search

Nitrokey / opcard-rs

OpenPGP card implementation
49 stars 1 forks source link

Investigate why opcard shows up as two pkcs11 tokens #119

Open sosthene-nitrokey opened 1 year ago

szszszsz commented 1 year ago

It's the normal state in OpenSC for the OpenPGP cards, unless do you mean something else?

sosthene-nitrokey commented 1 year ago

Not with all keys, for example it doesn't on a Yubikey 5. It does make sense to me that it would show up as 2 tokens but I don't really understand why it wouldn't on other keys.

saper commented 7 months ago

Can you run pkcs11-tool -T on Yubikey with the following system-wide opensc.conf and then dump /tmp/opensc-debug.log somewhere?

app default {
  debug = 9;
  debug_file = /tmp/opensc-debug.log;
}

Reading the code, there should be always two slots for the OpenPGP cards. This is for compatibility with OpenPGP v1 which had separate encryption and signing PINs. I think this could be simplified in OpenSC, though. But I don't know why Yubikey is not affected. Maybe only PIV slot is visible and not OpenPGP? I don't have one, so I don't know.