GnuPG PKCS11 SCD

To start smart card daemon:

gnupg-pkcs11-scd --server verbose            

To list the objects on the screen:

learn

Scroll up to find the KEY-FRIENDLY values.

Sample:

KEY-FRIENDLY 3383BA6F3958077801F2C7BDCF39AF5A9C4

To exit the smart card daemon:

bye            

Run:

gpg --expert --full-generate-key

For the key type, select option 13:

Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
   (9) ECC (sign and encrypt) *default*
   (10) ECC (sign only)
   (11) ECC (set your own capabilities)
   (13) Existing key
   (14) Existing key from card
Your selection? 13

Enter your your GPG keypair fingerprint as the keygrip:

Enter the keygrip:

Select Q to finish:

Possible actions for a RSA key: Sign Encrypt Authenticate 
Current allowed actions: Sign Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Specify 0 for the key validity so that it does not expire:

Please specify how long the key should be valid.

        0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? 0

Specify Y if the key validity is correct:

Is this correct? (y/N) y

Provide your full name, email address, and comment if necessary to create your user ID (UID):

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: john.doe@example.com
Comment: Pass

Select O if the information is correct:

You selected this USER-ID:
    "John Doe (Pass) john.doe@example.com"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

To set offline environment variables:

export SM_PKCS11_OFFLINE_MODE=true
export SM_PKCS11_DB_DSN=~/smtools-linux-x64/gnupg.db

env | grep SM         

To create a local database with all the certificates from the service, using the keytool command:

keytool -list -keystore NONE -storepass NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerarg ./conf/pkcs11properties.cfg         

To verify gnudb.db database created:

ls -lrt | grep *.db         

To remove non-RSA keys from the database:

1. To open the database with SQLite3:

   sqlite3 ~/smtools-linux/gnupg.db

2. To count the objects:

   select COUNT(*) from PKCS11_OBJECT;

3. To delete any entries that are non-ECC:

   delete from PKCS11_OBJECT where object_id in (select distinct object_id from PKCS11_object where cka_key_type=3);

   Note

   This command removes any keys of cka_key_type=3 (ECC).

4. To exit SQLite3:

   .quit

To start smart card daemon:

gnupg-pkcs11-scd --server verbose            

To list the objects on the screen:

learn

Identify the KEYPAIRINFO field.

Identify the hex code after the last /.

Sample:

x20Token/62373536306330652D65353130646155383037

To decode the hex code to ASCII and return the keypair ID, use the xxd utility or any hex to ASCII converter.

Sample command:

echo "31383836373962372D306437372D343465352D616238332D613234393865306332393334" | xxd -r -p && echo            

To exit the smart card daemon:

bye