Milestone for Nitrokey 3 Achieved: OpenPGP Card, One-Time Passwords and USB-C Availability!

Today, we are excited to announce the official release of the Nitrokey 3 firmware version 1.4.0. This is a big achievement for us, as the new firmware enables long-awaited features that will further improve privacy, security and ease of use for our users. Moreover, the production of the Nitrokey 3C NFC model has been sped up exponentially lately: we’re shipping hundreds of units every week and we expect to have all pre-orders shipped by the end of next week. From then on all Nitrokey 3 models will be on stock and available to order in our online shop. We would like to thank our users for their patience, hoping the result will be worth the wait. Now, let’s take a closer look at the new features that come with firmware 1.4.0!

OpenPGP Card

Arguably the most awaited feature for Nitrokey 3 is the OpenPGP Card. It’s a smart card that is often used for OpenPGP (Pretty Good Privacy) and GnuPG (GPG) to encrypt user data and e-mails. OpenPGP Card can also be used for arbitrary encryption, signing, and authentication use cases such as secure and convenient SSH logins. The new firmware now allows you to securely store your private keys on a Nitrokey 3 and use them on the go. For now your keys will be stored encrypted in flash and not in the secure element yet. Security does not sacrifice transparency: as usual, the new firmware is released under a fully open source license, allowing users to inspect the code and modifying it; something that sets Nitrokey apart from competitors.

One-Time Passwords (OTP)

One Time Passwords (OTP) are supported alongside the OpenPGP Card. It enables Nitrokey 3 to generate one-time passwords that, when enabled, during login will be requested from the user as a two-factor authentication (2FA) method after they entered their password. This approach combines something you know (the password) with something you have (the device generating the OTP), making you less vulnerable to password phishing attacks. For the time being, One Time Passwords can be generated through the nitropy command-line tool, but we have news in this regard as well. Read on…

using OPT with nitropy

Graphical User Interface: Nitrokey App 2

We recently released the Nitrokey App 2! Newly developed from scratch in Python, the app takes advantage of the pynitrokey library to feature an intuitive design to manage all Nitrokey 3 devices. Nitrokey App 2 is currently available through an MSI installer for Windows and a binary file for Linux, while a Flatpak version and macOS support are being worked on. It can already be used to update the Nitrokey 3 firmware and support for one-time passwords is expected to become available soon.

Nitrokey App 2

What to Expect in the Future

Our team is already working on new functionalities, such as adding a password store into the Nitrokey 3, support for the popular password manager KeePassXC, PIV to allow passwordless logins for enterprise Windows users, integration with NitroPad resp. HEADS for measured boot, SE050 Secure Element integration, and to encrypt and sign data in web browsers with Nitrokey 3 and without additional client software. Stay tuned!

By the way: If you want to be informed more frequently about news and development progress, follow our blog.

