Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: GnuPG: devel

OpenPGP card and 4096 bit keys

 

 

GnuPG devel RSS feed   Index | Next | Previous | View Threaded


klaus at flittner

Oct 19, 2009, 10:55 AM

Post #1 of 2 (78 views)
Permalink
OpenPGP card and 4096 bit keys

Hi,

i have a openpgp card that supports 4096 keys (even the one from
kernelconcepts seems to support them). But the usage with gpg is
restricted to 3072 bit due to limits from the communication protocol
between gpg, gpg-agent and scdaemon.

As far as i've looked into the code the only two commands that cause a
problem are:
- genkey: Public Key is returned via status lines
- decrypt: encrypted message is passed as an extra command

In my opinion there are two possible ways to fix this limitation:
1. Increase the assuan line length limit (>1037 instead of 1000 bytes)
2. Change the protocol used for genkey and decrypt
- genkey would then return the publich key like readkey as s-expression
- decrypt would inquire the encrypted message instead of a setdata
before the call of decrypt

Has any of these two options a chance to be included in gnupg?

Regards
Klaus Flittner

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel[at]gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-devel


wk at gnupg

Oct 20, 2009, 12:36 AM

Post #2 of 2 (71 views)
Permalink
Re: OpenPGP card and 4096 bit keys [In reply to]

On Mon, 19 Oct 2009 19:55, klaus[at]flittner.org said:

> i have a openpgp card that supports 4096 keys (even the one from
> kernelconcepts seems to support them). But the usage with gpg is

Note that cards up to a s/n of 0x15a (346) from Zeitcontrol ahve a bug
in that decryption does not work with keys larger than 2048 bit.

> As far as i've looked into the code the only two commands that cause a
> problem are:
> - genkey: Public Key is returned via status lines
> - decrypt: encrypted message is passed as an extra command

Right.

> In my opinion there are two possible ways to fix this limitation:
> 1. Increase the assuan line length limit (>1037 instead of 1000 bytes)

No.

> 2. Change the protocol used for genkey and decrypt
> - genkey would then return the publich key like readkey as s-expression
> - decrypt would inquire the encrypted message instead of a setdata
> before the call of decrypt

Right. However, the change will be easier: We send the key using
several status lines.

This will go into GnuPG 2.1 as time permits.


Shalom-Salam,

Werner

--
Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz.


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel[at]gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

GnuPG devel RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.