Open Headcrabed opened 10 months ago
14 card drivers in OpenSC have support for RSA 3072. But you need a card/token with applet that supports RSA 3072. NIST sp800-73-1 in 2006 defined it for PIV, but it was dropped in later versions. It looks like it is coming back.
grep "_sc_card_add_rsa_alg(card,.*3072" card-*
I assume you are referring specifically to the PIV card driver as NIST SP 800-78-5 is about Cryptographic Algorithms and Key Sizes for Personal Identity Verification
From the ChangeLog, I read the following:
In 2023, Revision 5 updates incorporate the following changes: • Table 1 reflects additional higher strength keys with at least 128-bit security and suggested sunsets of lower sized keys by 2030 in anticipation of the recommended migration to 128-bit security strength in 2031. • Accommodation of the Secure Messaging Authentication key • Deprecation of the symmetric card authentication key • Deprecation of 3TDEA algorithm with identifiers ‘00’ and ‘03’ • Removal of the retired RNG from CAVP PIV component testing where applicable
The only new feature added is the PIV Secure Messaging key. As far as I read the code, we're currently only supporting the pairing code for key establishment with PIV SM being disabled by default.
AFAICT, the new version should be supported if we add support for the asymmetric PIV SM key.
Problem Description
NIST SP 800-78-5 (Initial Public Draft) was released in september 2023. It has multiple modification including RSA3072 key support. Maybe we should add support for it? Or wait for final version? Draft release page: https://csrc.nist.gov/pubs/sp/800/78/5/ipd