Yubico Forum

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-11-09T15:12:07+01:00

Just a heads-up that GnuPG 2.1.0 has now been released as the 'modern' branch.

Statistics: Posted by hazza — Sun Nov 09, 2014 3:12 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T14:51:09+01:00

For OpenPGP I see there is a proposed standard for ECC, RFC 6637, but it is only a proposed standard at this stage. GPG 2.1, which is still in beta after ~3 years, has ECC, but you need to go into expert mode.

GPG has support for the curves based on OIDs so Brainpool curves, etc., can be used (all parties would need support of course).

Ah that makes sense. I saw it was only a couple of hours (at the time), but saw that it had earlier commits, these must have been from when it was private.

I will investigate OpenPGP and OpenSC further. Perhaps with the help from GPG's ECC code and ykneo-curves code it will be possible to add ECC support to the OpenPGP applet.

Thanks for the help Klas.

Statistics: Posted by air — Wed Jun 18, 2014 2:51 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T13:10:58+01:00

Hard to be aware of it, it's been internal until this morning. It should only be viewed as a demonstrator/test for different ecc curves, nothing to be used as is. With that said though, it stores the keys it generates, one key per curve.

The openpgp applet might be possible to use for pkcs11 through opensc, though I haven't tried it and it might require some work. Apart from that the only thing Yubico has for pkcs11 is the PIV applet, which as you noted is proprietary and only available as is on shipped Neos.

The problem with adding other curves to the PIV applet is that no supporting software would work with those curves, everything would have to be modified to know about them. Windows wouldn't recognize the algorithm used, OpenSC wouldn't recognize it without patches, etc.

/klas

Statistics: Posted by Klas — Wed Jun 18, 2014 1:10 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T12:20:33+01:00

Thanks Klas, I wasn't aware of the ykneo-curves applet. I will check it out.
Does it store the private key or is it only used at run-time?

Is there any other PKCS#11 applets besides the PIV applet? I ask because my only reason for using PIV is to gain PKCS#11 support, but the PIV applet appears to be proprietary, since we are not able to perform upgrades of it. I want to be able to use 320-bit ECC, even if it doesn't conform to the PIV standard, such as by using the brainpoolp320r1 curve.

Statistics: Posted by air — Wed Jun 18, 2014 12:20 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T09:34:24+01:00

and as a follow-up, we've published the test applet for those curves at: https://github.com/Yubico/ykneo-curves

pull requests with more curves are ofcourse welcome.

/klas

Statistics: Posted by Klas — Wed Jun 18, 2014 9:34 am

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T08:55:54+01:00

Hello,

For the openpgp applet we've held off on ecc support since there is no spec and gnupg 2.1 is still so much in flux. When there is stable software supporting smartcard with ecc there we plan to revisit this.

For PIV only two ecc curves are defined secp256r1 and secp384r1, of those only secp256r1 can run in the Neo (since it only support curves up to 320 bit). So implementing other curves here would break with the spec and supporting software..

In experiments we've run a couple of other curves:
brainpoolp256r1
brainpoolp256t1
brainpoolp320r1
gost2001
secp256k1
secp256r1
frp256v1

other curves might work as well, though not tested by us.

/klas

Statistics: Posted by Klas — Wed Jun 18, 2014 8:55 am

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-06-18T08:28:29+01:00

The OpenPGP applet doesn't have ECC support, let alone for 320-bit keys.

The PIV applet depending on which version you have might support ECC, but only 256-bit keys. Not 320-bit keys. When will a PIV applet or similar be available that can use 320-bit ECC keys (PKCS#11/X.509)?

Is it possible to use secp256k1 curve or other 256-bit curves rather than the secp256r1 curve which is rumored to be backdoored by the NSA?

Similarly is it possible to use Koblitz or other curves at key-sizes greater than 256-bits (up to 320-bits) such as K-283, brainpoolP320r1, or brainpoolP320t1? Would the hardware support these and it's just a matter of the software (applets) to implement/use them?

