Merge pull request #97 from LedgerHQ/cev/clean_supported_algo

Handle supported algorithms and curves

Makefile

@@ -29,8 +29,8 @@ APPNAME = OpenPGP
 
 # Application version
 APPVERSION_M = 2
-APPVERSION_N = 0
-APPVERSION_P = 1
+APPVERSION_N = 1
+APPVERSION_P = 0
 APPVERSION = "$(APPVERSION_M).$(APPVERSION_N).$(APPVERSION_P)"
 
 SPECVERSION:="3.3.1"
@@ -122,6 +122,8 @@ DISABLE_STANDARD_WEBUSB = 1
 DEFINES   += CUSTOM_IO_APDU_BUFFER_SIZE=\(255+5+64\)
 DEFINES   += HAVE_USB_CLASS_CCID
 DEFINES   += HAVE_RSA
+# Watchdog issue causing the device reset with long prime number computation
+# DEFINES   += WITH_SUPPORT_RSA4096
 
 ifeq ($(TARGET_NAME),TARGET_NANOS)
 DEFINES   += HAVE_UX_LEGACY

README.md

@@ -11,7 +11,7 @@ This specification is available in *doc* directory and at <https://g10code.com/p
 
 The application supports:
 
-- RSA with key up to 4096 bits
+- RSA with key up to 3072 bits
 - ECDSA with secp256k1
 - EDDSA with Ed25519 curve
 - ECDH with secp256k1 and curve25519 curves
@@ -321,3 +321,11 @@ It outputs 3 artifacts:
 
 - `compiled_app_binaries` within binary files of the build process for each device
 - `code-coverage` within HTML details of code coverage
+
+## Known limitations
+
+Today, the current App has some known limitations.
+
+- RSA4096 is disabled, because of an issue with the watchdog, resetting the device
+  during long prime number operation.
+- Using Ed25519 template, the decrypt doesn't output a correct result.

doc/user/app-openpgp.rst

@@ -50,10 +50,10 @@ This specification is available in doc directory at [G10CODE]_.
 
 The application supports:
 
-- RSA with key up to 4096 bits
-- ECDSA with secp256k1, secp256r1, brainpool 256r1 and brainpool 256t1 curves
+- RSA with key up to 3072 bits
+- ECDSA with secp256R1
 - EDDSA with Ed25519 curve
-- ECDH with secp256k1, secp256r1, brainpool 256r1, brainpool 256t1 and curve25519 curves
+- ECDH with secp256R1 and curve25519 curves
 
 This release has known missing parts (see also [GPGADD]_):
 
@@ -154,8 +154,7 @@ The full menu layout is:
  |         Choose Type...
  |             RSA 2048
  |             RSA 3072
- |             RSA 4096
- |             NIST P256
+ |             SECP 256R1
  |             ED25519
  |         Set Template
  |     Seed mode *ON/OFF*
@@ -1100,7 +1099,7 @@ The *usage* field tells you each key purpose:
 The *card-no* field provides you with the serial number of the card on which the key are stored.
 You should have 3 or less keys with the same serial. These are the keys we want to restore.
 
-For each key you also have the key template (*rsa2048*, *rsa3072*, *rsa4096*, *ed2559*, *cv25519*) followed by the
+For each key you also have the key template (*rsa2048*, *rsa3072*, *ed2559*, *cv25519*) followed by the
 short fingerprint, e.g. ``ed25519/8451AAF7D43D1095``
 
 Please note the serial and the 3 key template names: ``FD6C11BE`` , ``ed25519:cv25519:ed25519``.
@@ -1465,7 +1464,7 @@ Its usage is:
  |  ``--set-templates SIG:DEC:AUT``
  |                        ``Set template identifier for selected 'key-type'``
  |                        ``If 'key-type' is not specified, set for all keys (SIG:DEC:AUT)``
- |                        ``Valid values are rsa2048, rsa3072, rsa4096, nistp256, ed25519, cv25519``
+ |                        ``Valid values are rsa2048, rsa3072, nistp256, ed25519, cv25519``
  |  ``--seed-key            Regenerate all keys, based on seed mode``
  |  ``--file FILE           Public Key export file (default is 'pubkey')``
 

manual-tests/manual.sh

@@ -10,6 +10,7 @@ dirName=$(dirname "${exeName}")
 gnupg_home_dir="$(realpath "${dirName}/gnupg")"
 
