Start with a yubikey which already has OpenPGP keys on it. Either RSA or Brainpool.
Then try with keytocard to overwrite with the other type of key.
This results in
gpg: KEYTOCARD failed: Invalid value
Overwriting with the same key type is accepted.
| rG GnuPG | |||
| rG4c456bf07508 scd:openpgp: Fallback to default ECDH params in writekey. | |||
| rG1d472e4934b8 scd:openpgp: Print a diagnostic for the use of default ECDH params. | |||
| rG92af3f88a9df gpg: Pass ECDH parameters to OpenPGP smartcards | |||
| rGd03d0add1289 agent: Add optional ecdh parameter arg to KEYTOCARD. | |||
| rGb262a21c617d scd:openpgp: Support the ecdh-params arg for writing keys. | |||
| rGc03ba92576e3 gpg: Fix writing ECDH keys to OpenPGP smartcards. | |||
| rGfa4f716917e5 gpg: Make sure that we are not accidently working with the PIV app. | |||
| rG5118beeec18f gpg: Delete secret key after "keytocard". | |||
| rG2e065b4bd2d3 scd,openpgp: Switch key attributes between RSA and ECC in writekey. | |||
| rG706d557a6451 gpg: Delete secret key after "keytocard". | |||
| rG2630872cff71 scd,openpgp: Switch key attributes between RSA and ECC in writekey. | |||
| rG08cc34911470 gpg: Allow no version information of Yubikey | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Resolved | • werner | T6378 keytocard: invalid value | ||
| Resolved | • werner | T6382 keytocard fails to import a nistp384 ECDSA key | ||
| Open | • werner | T6465 Store the ECDH parameters in the key file | ||
| Open | • werner | T6620 Add a way to extract ECC key parameters from a public key |
Ooops. We do not have the automatic chnage of key type in the WRITEKEY command of scdaemon. This is only done when generating a key.
Test with GnuPG 2.4.1-beta76 failed with "error getting current key info: invalid name":
gpg> keytocard Den Hauptschlüssel wirklich verschieben? (j/N) y gpg: Fehler beim Holen der aktuellen Schlüsselinfo: Ungültiger Name
Unfortunately I can't replicate that with my Yubikey on 2.4.1. Tried several variant and with and without keyboxd. My Yubikey has PIV disabled but I doubt that this is the problem.
my Yubikey works, too, if I disable PIV. With enabled PIV:
4 - 2023-04-13 11:43:26 scdaemon[2604]: detected reader 'Yubico YubiKey OTP+FIDO+CCID 0' 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec -> S SERIALNO D2760001240100000006154932980000 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec -> OK 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec <- GETATTR SERIALNO 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: slot 0: have=piv want=piv keyref=[none] 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec -> S SERIALNO D2760001240100000006154932980000 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec -> OK 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec <- GETATTR KEY-FPR 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: slot 0: have=piv want=piv keyref=[none] 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: slot 0 app piv: calling getattr(KEY-FPR) 4 - 2023-04-13 11:43:26 scdaemon[2604]: DBG: chan_0x000002ec -> ERR 100663384 Ung�ltiger Name <SCD>
To replicate the problem it is best to use Windows. Should be solved with my commit. Note that the bug is specific to 2.4 dues to irts multi-card and app support. There was no problem on 2.2.