10.5.2023

Comments

Submitted by _ on 10. May 2023 - 14:53
Gratulation zu diesem Meilenstein. ( ^^)Y☆Y(^^ )
Submitted by Klaus on 10. May 2023 - 20:15
Erstmal Gratulation, bald kann ich den Stick so verwenden, wie ich es vorhatte. Und zwar wollte ich den Nitrokey 3 dazu verwenden, mit Veracrypt meine Festplatte zu verschlüsseln. Ich habe heute mit Freuden feststellen können, dass mit der Firmware 1.4 OpenPGP unterstützt wird. Ich habe dann analog zur Anleitung für den Nitrokey Pro 2 versucht, der Veracryptanleitung zu folgen. *ttps://docs.nitrokey.com/pro/linux/hard-disk-encryption In dem Augenblick, in dem ich allerdings bei Veracrypt auf Manage Security Token klicke, erscheint die sehr hilfreiche Meldung "GENERAL ERROR" und die Anzeige zur Auswahl des Sicherheitstokens bleibt leer. Ist die Kompatibilität zum jetzigen Stadium vielleicht noch nicht so weit gediehen?
Submitted by meissner on 12. May 2023 - 12:56
Ja, im Detail wird es aktuell noch die eine oder andere Client Anwendung geben, die nicht funktioniert. Wir haben so gut es geht nach Spezifikation (der OpenPGP Card) entwickelt, manche Client Anwendungen brauchen aber noch die eine oder andere Anpassung. Wir arbeiten daran, dass wir hier breiteren Support sicherstellen können
Submitted by Klaus on 17. May 2023 - 16:01
Alles klar, aber ich glaube mittlerweile, es lag an mir. Habe Veracrypt mit PKCS#11 verwendet und es klappt mit dem Nitrokey 3 einwandfrei. Top!
Submitted by graudeejs on 11. May 2023 - 10:52
Thank yo for the work and progress, however I have mixed feelings, because Secure Element is not used to store GPG keys (the whole point of buying Nitrokey Pro) --- "For now your keys will be stored encrypted in flash and not in the secure element yet" --- So when can we expect proper implementation?
Submitted by meissner on 12. May 2023 - 12:58
Hard to predict when exactly this will happen - we will first work on ensuring compatibility with more client applications, but then we'll directly jump on the SE050 support.
Submitted by david keepass on 12. May 2023 - 1:38
hello, thanks, please support KeePass on ms-windows, not just KeePassXC.
Submitted by Sepp on 25. May 2023 - 20:06
KeePassXC works fine on Windows: keepassxc.org/download/#windows
Submitted by John Doe on 12. May 2023 - 15:34
Herzlichen Glückwunsch zu den erreichten Meilensteinen! Mittlerweile ist auch mit 3C angekommen, zusammen mit dem Release kann ich diesen jetzt sogar sinnvoll einsetzen - vielen Dank.
Submitted by anon on 15. May 2023 - 1:15
Hi there, I got my 3C recently and I'm really enjoying it so far! Just got a couple questions regarding the "For now your keys will be stored encrypted in flash and not in the secure element yet" statement.
  • Once the SE implementation is in place, will the users need to do anything to move them or will that all be taken care of via the update and...
  • Will the users be better off factory resetting the keys and letting the NK regenerate them, or is will the automated process (if it will exist) be sufficient enough.
  • What the security implications of the keys residing in flash and/or what security measures have been taken to ensure the security of the keys for now.
Mainly asking to figure out how much trust can be put into the NK3 with the firmware in its current state. I'm assuming that with the keys being stored in the flash, the key isn't as resistant to physical tampering. Thank you, and all the best
Submitted by meissner on 15. May 2023 - 13:32
Although this is not entirely defined/implemented yet, the plan is to allow the user to choose (configure) one of both options: store keys inside the SE050 and use its cryptographic primitives or store keys on the external flash and use (open-source) software cryptographic primitives. Migrating (automatically) from one variant into the other will most likely not be possible. About the security implications on how currently keys are stored - on a high level: The encryption is bound to the MCU (soldering out the external flash, will not allow you to extract the keys), even if you manage to extract the MCU's internal flash (which would mean you break the MCU's anti-tampering mechanisms) you will not be able to decrypt the keys on the external flash. Further the pin is also used to on top of that for deriving the encryption key, which adds another strong level of security. p.s.: have done minimal (layout) changes in your post for readability
Submitted by anon on 16. May 2023 - 0:27
Thank you for the detailed response, I really appreciate it. Out of curiosity, on a high level how will the SE050 functionality be implemented? My background is in C/C++, but I've never worked with secure elements and would love to know it compares to the flash method.
Submitted by meissner on 16. May 2023 - 13:53
