Mailing List Archive: GnuPG: devel

USB Token for GnuPG

Index | Next | Previous | View Threaded

gniibe at fsij

Mar 9, 2009, 5:50 PM

Post #1 of 4 (812 views)
Permalink

USB Token for GnuPG

Hi,

I'm new to this list, pardon my ignorance if any.

I have an idea for USB Token which speaks OpenPGP card protocol, and
its Free Software implementation. The use-case will be like FSFE
membership card, but it won't require USB card reader.

I have done a little development with Atmel AVR ATmega328P 20MHz.
Currently, my mockup code works for "gpg --card-status" and
"gpg --clearsign". RSA signing takes five seconds or so. Not that
good, but not that bad, I think.

I know that it's totally not secure than Smart Card. Still, I think
that it could be used for some cases which don't require much
security, and it could be a reference device side Free Software
implementation.

Does it make sense?

Attached is a picture of my device. Any comments will be appreciated.
--

Attachments:

fsij-usb-token-experimental.jpg (13.4 KB)

wk at gnupg

Mar 10, 2009, 4:39 AM

Post #2 of 4 (754 views)
Permalink

Re: USB Token for GnuPG [In reply to]

Hi,

On Tue, 10 Mar 2009 01:50, gniibe [at] fsij said:

> I have done a little development with Atmel AVR ATmega328P 20MHz.
> Currently, my mockup code works for "gpg --card-status" and
> "gpg --clearsign". RSA signing takes five seconds or so. Not that

Cool. Does that implement the ISO-7816 commands or did you changed the
GnuPG code?

FWIW, there is a somewhat related project which uses a chip from a regular
card: http://wiki.privacyfoundation.de/GPFCryptoStick

Salam-Shalom,

Werner

--
Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

gniibe at fsij

Mar 10, 2009, 4:43 PM

Post #3 of 4 (747 views)
Permalink

Re: USB Token for GnuPG [In reply to]

Hi,

Werner Koch wrote:
> Cool. Does that implement the ISO-7816 commands or did you changed the
> GnuPG code?

No changes needed for GnuPG code. Although it's quite bad code now
(mostly hardcoded, many layer violation, etc.), it implements ISO-7816
commands on top of USB-ICC version A (T=0) protocol.

While we don't change GnuPG, I needed changes for ccid.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503638
I am not that confident for USB-ICC protocol. I will report again for
details for this bug soon.

FSIJ (Free Software Initiative of Japan) will have a meeting next week
for this USB Token. After that, I will put current implementation to
our web site. Note that hardware design is just taken from AVR-USB
project. Perhaps, I will publish RSA computation code for AVR
separately, it's basically based on the work by Tom St Denis and
heavenly hacked in AVR assembler.

> FWIW, there is a somewhat related project which uses a chip from a regular
> card: http://wiki.privacyfoundation.de/GPFCryptoStick

Yes, I know this. I think that GPFCryptoStick would be good for real use.
FSIJ's USB Token would be a kind of "development reference" or something.

Given this little success, I am considering to implement ECC instead
of RSA, because RSA 1024-bit won't survive so long, and we can expect
less seconds for computation.
--

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

wk at gnupg

Mar 11, 2009, 7:14 AM

Post #4 of 4 (747 views)
Permalink

Re: USB Token for GnuPG [In reply to]

On Wed, 11 Mar 2009 00:43, gniibe [at] fsij said:

> No changes needed for GnuPG code. Although it's quite bad code now
> (mostly hardcoded, many layer violation, etc.), it implements ISO-7816
> commands on top of USB-ICC version A (T=0) protocol.

I don't have a copy of 7816-12 here so I don't know any details.
However it seems that there is a version B which sends complete APDUs.
Any chance to implement that versions to get rid of the T=0 protocol
with all its problems?

> Given this little success, I am considering to implement ECC instead
> of RSA, because RSA 1024-bit won't survive so long, and we can expect
> less seconds for computation.

There is I-D to extend OpenPGP with ECC and we are already working on an
GnuPG implementation.

Shalom-Salam,

Werner

--
Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads