By adding new DO (Data Object) for KDF, the OpenPGP card protocol will be improved, so that host computer can compute hash for passphrase with KDF.
This enhancement to the protocol can lower the risk when the data in a card will be accidentally exposed.
| rG GnuPG | |||
| rG91303b7df9c3 scd: Support KDF Data Object of OpenPGPcard V3.3. | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Resolved | • gniibe | T3152 KDF DO support in OpenPGP card | ||
| Resolved | • gniibe | T3201 KDF DO support enhancement | ||
| Resolved | • gniibe | T3823 gpg frontend support to setup KDF DO | ||
| Resolved | • gniibe | T3891 kdf-setup does not set admin and user PIN codes |
Here is the spec.
KDF algorithm byte: 0 - NONE, 3 - KDF_ITERSALTED_S2K Hash algorithm byte: 8 - SHA256, 10 - SHA512 Iteration count (4-byte) Salt bytes for User PIN Salt bytes for Reset Code Salt bytes for Admin PIN Initial PIN hash for User Initial PIN hash for Admin
When KDF-DO is none, it is equivalent to have KDF-DO of:
KDF algorithm byte: 0 - NONE Hash algorithm byte: 0 - N/A Iteration count (4-byte): None Salt bytes for User PIN: None Salt bytes for Reset Code: None Salt bytes for Admin PIN: None Initial PIN hash for User: "123456" Initial PIN hash for Admin: "12345678"
and here is a concrete example.
KDF algorithm byte: 3 - KDF_ITERSALTED_S2K Hash algorithm byte: 8 - SHA256 Iteration count (4-byte): 100000 Salt bytes for User PIN: 30 31 32 33 34 35 36 37 Salt bytes for Reset Code: 10 11 12 13 14 15 16 17 Salt bytes for Admin PIN: 41 42 43 44 45 46 47 48 Initial PIN hash for User: 773784A602B6C81E3F092F4D7D00E17CC822D88F7360FCF2D2EF2D9D901F44B6 - "123456" hashed by the KDF (with User's salt, SHA256, 100000 iter) Initial PIN hash for Admin: 2675D6164A0D4827D1D00C7EEA620D015C00030A1CAB38B4D0DD600B27DC9630 - "12345678" hashed by the KDF (with Admin's salt, SHA256, 100000 iter)
bit 0 (in smartcard context, we say b1 as it starts from 1) of Extended Capabilities specifies if KDF-DO is supported.
I realized that KDF support may be incompatible to Gnuk's feature of "admin-less" mode.
I'm going to implement compatible KDF support to Gnuk; That is, KDF data which only has a single salt.
In this case, all KDF calculation (user, reset-code, and admin) is done with the single salt.
With single salt, admin-less mode can work with no problem.