Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Any plans to support EC secp256k1 parameters #405

Closed
dragom opened this issue Oct 13, 2022 · 10 comments
Closed

Any plans to support EC secp256k1 parameters #405

dragom opened this issue Oct 13, 2022 · 10 comments

Comments

@dragom
Copy link

dragom commented Oct 13, 2022

Looking that pgp applet already have this support, wondering if there is any plan to support this also in PIV?
https://docs.yubico.com/hardware/yubikey/yk-5/tech-manual/yk5-apps.html#elliptic-curve-cryptographic-ecc-algorithms
https://bitcoindev.network/using-gpg-as-a-bitcoin-address/

@qpernil
Copy link
Contributor

qpernil commented Oct 21, 2022

No current plan as that curve is not supported by the PIV spec, so it would be a proprietary extension. As you noted the algorithm is supported by the firmware so it would be very possible if the spec is updated.

@qpernil qpernil closed this as not planned Won't fix, can't repro, duplicate, stale Oct 24, 2022
@dragom
Copy link
Author

dragom commented Oct 24, 2022

Looked at PIV specs and yes, there is no curve yet. But this could take some time before it is. Maybe new applet for cypto will be better way to go. Thank you.

@qpernil
Copy link
Contributor

qpernil commented Oct 24, 2022

Well, you can use the pgp applet for the time being. Or YubiHSM2.

@dragom
Copy link
Author

dragom commented Oct 24, 2022

There is some problem using gpg applet and sign transaction, so looking for clean solution.
https://bitcoindev.network/using-gpg-as-a-bitcoin-address/
Unfortunately, we were not able to sign a bitcoin transaction directly with GPG due to its specific signing algorithm

@qpernil
Copy link
Contributor

qpernil commented Oct 24, 2022

The formatting of data to be signed is done outside the OpenPGP applet on any OpenPGP card, so in theory, with the right middleware, any data can be signed with the keys on the card (such as a YubiKey). Only the raw ecdsa signature operation is performed on-card.

@dragom
Copy link
Author

dragom commented Oct 24, 2022

Nice. Then I will investigate how they communicate with applet. Thank you.

@qpernil
Copy link
Contributor

qpernil commented Oct 24, 2022

A pkcs#11 implementation for the OpenPGP applet would be nice.. Then the client could be made generic and also support other devices, such as HSMs and smart cards.

@dragom
Copy link
Author

dragom commented Oct 24, 2022

Extended YKCS11 so that use also openpgp applet (for EC secp256k1) not just piv interface :)

@qpernil
Copy link
Contributor

qpernil commented Oct 24, 2022

Yes I see where you are coming from, but this would be applicable to any OpenPGP card and as such should probably be separate from YKCS11. But I will consider it.

@dragom
Copy link
Author

dragom commented Oct 24, 2022

Thank you for your time. Maybe I will have time to investigate your proposal just to make some proof-of-concept.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants