3

I am trying to use an Omnikey 6121 smartcard reader with an OpenPGPv2 smart card. The reader is recognized, as I see from gpg --card-status and I was able to edit some card details like URL, name etc

However, when I try to issue a "keytocard" command, I get the following:

gpg: writing new key
gpg: 3 Admin PIN attempts remaining before card is permanently locked

Please enter the Admin PIN
gpg: ccid_transceive failed: (0x10002)
gpg: apdu_send_simple(0) failed: invalid value
gpg: failed to store the key: invalid argument
gpg: error writing key to card: invalid argument

Same error with --debug-ccid-driver.

And similarly, if I just issue a "generate":

gpg/card> generate
Make off-card backup of encryption key? (Y/n) n

Please enter the PIN
What keysize do you want for the Signature key? (2048) 
What keysize do you want for the Encryption key? (2048) 
What keysize do you want for the Authentication key? (2048) 
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and E-mail Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Deim0s Anomaly
E-mail address: deim0s@example.com
Comment: 
You selected this USER-ID:
    "Deim0s Anomaly <deim0s@example.com>"

Change (N)ame, (C)omment, (E)-mail or (O)kay/(Q)uit? O
gpg: generating new key
gpg: 3 Admin PIN attempts remaining before card is permanently locked

Please enter the Admin PIN
gpg: please wait while key is being generated ...
gpg: generating key failed
gpg: key generation failed: general error
Key generation failed: general error

gpg/card> 

what's going on? Can somebody please help?

  • Does gpg --cardstatus work normally. What version of gpg, What kind of card do you have? Some older ones do not support longer keys, or long key generation on the card, and some older versions of gpg do not support longer key generation on cards either. If key generation on the card does not work but the rest does, you can generate the keys in a clean environment and upload them ( anthon.home.xs4all.nl/rants/2014/… ) – Anthon Sep 30 '14 at 15:17
  • @Anthon I also wrote that keytocard does not work. I just found solution, will update the question with the details – Deim0s Sep 30 '14 at 15:45
1

Weird, but I finally managed to make this setup work (Omnikey 6121 + OpenGPG v2 card). This is how a mere mortal can achieve the same:

  1. Disable 90gpg-agent-mine and 90ssh-agent-mine in /etc/X11/Xsession.d/ so that they won't try to start gpg-agent or ssh-agent
  2. Create a new gpg-agent-wrapper like explained in https://blog.flameeyes.eu/2010/08/smart-cards-and-secret-agents

In (1), the reason to not start gpg-agent from there is that it will not enable --enable-ssh-support, which is something I wanted.

By issuing a gpg --card-status, you will now notice a small delay and then:

gpg: detected reader `OMNIKEY CardMan (076B:6622) 6121 00 00'
Application ID ...: ......

That means card now also will work for writing operations! Yay! And my keytocard was successful :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.