<div dir="ltr">Ah that explains why. I find it very awesome that it works with these larger keys. I also experimented with the EC keys, Curve 25519. That works as well, super cool!<br><br>Generate key on host:<br><br> $ gpg2 --expert --full-gen-key<br> gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.<br> This is free software: you are free to change and redistribute it.<br> There is NO WARRANTY, to the extent permitted by law.<br><br> Please select what kind of key you want:<br> (1) RSA and RSA (default)<br> (2) DSA and Elgamal<br> (3) DSA (sign only)<br> (4) RSA (sign only)<br> (7) DSA (set your own capabilities)<br> (8) RSA (set your own capabilities)<br> (9) ECC and ECC<br> (10) ECC (sign only)<br> (11) ECC (set your own capabilities)<br> Your selection? 9<br> Please select which elliptic curve you want:<br> (1) Curve 25519<br> (3) NIST P-256<br> (4) NIST P-384<br> (5) NIST P-521<br> (6) Brainpool P-256<br> (7) Brainpool P-384<br> (8) Brainpool P-512<br> (9) secp256k1<br> Your selection? 1<br> Please specify how long the key should be valid.<br> 0 = key does not expire<br> <n> = key expires in n days<br> <n>w = key expires in n weeks<br> <n>m = key expires in n months<br> <n>y = key expires in n years<br> Key is valid for? (0) 1m<br> Key expires at Sat Oct 8 18:24:21 2016 CEST<br> Is this correct? (y/N) y<br><br> GnuPG needs to construct a user ID to identify your key.<br><br> Real name: c25519 remy<br> Email address: <a href="mailto:remy@remy.nl">remy@remy.nl</a><br> Comment: test<br> You selected this USER-ID:<br> "c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>>"<br><br> Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o<br> We need to generate a lot of random bytes. It is a good idea to perform<br> some other action (type on the keyboard, move the mouse, utilize the<br> disks) during the prime generation; this gives the random number<br> generator a better chance to gain enough entropy.<br> We need to generate a lot of random bytes. It is a good idea to perform<br> some other action (type on the keyboard, move the mouse, utilize the<br> disks) during the prime generation; this gives the random number<br> generator a better chance to gain enough entropy.<br> gpg: key 0x2670351E6ECB1A9F marked as ultimately trusted<br> gpg: revocation certificate stored as '/home/remy/.gnupg/openpgp-revocs.d/DA432D2A9DAB96074BC6F38E2670351E6ECB1A9F.rev'<br> public and secret key created and signed.<br><br> pub ed25519/0x2670351E6ECB1A9F 2016-09-08 [SC] [expires: 2016-10-08]<br> Key fingerprint = DA43 2D2A 9DAB 9607 4BC6 F38E 2670 351E 6ECB 1A9F<br> uid c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>><br> sub cv25519/0x59A85A111997E614 2016-09-08 [E] [expires: 2016-10-08]<br><br><br><br>Keytocard:<br><br> $ gpg --expert --edit-key 2670351E6ECB1A9F<br> gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.<br> This is free software: you are free to change and redistribute it.<br> There is NO WARRANTY, to the extent permitted by law.<br><br> Secret key is available.<br><br> gpg: checking the trustdb<br> gpg: public key of ultimately trusted key 0xB9073AEB64937870 not found<br> gpg: marginals needed: 3 completes needed: 1 trust model: pgp<br> gpg: depth: 0 valid: 4 signed: 13 trust: 0-, 0q, 0n, 0m, 0f, 4u<br> gpg: depth: 1 valid: 13 signed: 4 trust: 12-, 0q, 0n, 0m, 1f, 0u<br> gpg: next trustdb check due at 2016-09-10<br> sec ed25519/0x2670351E6ECB1A9F<br> created: 2016-09-08 expires: 2016-10-08 usage: SC <br> trust: ultimate validity: ultimate<br> ssb cv25519/0x59A85A111997E614<br> created: 2016-09-08 expires: 2016-10-08 usage: E <br> [ultimate] (1). c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>><br><br> gpg> key 1<br><br> sec ed25519/0x2670351E6ECB1A9F<br> created: 2016-09-08 expires: 2016-10-08 usage: SC <br> trust: ultimate validity: ultimate<br> ssb* cv25519/0x59A85A111997E614<br> created: 2016-09-08 expires: 2016-10-08 usage: E <br> [ultimate] (1). c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>><br> <br> gpg> keytocard<br> Please select where to store the key:<br> (2) Encryption key<br> Your selection? 2<br><br> sec ed25519/0x2670351E6ECB1A9F<br> created: 2016-09-08 expires: 2016-10-08 usage: SC <br> trust: ultimate validity: ultimate<br> ssb* cv25519/0x59A85A111997E614<br> created: 2016-09-08 expires: 2016-10-08 usage: E <br> [ultimate] (1). c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>><br><br> gpg> save<br><br><br><br>Keytocard also works<br><br> $ gpg --card-status<br><br> Reader ...........: 234B:0000:FSIJ-1.2.1-87022326:0<br> Application ID ...: D276000124010200FFFE870223260000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87022326<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: not forced<br> Key attributes ...: rsa4096 cv25519 rsa4096<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: 80C3 884D 5FEF 484A BE57 E05E 59A8 5A11 1997 E614<br> created ....: 2016-09-08 16:24:36<br> Authentication key: [none]<br> General key info..: sub cv25519/0x59A85A111997E614 2016-09-08 c25519 remy (test) <<a href="mailto:remy@remy.nl">remy@remy.nl</a>><br> sec ed25519/0x2670351E6ECB1A9F created: 2016-09-08 expires: 2016-10-08<br> ssb> cv25519/0x59A85A111997E614 created: 2016-09-08 expires: 2016-10-08<br> card-no: FFFE 87022326<br><br><br>Afterwards I was able to successfully encrypt a file with another key and use this key on the device to decrypt it. Yay! <br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><br><br><a href="https://raymii.org" target="_blank">https://raymii.org</a><br></div></div>
<br><div class="gmail_quote">On Thu, Sep 8, 2016 at 11:46 AM, Gary <span dir="ltr"><<a href="mailto:gary@mups.co.uk" target="_blank">gary@mups.co.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 07/09/16 19:54, Remy van Elst wrote:<br>
> One of the nice things now is that I can put a 4096 bit key on the card,<br>
> yay:<br>
><br>
</span>[snip]<br>
<span class="">> Generating the key on the card fails however:<br>
><br>
</span>[snip]<br>
<br>
Although I could be mistaken, I seem to recall it mentioned that the<br>
gnuk does not have enough memory to be able to generate a 4096 key on<br>
the card itself but works fine if you generate on another machine then<br>
upload.<br>
<br>
I didn't try generating a key on the gnuk itself I just uploaded my<br>
existing key 4096 key to mine and other than a bit of a delay (6-8<br>
seconds or so) for signing, it works great :)<br>
<span class="HOEnZb"><font color="#888888"><br>
Gary<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
______________________________<wbr>_________________<br>
gnuk-users mailing list<br>
<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a><br>
<a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" rel="noreferrer" target="_blank">https://lists.alioth.debian.<wbr>org/mailman/listinfo/gnuk-<wbr>users</a><br>
</div></div></blockquote></div><br></div>