KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #typescript #codex #cli #claude-code #mcp #rust #deepseek-harness #ai-agent

opcard-rs

★ 59 Open GitHub ↗

OpenPGP card implementation

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# opcard-rs

`opcard` is a Rust implementation of the [OpenPGP smart card specification
v3.4][spec] using the [Trussed][] framework for modern cryptographic firmware.
It is developed for the [Nitrokey 3][] but can be used with any device
supporting Trussed.

[spec]: https://github.com/Nitrokey/openpgp-card/raw/master/OpenPGP%20Card%20Specification%203.4.pdf
[Trussed]: https://github.com/trussed-dev/trussed
[Nitrokey 3]: https://github.com/nitrokey/nitrokey-3-firmware

## Usage

See the [Nitrokey 3 documentation][docs].

[docs]: https://docs.nitrokey.com/nitrokey3/

## Features

`opcard` currently supports the basic OpenPGP Card functionality (key generation,
key import, signing, decrypting, card administration).

Here are the currently supported algorithms:

- RSA-2048
- RSA-3072
- RSA-4096
- EcDSA and ECDH for:
  - secp256r1 (NIST P-256)
  - secp384r1 (NIST P-384)
  - secp521r1 (NIST P-521)
  - secp256k1 (Koblitz/Bitcoin curve)
  - brainpoolp256r1
  - brainpoolp384r1
  - brainpoolp512r1
- EdDSA and ECDH for Curve25519

## Development

Opcard uses [virtualsmartcard](https://frankmorgner.github.io/vsmartcard/) for testing.
`make test` will run `opcard` on the host through virtualsmartcard and test it.

`make dangerous-real-card-test` will instead run the tests against a real card.
The vendor id and serial numbers can be configured with variables:

- `OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR` configures the USB vendor ID of the device
- `OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT` configures the USB product ID of the device

Those can be obtained by `lsusb`. In the line `Bus 003 Device 010: ID 20a0:42b2 Clay Logic Nitrokey 3`, `20a0` is `OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR` and `42b2` is `OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT`.

- `OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR` configures the PGP vendor ID of the device
- `OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL` configures the PGP serial number of the device.

Those can be obtained by `opgpcard status`. In the line `OpenPGP card 000F:566F86B0 (card version 3.4)`, `000F` is `OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR` and `566F86B0` is `OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL`.

Be aware that due to conflicts between `gpg-agent` and `pcscd` (the smartcard daemon), this test suite will start then  stop `pcscd`

```
make dangerous-real-card-test \
  OPCARD_DANGEROUS_TEST_CARD_USB_VENDOR="20A0" \
  OPCARD_DANGEROUS_TEST_CARD_USB_PRODUCT="42B2" \
  OPCARD_DANGEROUS_TEST_CARD_PGP_VENDOR="0000" \
  OPCARD_DANGEROUS_TEST_CARD_PGP_SERIAL="A020DF77" \
  OPCARD_DANGEROUS_TEST_CARD_NAME="test card"
```

To ensure backward compatibility, the test suite contains tests that the persistent state of the application can still be loaded from previous versions.
Whenever the version is bumped in `Cargo.toml`, new "reference" files must be generated for the new version.
This can be done with `TEST_STATE_CAN_CREATE=true cargo test`.

## Bug reports

If you encounter a bug or have a feature request, please inform us on [our forum](https://support.nitrokey.com/).
Please include the output of `gpg --card-status` so for context.

## License

This project is licensed under the [GNU Lesser General Public License (LGPL)
version 3][LGPL-3.0].  Configuration files and examples are licensed under the
[CC0 1.0 license][CC0-1.0].  For more information, see the license header in
each file.  You can find a copy of the license texts in the
[`LICENSES`](./LICENSES) directory.

[LGPL-3.0]: https://opensource.org/licenses/LGPL-3.0
[CC0-1.0]: https://creativecommons.org/publicdomain/zero/1.0/

This project complies with [version 3.0 of the REUSE specification][reuse].

[reuse]: https://reuse.software/practices/3.0/

## Funding

[<img src="https://nlnet.nl/logo/banner.svg" width="200" alt="Logo NLnet: abstract logo of four people seen from above" hspace="20">](https://nlnet.nl/)
[<img src="https://nlnet.nl/image/logos/NGI0PET_tag.svg" width="200" alt="Logo NGI Zero: letterlogo shaped like a tag" hspace="20">](https://nlnet.nl/NGI0/)

This project was funded through the [NGI0 PET](https://nlnet.nl/PET) Fund, a fund established by [NLnet](https://nlnet.nl/) with financial support from the European Commission's [Next Generation Internet programme](https://ngi.eu/), under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

opcard-rs

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README