 VERBOSE=false
+EXPERT=false
 
 #===============================================================================
 #
@@ -23,7 +24,8 @@ help() {
   echo
   echo "Options:"
   echo
-  echo "  -c <init|card|encrypt|decryptsign|verify>  : Requested command"
+  echo "  -c <init|reset|card|encrypt|decryptsign|verify>  : Requested command"
+  echo "  -e     : Expert mode mode"
   echo "  -v     : Verbose mode"
   echo "  -h     : Displays this help"
   echo
@@ -32,10 +34,10 @@ help() {
 
 #===============================================================================
 #
-#     kill_process - Kill running process, ensure clear next operation
+#     reset - Kill running process, ensure clear next operation
 #
 #===============================================================================
-kill_process() {
+reset() {
   # Kill running process
   killall scdaemon gpg-agent 2>/dev/null
 }
@@ -46,7 +48,7 @@ kill_process() {
 #
 #===============================================================================
 init() {
-  kill_process
+  reset
 
   # Cleanup old gnupg home directory
   dir=$(basename "${gnupg_home_dir}")
@@ -68,8 +70,11 @@ init() {
 #
 #===============================================================================
 card() {
+  local expert_mode=""
 
-  gpg --homedir "${gnupg_home_dir}" --card-edit
+  [[ ${EXPERT} == true ]] && expert_mode="--expert"
+
+  gpg --homedir "${gnupg_home_dir}" ${expert_mode} --card-edit
 }
 
 #===============================================================================
@@ -79,7 +84,8 @@ card() {
 #===============================================================================
 encrypt() {
   local recipient=""
-  kill_process
+  local verbose_mode=""
+  reset
   rm -fr foo*
   echo CLEAR > foo.txt
 
@@ -98,8 +104,9 @@ encrypt() {
 #
 #===============================================================================
 decrypt() {
+  local verbose_mode=""
 
-  kill_process
+  reset
 
   [[ ${VERBOSE} == true ]] && verbose_mode="--verbose"
 
@@ -121,8 +128,9 @@ decrypt() {
 #
 #===============================================================================
 sign() {
+  local verbose_mode=""
 
-  kill_process
+  reset
   rm -fr foo*
   echo CLEAR > foo.txt
 
@@ -137,8 +145,9 @@ sign() {
 #
 #===============================================================================
 verify() {
+  local verbose_mode=""
 
-  kill_process
+  reset
 
   [[ ${VERBOSE} == true ]] && verbose_mode="--verbose"
 
@@ -156,12 +165,12 @@ if (($# < 1)); then
   help
 fi
 
-while getopts ":c:vh" opt; do
+while getopts ":c:evh" opt; do
   case $opt in
 
     c)
       case ${OPTARG} in
-        init|card|encrypt|decrypt|sign|verify)
+        init|reset|card|encrypt|decrypt|sign|verify)
           CMD=${OPTARG}
           ;;
         *)
@@ -171,6 +180,7 @@ while getopts ":c:vh" opt; do
       esac
       ;;
 
+    e)  EXPERT=true ;;
     v)  VERBOSE=true ;;
     h)  help ;;
 

pytools/gpgapp/gpgcmd.py

@@ -22,7 +22,7 @@
 KEY_TEMPLATES = {
     "rsa2048" : "010800002001",
     "rsa3072" : "010C00002001",
-    "rsa4096" : "011000002001",
+    # "rsa4096" : "011000002001", not supported yet
     "nistp256": "132A8648CE3D030107",
     "ed25519" : "162B06010401DA470F01",
     "cv25519" : "122B060104019755010501"