Milestone for Nitrokey 3 Achieved: OpenPGP Card, One-Time Passwords and USB-C Availability!

Today, we are excited to announce the official release of the Nitrokey 3 firmware version 1.4.0. This is a big achievement for us, as the new firmware enables long-awaited features that will further improve privacy, security and ease of use for our users. Moreover, the production of the Nitrokey 3C NFC model has been sped up exponentially lately: we’re shipping hundreds of units every week and we expect to have all pre-orders shipped by the end of next week. From then on all Nitrokey 3 models will be on stock and available to order in our online shop. We would like to thank our users for their patience, hoping the result will be worth the wait. Now, let’s take a closer look at the new features that come with firmware 1.4.0!

OpenPGP Card

Arguably the most awaited feature for Nitrokey 3 is the OpenPGP Card. It’s a smart card that is often used for OpenPGP (Pretty Good Privacy) and GnuPG (GPG) to encrypt user data and e-mails. OpenPGP Card can also be used for arbitrary encryption, signing, and authentication use cases such as secure and convenient SSH logins. The new firmware now allows you to securely store your private keys on a Nitrokey 3 and use them on the go. For now your keys will be stored encrypted in flash and not in the secure element yet. Security does not sacrifice transparency: as usual, the new firmware is released under a fully open source license, allowing users to inspect the code and modifying it; something that sets Nitrokey apart from competitors.

One-Time Passwords (OTP)

One Time Passwords (OTP) are supported alongside the OpenPGP Card. It enables Nitrokey 3 to generate one-time passwords that, when enabled, during login will be requested from the user as a two-factor authentication (2FA) method after they entered their password. This approach combines something you know (the password) with something you have (the device generating the OTP), making you less vulnerable to password phishing attacks. For the time being, One Time Passwords can be generated through the nitropy command-line tool, but we have news in this regard as well. Read on…

using OPT with nitropy

Graphical User Interface: Nitrokey App 2

We recently released the Nitrokey App 2! Newly developed from scratch in Python, the app takes advantage of the pynitrokey library to feature an intuitive design to manage all Nitrokey 3 devices. Nitrokey App 2 is currently available through an MSI installer for Windows and a binary file for Linux, while a Flatpak version and macOS support are being worked on. It can already be used to update the Nitrokey 3 firmware and support for one-time passwords is expected to become available soon.

Nitrokey App 2

What to Expect in the Future

Our team is already working on new functionalities, such as adding a password store into the Nitrokey 3, support for the popular password manager KeePassXC, PIV to allow passwordless logins for enterprise Windows users, integration with NitroPad resp. HEADS for measured boot, SE050 Secure Element integration, and to encrypt and sign data in web browsers with Nitrokey 3 and without additional client software. Stay tuned!

By the way: If you want to be informed more frequently about news and development progress, follow our blog.



