Since 2019 Kleopatra does not offer RSA-2048 in de-vs mode in the newcertificatewizard, but it is possible to generate a CSR / OpenPCP Certificate for existing RSA-2048 keys from a smartcard. This is esp. a problem for Netkey cards since the RSA-2048 cards should be deprecated but can still be used by switching to OpenPGP.
It would be good if we could have this for the next release.
Update 2023-01-16: Also prevent usage of all non-brainpool curves in de-vs mode.
| rLIBKLEO Libkleo | |||
| rLIBKLEO3cd4f9932ed6 Only RSA 3072, RSA 4096, and the Brainpool curves are de-vs compliant | |||
| rLIBKLEO1d9d7fe322f4 Add function to check if algorithm is de-vs compliant | |||
| rLIBKLEO2f2109dbb9a9 Add C++20 compatibility helper to check if string starts with a prefix | |||
| rKLEOPATRA Kleopatra | |||
| rKLEOPATRA93df10a60268 Disable CSR and OpenPGP key creation from non-compliant NetKey card keys | |||
| rKLEOPATRAa3ecaf138984 Don't check the individual keys if NetKey card isn't set up properly | |||
| rKLEOPATRA56fc0fd3b40f Disable CSR and OpenPGP key creation from non-compliant PIV card keys | |||
| rKLEOPATRAac6044aa2615 Cache information from PIV card and store algo in key info | |||
| rKLEOPATRA5c3d09cfffd1 Disable creating an OpenPGP key from non-compliant OpenPGP card keys | |||
| rKLEOPATRA92d4f4b66f13 Disable CSR creation for non-compliant OpenPGP card keys | |||
RSA-2048 can still be used in de-vs mode if it's listed in the RSAKeySizes config entry.
Right, I think with that you could even go down to 1024 or 512 (or does gnupg block this?). Its better to block this in de-vs mode as it says in our documents somewhere that we prevent generation of non-compliant keys at least in the GUI.
For testing someone could still leave de-vs mode and generate a key that way. I think the RSAKeySizes config entry was mainly added to silence the "But I really really want RSA-8k keys" complaints.
Done for OpenPGP cards, PIV cards, and NetKey cards.
Note that I explicitly reject any RSA algos other than "rsa3072" and "rsa4096" instead of excluding just some RSA algos (see
rLIBKLEO1d9d7fe322f4: Add function to check if algorithm is de-vs compliant.
This function can easily be extended with other algorithms that are not De-VS compliant (or unsupported by gpgsm) and that currently cause an "Unsupported algorithm" error.
Ideally, we'd use a list of compliant, supported algorithms which we would retrieve from gpg and gpgsm.
Back to WiP to also prevent usage of all non-brainpool curves (as requested by Werner in M9#117).
Now creation of OpenPGP certificates and CSRs from card keys in de-vs mode is only possible for RSA 3072, RSA 4096, and the Brainpool curves.
fwiw: For a Netkey 3.0 card with expired RSA 2048 certificates, CSR creation is not offered.
On Yubikey and OpenPGP card, OpenPGP creation is possible for RSA2048, too.
Key creation on Yubikey with Curve25519 fails with "General error", it is not disabled in Kleo.
On the Zeitcontrol OpenPGP card it is not offered (but it does not have the capability, anyway, AFAIK)
I think both RSA2048 and Curve25519 should be disabled in Kleo, as it is for key generation with gpg, for any smart card
In no case was the "create CSR" button enabled. So CSR does not seem to work at all in VS-Desktop-3.2.0.0-beta229/231
This task is about the creation of OpenPGP certificates or S/MIME CSR from existing card keys. In particular, it isn't about the creation of card keys.
Well, neither OpenPGP certifcate nor CSR creation from a key on a card is offered for any of the cards I tried.
But that is not only for RSA2048, but for all types of keys.
As example:
KEYPAIRINFO in 2.2 lacks the algorithm (and the fingerprint time). Kleopatra uses the algorithm to check if the algorithm is allowed in VSD.
with VS-Desktop-3.1.90.258-Beta, CSR creation is now greyed out for RSA2048, while it is offered and works for other algorithms