Re: [Openpgp-dt] v5 keys and hardware tokens (issue #63)

[NIIBE Yutaka <[e-mail]>]

Hello,

Daniel Kahn Gillmor wrote:
> The public keys data for each of these three secret keys can typically
> be extracted from the card, but they will be the raw public key
> material, not stored in full OpenPGP format.

Right.  Only raw public key material is available, it's not in OpenPGP
format.

> Some cards may not be able to produce the full raw public key material
> available, or may have it wrong, somehow. Or maybe it's expensive to
> retrieve?  (when/why is it not available?)

For all OpenPGP card implementations (I know of), after user generates
or loads key on smartcard, public raw key material is always avaiable.
I don't know any implementation which can not retrieve raw key material.

>  - arbitrary-length field of "URL", which is intended to point to a place to download the full certificates

For GnuPG, a user can do:

    gpg --card-edit -> fetch

to retrieve OpenPGP key from the URL.  (It was useful before WKD.)
It's because there is no (defined) space on card to store OpenPGP key.


> As v5 fingerprints are 32 octets, not 20 octets, they don't fit nicely
> on these cards.

Yes.

> As i understand it, the biggest concern we have is that some
> applications rely on the fingerprint field from the card in order to
> retrieve the OpenPGP fingerprint from the network.  Presumably this is
> donen because extracting the public key material from the card to create
> an OpenPGP public key and thereby derive the fingerprint is not always
> possible.

If we can assume some constants (like ECDH KDF parameters), OpenPGP
fingerprint can be derived with raw public key material plus timestamp.
When I tested in the past (in 2019) for v5 key, I did that.
--