Nitrokey 3 Alpha Firmware

Wir haben nun eine neue Alpha-Version 20221130 der Firmware für jetzt alle Nitrokey 3 Modelle veröffentlicht. Zukünftige Alpha-Versionen werden zentral im Nitrokey 3 Firmware Repository verfügbar sein.

Ein wesentlicher Unterschied ist die Verfügbarkeit für alle Nitrokey 3 Modelle, was auch einen wichtigen Schritt für die Codebasis darstellt. Die Firmware für den Nitrokey 3A NFC, 3C NFC und 3A Mini werden nun aus einer Codebasis gebaut, so dass zukünftig alle Modelle über die gleiche Funktionalität verfügen werden.

Einmalpasswörter (OTP)

Die Firmware enthält eine erste Implementierung für HOTP und TOTP als zweiten Faktor. Die aktuelle Version des Kommandozeilen-Tools pynitrokey kann für die Nutzung dieser Einmalpasswörter verwendet werden. Eine neue Nitrokey App 2 befindet sich bereits in Entwicklung um in Zukunft auch bequem über eine grafische Oberfläche (GUI) Einmalpasswörter verwenden zu können. Aktuell kann man wie folgt mittels pynitrokey OTPs mit der Alpha Firmware verwalten:

# Ein Einmalpasswort mit dem Namen 'test' registrieren:
$ nitropy nk3 otp register --experimental test ABCDEFGHIJKLMNOP
​
# Alle registrierten OTP-Einträge anzeigen:
$ nitropy nk3 otp show
​
# Das Einmalpasswort für den Namen 'test' erhalten:
$ nitropy nk3 otp get --experimental test
​
# Hilfe anzeigen:
$ nitropy nk3 otp --help
$ nitropy nk3 otp register --help
​
# --clear-password & --set-password funktionieren derzeit noch nicht

OpenPGP Card

Die erste Alpha-Version der OpenPGP Card wurde weiter entwickelt und in der aktuellen Version unterstützt jetzt auch RSA. Zusammenfassend, kann man jetzt RSA 2048, NIST P256 sowie Ed25519 Schlüssel generieren und RSA 4096 Schlüssel sind importierbar, aber nicht generierbar. Darüber hinaus haben wir die Kompatibilität mit OpenSC verbessert, sowie zahlreiche kleinere Fehler behoben. Wenn von einer vorausgehenden Alpha Firmware geupdated wird, ist es nötig einen speziellen factory-reset auszuführen ansonsten wird die OpenPGP Card nicht korrekt funktionieren.

Ausblick

Aktuell sind die obigen Funktionen ausschließlich in Software realisiert und die Einmalpasswörter (bzw. Secrets) und kryptographische Schlüssel werden noch unverschlüsselt im Mikroprozessor gespeichert. Wir haben uns das Ziel gesetzt, in den nächsten Monaten das Secure Element (SE050) zunächst mit Einmalpasswörtern zu integrieren und anschließend mit der OpenPGP Card. Abonniert dieses Blog um stets über die Entwicklungen informiert zu sein.

Kurzes Nitrokey 3 Status Update

Im wesentlichen gibt es nichts Neues zu berichten. Wie schon zuvor erwähnt planen wir weiterhin die Auslieferung der Nitrokey 3C NFC mit neuen Gehäuse ab Ende diesen Jahres.