I believe RSA2048, which is equivalent to 112-bit symmetric key, and ECC P-256, which is equivalent to 128-bit symmetric key, may be insufficient for some uses. For example the US Government requires key-lengths of 192 or greater for highly sensitive data. I guess this is not a requirement for most YubiKey users nor a goal of Yubico, but it would be nice to have on-par security especially if the hardware supports it and it's just a software development issue. It could also be a boon to Yubico to sell into government areas, all though this will probably need improvements in other areas as well, such as tamper-resistance.

Statistics: Posted by air — Wed Jun 18, 2014 8:28 am

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-02-13T21:37:36+01:00

Thanks for clearing that up. (I'm sorry for muddying the waters; I was working off of what the NXP TagInfo app reported.)

Statistics: Posted by ppc — Thu Feb 13, 2014 9:37 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-02-13T20:28:37+01:00

Hello,

Just to clear the confusion, it's based on the a700x chip from nxp (http://www.nxp.com/products/identificat ... AMILY.html) so it's limited to 2048 bit RSA and 320 bit ecc over gf(p).

/klas

Statistics: Posted by Klas — Thu Feb 13, 2014 8:28 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-01-29T21:30:18+01:00

ppc wrote:

The Yubikey NEO is using a NXP SmartMX P5CD081, right? The hardware supports 4k RSA keys and ECC (though you're right about the GnuPG ECC/non-NIST support... no point in chasing that).
Is there any reason I'm not seeing that this couldn't be fixed in the applet?

The same way my CPU can handle (in theory) 2^64 of memory, yet it pracitcally handles a bunch of gigabytes which in turn is limited by the motherboard support and number of slots.

At least according to "public specs" the JCOP chip can't do more than 2k, maybe there is some proprietary extension in JCOP that allows to do some, but then again, you'd be able to take the "NDA your grandma" approach to get that. You can't initiate a key with a bigger bit size than 2k according to JC.

Have a look at http://www.fi.muni.cz/~xsvenda/jcsupport.html

Support for ECC is a different story.

Statistics: Posted by martinpaljak — Wed Jan 29, 2014 9:30 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-01-26T22:47:43+01:00

Quote:

The Yubikey NEO is using a NXP SmartMX P5CD081, right? The hardware supports 4k RSA keys and ECC (though you're right about the GnuPG ECC/non-NIST support... no point in chasing that).

Is there any reason I'm not seeing that this couldn't be fixed in the applet?

Statistics: Posted by ppc — Sun Jan 26, 2014 10:47 pm

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-01-23T10:13:45+01:00

ppc wrote:

The OpenPGP card applet in the Yubikey NEO only supports 2048 bit RSA keys. Is there any plan to support larger keys and EC keys?

"opensc-tool --list-algorithms" indicates that the Yubikey NEO is capable of:

Is there any plan to accommodate larger key sizes in the hardware, such as 4096 bit RSA?

.

Don't trust OpenSC on this - it is apparently wrong. It seems that 2048+ RSA is not supported by the card (I wish it did 3k) and ECC requires more work on GnuPG side, still. Non-NIST curves in GnuPG is another problem point.

If you can withstand the trouble of changing your PGP keys, changes to the appelt can be done independently from Yubico.

Statistics: Posted by martinpaljak — Thu Jan 23, 2014 10:13 am

Re: Larger key size in Yubikey NEO (OpenPGP Card)

2014-01-23T08:17:23+01:00

No, only 2048.

No plans for more currently.

Statistics: Posted by Tom — Thu Jan 23, 2014 8:17 am

Larger key size in Yubikey NEO (OpenPGP Card)

2014-01-23T01:45:09+01:00

Code:

Algorithm: rsa
Key length: 1024

Algorithm: rsa
Key length: 2048

Algorithm: rsa
Key length: 3072

Algorithm: ec
Key length: 256

Algorithm: ec
Key length: 384

Is there any plan to accommodate larger key sizes in the hardware, such as 4096 bit RSA?

.

Statistics: Posted by ppc — Thu Jan 23, 2014 1:45 am