the Ledger *Open PGP* logo;
- Confirm the installation when required on your device by pressing the
- Confirm the installation when required on your device by pressing the
right button above the check mark;
- Quit the Ledger Manager
@ -118,7 +118,7 @@ If you are using an old version of CCID, you have to have to add the NanoS to /e
- In <key>ifdVendorID</key> add the entry <string>0x2C97</string>
- In <key>ifdProductID</key> add the entry <string>0x0001</string>
- In <key>ifdFriendlyName</key> add the entry <string>Ledger Token</string>
These 3 entries must be added at the end of each list.
For the NanoX :
@ -138,7 +138,7 @@ MAC
- In <key>ifdVendorID</key> add the entry <string>0x2C97</string>
- In <key>ifdProductID</key> add the entry <string>0x0001</string>
- In <key>ifdFriendlyName</key> add the entry <string>Ledger Token</string>
This 3 entries must be added at the end of each list.
Charles-Edouard de la Vergne
11 months ago