Stay Secure
Your Nitrokey Team

6.12.2022

Comments

Submitted by Mateusz on 7. Dezember 2022 - 13:56
I've been using the alpha software on my NK3A for the last two days. OpenPGP works as expected. I have a question, though. You write "cryptographic keys are still stored unencrypted in the microprocessor". So let me ask you: when this is resolved in a new firmware release (in the months to come), will keys be somehow transferred to the secure element or will I lose them when updating firmware? Kind regards, Mateusz
Submitted by meissner on 8. Dezember 2022 - 12:15
Currently the plan that there will be no migration path. It is also very likely that (some of) the alpha releases on the way will also delete your keys as the underlying storage architecture will undergo various changes - that's one of the reasons we state that the alpha shall not be used for production. We will clearly communicate once we expect the key storage to be stable (this might even be before the OpenPGP Card feature itself will move into stable).
Submitted by Mateusz on 8. Dezember 2022 - 12:24
OK, I get it. Thank you for your answer.
Submitted by sycamore on 7. Dezember 2022 - 14:26
This sounds like really great progress, keep up the good work! :)
Submitted by coolellipses on 8. Dezember 2022 - 20:46
Hey. Since the Nitrokey 3 is CC EAL 6+ certified, has there been any consideration of getting an official Authenticator Certification Level from the FIDO alliance? They rate various FIDO2 authenticators on their ability to protect the secrets they're holding. This is useful for adoption in governments and perhaps even enterprises. The new generation of keys are supposedly utilizing the SE050 so I think this might play in your favor. fidoalliance.org/certification/authenticator-certification-levels/
Submitted by meissner on 8. Dezember 2022 - 22:27
Yes, we are currently looking at the options to go for a fido-alliance certification, but no ETA yet
Submitted by xxxx on 12. Dezember 2022 - 12:43
Hey. How many key pairs and passwords exactly can be stored in the NK3 is still unknown, right?
Submitted by meissner on 12. Dezember 2022 - 13:53
Initially there will only be one identity for OpenPGP Card, later likely more. But you are right, we cannot give numbers yet - we are currently working on the details of the storage concept especially on how the 2MB external flash can be incorporated together with the 50kb available on the SE050.
Submitted by BR on 12. Dezember 2022 - 13:16
For alpha testers, is there a special procedure to report bugs/issues or should we just dump things into GitHub issues?
Submitted by meissner on 12. Dezember 2022 - 13:48
Please report on Github, thanks
Submitted by noname on 14. Dezember 2022 - 7:54
Can you please clarify how fido resident keys are stored/protected? Is the security chip used? Will a firmware update erase them?
Submitted by meissner on 14. Dezember 2022 - 18:55
Currently they are stored exclusively inside the MCU's internal non-volatile memory. The MCUs are sealed and firmwares need to be signed, means there is no way to extract these w/o the signing keys. In the future there will be the option to save them onto the SE050 secure element for a even higher security, but this will come with the drawback that fido2 will not work through NFC (as there is not enough power to bring up the secure element during NFC operation). A firmware update will not delete the RKs.
Submitted by Anonymous on 18. Dezember 2022 - 15:27
Is there an ETA for the new app? Or a little peek on how the GUI would look like?
Submitted by meissner on 19. Dezember 2022 - 12:57
Currently we plan for beginning of 2023, there won't be too much functionality at the beginning - we planning for smaller, faster release cycles with this application to be able to do small (release) steps with constant improvements.
Submitted by noname on 20. Dezember 2022 - 19:27
please add a hint to the realease notes / readme that libccid version 1.5 is required source: ccid.apdu.fr / ccid / shouldwork.html otherwise the reset command using opensc-tool will not work
Submitted by meissner on 20. Dezember 2022 - 19:38
thanks for the hint, will do
Submitted by Anonymous on 15. Februar 2023 - 17:46
Since TOTP and HOTP have been implemented does that mean the NK3 (even if at alpha) can now be used as the OTP key for Heads instead of the Nitrokey Pro2 and the Librem Key?
Submitted by meissner on 23. Februar 2023 - 10:33
We are working on that, but there will very likely be the need for a firmware update to support the Nitrokey 3 together with HEADS and the Nitropads. We'll be announcing this once this is possible.
Submitted by Anonymous on 27. Februar 2023 - 22:42
Does that apply only for the HOTP functionality (which I assume is what you need to enable the LIBREM_KEY build option for), or also TOTP? (where you use a QR code) like the Yubikey mentioned in osresearch.net/Prerequisites#usb-security-dongles-aka-security-token-aka-smartcard
Submitted by meissner on 28. Februar 2023 - 14:43
The HOTP functionality is quite specific for this use-case. So you are right, the TOTP approach used is afaik a typical TOTP secret which should not differ from any other TOTP. But please take this with a grain of salt, as this is not a typical configuration for us our experience is limited with HEADS & TOTP.
Submitted by Jakob on 17. Februar 2023 - 11:23
I updated nitropy with pip and loaded firmware 1.2.2 When i try the example from above, i get on my NK3c $ nitropy nk3 otp register --experimental test ABCDEFGHIJKLMNOP Command line tool to interact with Nitrokey devices 0.4.33 Authentication failed with error: "OTPAppException(code=7903/Unknown SW code)" Aborted!
Submitted by meissner on 23. Februar 2023 - 10:36
Generally, for purely technical issues please report towards support (at) nitrokey (dot) com, or use Github issues. For specific issues happens because pynitrokey in its latest latest version is not compatible with the alpha firmware anymore, please use 0.4.31 or wait for some more days until we release a new firmware, which will then be compatible with pynitrokey again.
Submitted by graudeejs on 18. Februar 2023 - 9:37
Status updates... we need more gnupg firmware status updates... even if there is no breakthrough surely there is some progress that you can share
Submitted by meissner on 23. Februar 2023 - 10:38
There is not too much to report for OpenPGPCard recently, because we are working on the last details and stabilization. After the upcoming stable release there will be an alpha release shortly afterwards with a nearly stable OpenPGPCard, which means inclusion into stable is around the corner then.
Submitted by ragaller on 26. März 2023 - 12:37
For everybody trying the OTP examples from the top of this page: It took me a while to figure out, that the 'otp' subcommand was renamed to 'secrets' (nitropy 0.4.34): github.com/Nitrokey/pynitrokey/commit/8c663a67881d200d0f908a88e8e767494f1fa8c3
Submitted by loutchi on 25. März 2024 - 8:25
Hello, I wanted to know when do you expect the nitropkey 3 pro to work with heads ?
Submitted by meissner on 2. April 2024 - 13:29
Hey, the Nitrokey 3 already works together with HEADS e.g., through the upstream HEADS repository - but you can directly order Nitropads with a Nitrokey 3 and HEADS.

Add new comment

Fill in the blank.