support rutoken about gnupg-pkcs11-scd

[alonbl]

Please read the gnupg-pkcs11-scd man page and follow the Typical steps to set up a card for >=gpg-2.1.19 usage: instructions.

[ya-zero]

good.

gpg --card-status
gpg: WARNING: server 'scdaemon' is older than us (0.9.2 < 2.2.12)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: OpenPGP card not available: Bad session key

gnupg-pkcs11-scd.conf

providers p1 >provider-p1-library /usr/lib/librtpkcs11ecp.so
question : need openpgp-sign KEY-FRIEDNLY ?

gpg-agent.conf

scdaemon-program /usr/bin/gnupg-pkcs11-scd >pinentry-program /usr/bin/pinentry

gpg-agent server
SCD LEARN
https://pastebin.com/nXZAb9Qt

gpg --expert --full-generate-key
gpg (GnuPG) 2.2.12; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(9) ECC and ECC
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(13) Existing key
Your selection? 13
Enter the keygrip: BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A
No key with this keygrip

may be requared GPG_AGENT_INFO ?

[alonbl]

Please send debug log of gnupg-pkcs11.

[alonbl]

Is this includes the key gen or just the learn? Please also attach exact configuration. First we need gpg to work. בתאריך יום ב׳, 30 בספט׳ 2019 ב-14:50 מאת ya-zero <[email protected]>:

…

https://pastebin.com/heC8E2uu — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#21?email_source=notifications&email_token=AAJURLLY3XH3MJOSHYSC5T3QMHRZNA5CNFSM4I3R57L2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD75L72Q#issuecomment-536526826>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJURLN4OBZ4ORGWODJTPNDQMHRZNANCNFSM4I3R57LQ> .

[ya-zero]

https://paste2.org/PUhKfVKE

[ya-zero]

gnupg-pkcs11-scd.conf

debug-all

verbose

log-file /root/gnupg-pkcs11-scd.log

providers p1

provider-p1-library /usr/lib/librtpkcs11ecp.so

#provider-p1-cert-private

#emulate-openpgp
openpgp-sign BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

#openpgp-encr BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

#openpgp-auth BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

need learn key on token

[alonbl]

For som reason I cannot get raw content from you post, everything is mistakenly wrapped. Please remove L openpgp statements and make sure to paste it so I can see lines properly. And produce debug again. בתאריך יום ב׳, 30 בספט׳ 2019 ב-15:04 מאת ya-zero <[email protected]>:

…

1. gnupg-pkcs11-scd.conf debug-all verbose log-file /root/gnupg-pkcs11-scd.log providers p1 provider-p1-library /usr/lib/librtpkcs11ecp.so #provider-p1-cert-private #emulate-openpgp openpgp-sign BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A #openpgp-encr BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A #openpgp-auth BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A 1. need leard key on token — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#21?email_source=notifications&email_token=AAJURLKOTUBDOFVIWT2DYXTQMHTOJA5CNFSM4I3R57L2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD75NBOQ#issuecomment-536531130>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJURLJSHDKTGCDI4TTOVADQMHTOJANCNFSM4I3R57LQ> .

[ya-zero]

https://github.com/ya-zero/ya-zero.github.io/blob/master/uploads/gnupg-pkcs11-scd.log

update formating config
#21 (comment)

[alonbl]

Please also upload raw config used by this log and exact command sequence, as it seems like you kept openpgp statement. I may be wrong. Just to make sure. בתאריך יום ב׳, 30 בספט׳ 2019 ב-15:22 מאת ya-zero <[email protected]>:

…

https://github.com/ya-zero/ya-zero.github.io/blob/master/uploads/gnupg-pkcs11-scd.log — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#21?email_source=notifications&email_token=AAJURLNIKLUDTNXE3SXDNP3QMHVRTA5CNFSM4I3R57L2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD75ONRA#issuecomment-536536772>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJURLNTBEAXKNELEGPHEK3QMHVRTANCNFSM4I3R57LQ> .

[ya-zero]

1. https://github.com/ya-zero/ya-zero.github.io/blob/master/uploads/gnupg-pkcs11-scd.conf
2. https://github.com/ya-zero/ya-zero.github.io/blob/master/uploads/gpg-agent.conf
3. command no enter , i'm try run in shell start
   gnupg-pkcs11-scd --daemon
   gpg-agent --daemon
   gpg-agent --server

gpg --card-status

[ya-zero]

i'm configure
openpgp-sign BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A
openpgp-encr BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A
openpgp-auth BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

gpg --card-status

gpg: WARNING: server 'scdaemon' is older than us (0.9.2 < 2.2.12)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
Reader ...........: [none]
Application ID ...: D2760001240111503131CBAA96721111
Version ..........: 11.50
Manufacturer .....: unknown
Serial number ....: CBAA9672
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa48 rsa48 rsa48
Max. PIN lengths .: 0 0 0
PIN retry counter : 0 0 0
Signature counter : 0
Signature key ....: BEDF 773D 43C5 B817 E5B7 DA16 4DA6 DF21 B9F4 4C2A
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

gpg --expert --full-generate-key
13 Existing key
enter BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

Your selection? 13
Enter the keygrip: BEDF773D43C5B817E5B7DA164DA6DF21B9F44C2A

next question
Possible actions for a RSA key: Sign Certify Encrypt Authenticate
Current allowed actions: Sign Certify Encrypt

(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished

what to choose ?

[ya-zero]

if i'm toggle Current allowed actions: Sign Certify
next question
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.
Real name:
what to enter?

[alonbl]

Please *remove* any openpgp statements from configuration. I requested this several times already. You should strictly follow the man page instructions. The information gpg requires is the same information in gpg docs to produce a key.

[ya-zero]

very cool. always present in examples openpgp-sign/encr/auth . after remove whis string
everything is working.

root@ubuntu1904:~/.gnupg# gpg --list-keys
/root/.gnupg/pubring.kbx

pub rsa2048 2019-09-30 [SC]
E15216754A57D7448C83DD4B257BB235AD7BAFF3
uid [ultimate] [email protected] (0) [email protected]

root@ubuntu1904:~/.gnupg# gpg --list-secret-keys
/root/.gnupg/pubring.kbx

sec> rsa2048 2019-09-30 [SC]
E15216754A57D7448C83DD4B257BB235AD7BAFF3
Card serial no. = 3131 CBAA9672
uid [ultimate] [email protected] (0) [email protected]

[alonbl]

gpgsm should learn the certificate from the card