Installation

GNU/Linux

1. To access the OpenPGP smart card of the Nitrokey, install the package libccid.
2. This step is required as long as the latest device driver isn't included in major Linux distributions. Edit the file /etc/libccid_Info.plist (e.g. "sudo gedit /etc/libccid_Info.plist") and add the following bold lines.

      <key>ifdVendorID</key>
      <array>
         <string>0x20A0</string>
         <string>0x20A0</string>
         <string>0x20A0</string>
         <string>0x20A0</string>
   

      <key>ifdProductID</key>
      <array>
         <string>0x4108</string>
         <string>0x4109</string>
         <string>0x4211</string>
         <string>0x4230</string>
   

      <key>ifdFriendlyName</key>
      <array>
         <string>Nitrokey Pro</string>
         <string>Nitrokey Storage</string>
         <string>Nitrokey Start</string>
         <string>Nitrokey HSM</string>

3. For non-RPM based distributions only: Copy this file 41-nitrokey.rules to /etc/udev/rules.d/ and restart your system or restart udev:

   sudo service udev restart

4. Download and start the Nitrokey App. Perhaps you want to store it on the unencrypted partition of your Nitrokey Storage.
5. Open the About window from Nitrokey App's menu and check if you have the latest firmware installed. If it's not the latest, please update.
6. Use the Nitrokey App to change the default User PIN (default: 123456) and Admin PIN (default: 12345678) to your own choices.
7. Brand-new Nitrokey Storage need to be initialized first. Use the Nitrokey App and select "initialize device". This process generates AES keys and formats the entire volume with random data. Because this is a security-critical aspect we decided that users should perform it themselves. The process may take long (2.5h for 64 GB) but is only required once.
8. Use the Nitrokey App to unlock the encrypted storage which doesn't contain a partition and filesystem yet. Use your operating system's tool to create a partition and file system. You can use any filesystem but FAT32 is most common for mobile storages.

Your Nitrokey is now ready to use. Checkout the various use cases and supported applications.

Optional: OpenPGP Email Encryption

Optional step, if you want to use OpenPGP/GnuPG email encryption. Skip this step if unsure.

1. Install scdaemon ("sudo apt install scdaemon")
2. Install Gnu Privacy Assistant (GPA) or Thunderbird with Enigmail (instructions in German). Ensure that scdaemon is installed. Advanced users could use the command line tool GnuPG, see recommended instructions using subkeys and backup or simpler main key method (not recommended).
3. Initialization: Change the default User PIN (default: 123456) and Admin PIN (default: 12345678) to your own choices. Generate new keys or import your existing RSA keys (after backup!).

Optional: S/MIME Email Encryption, X.509 and PKCS#11

Optional step, if you want to use S/MIME email encryption with Thunderbird, TrueCrypt, certificate-based SSL/TLS authentication with Firefox, PuTTY/KiTTY, OpenSSH, OpenSSL, or any other PKCS#11 compatible software. Skip this step if unsure.

1. Install OpenSC
2. Initialization: If you didn't do so already, change the default User PIN (default: 123456) and Admin PIN (default: 12345678) to your own choices using OpenSC. Generate new keys or import your existing RSA keys. Note that a Nitrokey initialized with OpenSC doesn't work with GnuPG/OpenPGP. But the other way around works fine.