search

Nitrokey / nitrokey-3-firmware

Nitrokey 3 firmware
Apache License 2.0
234 stars 23 forks source link

Is it possible to run symmetric (aes or similar) block and stream cipher directly on the NK3? #497

Open jerabaul29 opened 3 months ago

jerabaul29 commented 3 months ago

Is it possible to run AES or similar block and stream cipher directly on the NK3?

I.e., let us say I want to be able to perform symmetric encryption / decryption in a safe way. I would like to have the secret key checked onto the NK3 "checked in only, no way to extract it" like for the GPG private key, and then do the AES operations directly on the key (I guess this will, for speed reasons, only work for limited amounts of data, but fair enough).

Is this already supported / would this be doable / are there plans for making this possible? Not sure if there are standard APIs / methods, a la GPG-smartcard standard, to do this in a convenient way?

sosthene-nitrokey commented 3 months ago

Yes, this is possible through the GPG smartcard standard.

We respect the specification. See the PSO:DECIPHER and PSO:ENCIPHER commands. They will allow you to perform the encryption/decryption with AES 256 CBC on the NK3 with a key that cannot be extracted.

Be aware that the uses cases for this are limited since there is no authentication. Nonce reuse is also very dangerous.

jerabaul29 commented 3 months ago

Thanks! I was trying to google a bit about all of this, but this was actually quite difficult - do you know of a good resource which shows how to "check in" the AES key onto the smartcard / use the smartcard and a specific AES key to perform encryption / decryption?

sosthene-nitrokey commented 3 months ago

I am not aware of a simple resource just explaining how to communicate with the GPG application for this specific use case.

You probably want to start with learning about PC/SC and the library for that on your language of choice.