Gratulation zu diesem Meilenstein. ( ^^)Y☆Y(^^ )
Erstmal Gratulation, bald kann ich den Stick so verwenden, wie ich es vorhatte. Und zwar wollte ich den Nitrokey 3 dazu verwenden, mit Veracrypt meine Festplatte zu verschlüsseln. Ich habe heute mit Freuden feststellen können, dass mit der Firmware 1.4 OpenPGP unterstützt wird. Ich habe dann analog zur Anleitung für den Nitrokey Pro 2 versucht, der Veracryptanleitung zu folgen. *ttps:// In dem Augenblick, in dem ich allerdings bei Veracrypt auf Manage Security Token klicke, erscheint die sehr hilfreiche Meldung "GENERAL ERROR" und die Anzeige zur Auswahl des Sicherheitstokens bleibt leer. Ist die Kompatibilität zum jetzigen Stadium vielleicht noch nicht so weit gediehen?
Ja, im Detail wird es aktuell noch die eine oder andere Client Anwendung geben, die nicht funktioniert. Wir haben so gut es geht nach Spezifikation (der OpenPGP Card) entwickelt, manche Client Anwendungen brauchen aber noch die eine oder andere Anpassung. Wir arbeiten daran, dass wir hier breiteren Support sicherstellen können
Alles klar, aber ich glaube mittlerweile, es lag an mir. Habe Veracrypt mit PKCS#11 verwendet und es klappt mit dem Nitrokey 3 einwandfrei. Top!
Thank yo for the work and progress, however I have mixed feelings, because Secure Element is not used to store GPG keys (the whole point of buying Nitrokey Pro) --- "For now your keys will be stored encrypted in flash and not in the secure element yet" --- So when can we expect proper implementation?
Hard to predict when exactly this will happen - we will first work on ensuring compatibility with more client applications, but then we'll directly jump on the SE050 support.
hello, thanks, please support KeePass on ms-windows, not just KeePassXC.
KeePassXC works fine on Windows:
Herzlichen Glückwunsch zu den erreichten Meilensteinen! Mittlerweile ist auch mit 3C angekommen, zusammen mit dem Release kann ich diesen jetzt sogar sinnvoll einsetzen - vielen Dank.
Hi there, I got my 3C recently and I'm really enjoying it so far! Just got a couple questions regarding the "For now your keys will be stored encrypted in flash and not in the secure element yet" statement.
  • Once the SE implementation is in place, will the users need to do anything to move them or will that all be taken care of via the update and...
  • Will the users be better off factory resetting the keys and letting the NK regenerate them, or is will the automated process (if it will exist) be sufficient enough.
  • What the security implications of the keys residing in flash and/or what security measures have been taken to ensure the security of the keys for now.
Mainly asking to figure out how much trust can be put into the NK3 with the firmware in its current state. I'm assuming that with the keys being stored in the flash, the key isn't as resistant to physical tampering. Thank you, and all the best
Although this is not entirely defined/implemented yet, the plan is to allow the user to choose (configure) one of both options: store keys inside the SE050 and use its cryptographic primitives or store keys on the external flash and use (open-source) software cryptographic primitives. Migrating (automatically) from one variant into the other will most likely not be possible. About the security implications on how currently keys are stored - on a high level: The encryption is bound to the MCU (soldering out the external flash, will not allow you to extract the keys), even if you manage to extract the MCU's internal flash (which would mean you break the MCU's anti-tampering mechanisms) you will not be able to decrypt the keys on the external flash. Further the pin is also used to on top of that for deriving the encryption key, which adds another strong level of security. p.s.: have done minimal (layout) changes in your post for readability
Thank you for the detailed response, I really appreciate it. Out of curiosity, on a high level how will the SE050 functionality be implemented? My background is in C/C++, but I've never worked with secure elements and would love to know it compares to the flash method.
We are using Trussed, which serves as a provider for e.g., cryptographic primitives (and file operations). Various different clients/apps are then attached to Trussed, e.g., Fido2 or OpenPGP Card. The latter realize the actual user-faced functionalities and use the backend via a request/response mechanism. Trussed receives a request (e.g., hash("abc")) and responds with whatever the request asked for. Quite recently we have extended Trussed to support multiple backends, which essentially means that the request can be dispatched to "somewhere" else instead of the pure software implementation. The SE050 is such a backend, which can be configured - so instead of e.g., hash("123") being executed by the software implementation, Trussed will dispatch the request towards the SE050. The SE050 will execute the operation and Trussed will pass the response on to the client. This especially means that for the client this will be mostly transparent, which is very beneficial for us, as this ensures that the client does not require any changes. On the backend side, the communication between the MCU and the SE050 is realized via I2C using APDUs.
How many credentials can we store with the future nk3 password manager ?
With the first shot, we'll restrict the maximum to 100. Generally the available space should handle 500 easily, but there are some (internal) issues to be solved on the way. E.g., the listing performance suffers quite a lot at some point, but we are working on that and will increase this number step by step.
When the next firmware will come out ?
we expect a 1.5 release next or the week after...

Add new comment

Fill in the blank.

Nitrokey - Made in Germany