We are using Trussed, which serves as a provider for e.g., cryptographic primitives (and file operations). Various different clients/apps are then attached to Trussed, e.g., Fido2 or OpenPGP Card. The latter realize the actual user-faced functionalities and use the backend via a request/response mechanism. Trussed receives a request (e.g., hash("abc")) and responds with whatever the request asked for. Quite recently we have extended Trussed to support multiple backends, which essentially means that the request can be dispatched to "somewhere" else instead of the pure software implementation. The SE050 is such a backend, which can be configured - so instead of e.g., hash("123") being executed by the software implementation, Trussed will dispatch the request towards the SE050. The SE050 will execute the operation and Trussed will pass the response on to the client. This especially means that for the client this will be mostly transparent, which is very beneficial for us, as this ensures that the client does not require any changes. On the backend side, the communication between the MCU and the SE050 is realized via I2C using APDUs.
Submitted by someone on 16. May 2023 - 23:45
How many credentials can we store with the future nk3 password manager ?
Submitted by meissner on 17. May 2023 - 10:49
With the first shot, we'll restrict the maximum to 100. Generally the available space should handle 500 easily, but there are some (internal) issues to be solved on the way. E.g., the listing performance suffers quite a lot at some point, but we are working on that and will increase this number step by step.
Submitted by charlie on 23. May 2023 - 12:10
When the next firmware will come out ?
Submitted by meissner on 23. May 2023 - 22:41
we expect a 1.5 release next or the week after...
Submitted by moof on 2. June 2023 - 4:26
Hi! Im kind of new in this field. I wonder do you have any plan on supporting Bitwarden or is it somehow supported through any means already? And what about clients on the mobile side, for ex KeepassDX, Bitwarden for Android etc.
Submitted by meissner on 5. June 2023 - 12:17
Hey, so far I know bitwarden's fido2-based authentication is working. For the mobile side I am not aware of any password-safe being able to use the Nitrokey 3 to unlock, but this also could be a lack of testing. If you find an application that you think might be supported don't hesitate to write us, so we can investigate and maybe do fixes in order to support it.
Submitted by tomka on 23. July 2023 - 12:34
Hallo ich warte immer noch auf die NitrokeyApp 2 für Mac. Wann ist denn damit zu rechnen?
Submitted by meissner on 24. July 2023 - 16:15
Hey, ja die Version für macOS fehlt noch, hier ist das Github Issue, gerne +1 melden um die Prio zusätzlich zu erhöhen. Grundsätzlich sollte aber die Installation über pypi funktionieren. Grundsätzlich ist das aber eine der top prio Aufgaben, die anstehen.
Submitted by wolfhorst on 20. September 2023 - 1:44
'Update the Nitrokey' sollte besser in 'Updating Nitrokey...' umbenannt werden.
Submitted by Marc on 11. October 2023 - 16:01
Hallo habe meine Nitrokey 3 NFC bekommen und stelle mit erstaunen fest das es keine Flatpack App für Linux gibt das ist echt enttäuschend. Hätte es gerne ausprobiert mit den ganzen Terminal tutorials komme ich nicht zurecht. Hoffe das die passende Nitrokey App für den Key3 bald erscheind. Meiner Meinung nach sollte nichts ohne vollständigen Softwaresupport verkauft werden.
Submitted by meissner on 15. October 2023 - 22:21
Hey Marc, ja leider gibt es noch kein Flatpak Paket. Wir hatten naiver-weise gehofft, dass wir das vorerst mit einem Single-Binary für Linux lösen können. Leider zeigt das gerne mal Inkompatibilitäten und wir haben jetzt auch Flatpak ganz oben auf die Liste geschrieben. Hier ist das Single-Binary für Linux, auspacken, ausführen, Daumen drücken. Darüber hinaus ist der Nitrokey 3 aber zumeist mit standartisierten Methoden und Applikationen zu nutzen:
  • FIDO2 geht mit jedem aktuellen Browser, auch die Verwaltung, in Chromium zB über chrome://settings/securityKeys (das muss man mit der Hand kopieren, der Link ist nicht "clickbar")
  • OpenPGPCard ist auch ein Standard, der von jeder Applikation benutzt werden kann die PKCS versteht: GPG, OpenSC, Kleopatra, etc etc
  • PasswordSafe geht tatsächlich nur über unser Tooling, wie beschrieben, wir arbeiten dran
Submitted by Kurt on 14. November 2023 - 4:12
Does this mean the SoloV2 also now supports OpenPGP?
Submitted by meissner on 20. November 2023 - 15:24
No, although Nitrokey and Solo share the same basis, this does not mean one can simply use the firmwares interchangeably.
Submitted by Maik on 20. January 2024 - 7:46
Wann kommt das Flatpak. Das binary will und will nicht laufen.
Submitted by meissner on 23. January 2024 - 13:26
Hey Maik, wir planen das nächste NitrokeyApp2 release für Ende dieser Woche, da es auch das erste mit flathub/flatpak support wird, wird es danach noch einige Tage dauern, wir werden bestimmt einen Blog Artikel dazu veröffentlichen.

Add new comment

Fill in the blank.