Post by @Larvitz@burningboard.net

Finally, openpgp-card-tools from @hko landed in the FreeBSD package repositories.

Upstream-Project: https://codeberg.org/openpgp-card/openpgp-card-tools

FreeBSD Port: https://www.freshports.org/security/openpgp-card-tools/

It's a command-line utility to manage OpenPGP Cards and compatible devices (Yubikey, Nitrokey, etc). More tools from the same ecosystem (oct-git, ssh-agent) are in the works for FreeBSD 🙂

#freebsd #pgp #cryptography #opensource

FreshPorts -- security/openpgp-card-tools: CLI tool for interacting with OpenPGP cards

The openpgp-card-tools package provides a set of command-line utilities for interacting with OpenPGP cards. It supports common operations such as listing card information, managing PINs, generating keys, and performing cryptographic operations directly on the hardware. The primary tool, 'oct', serves as a versatile interface for administrative tasks and user-level card management, ensuring secure handling of private keys stored on OpenPGP-compliant smart cards and security tokens.

Codeberg.org

openpgp-card-tools

The oct CLI tool for inspecting, configuring and using OpenPGP card devices.

#pgp #cryptography #freebsd #opensource

0 Boosts

1 Like

AutumnOut Boy

@feld@friedcheese.us 51 min. ago

@Larvitz @hko oh wowww I didn't know this existed, I hate trying to remember what the heck I gotta do with gpg

AutumnOut Boy

@feld@friedcheese.us 46 min. ago

@Larvitz @hko for some reason it didn't work until I *restarted* pcscd. Very strange. But now it can see my yubikey

Larvitz :fedora:

@Larvitz@burningboard.net 44 min. ago

@feld @hko likely your pcscd was already locked by another client. (gpg maybe, if you have that installed. gpg tends to bind the hardware exclusively)

AutumnOut Boy

@feld@friedcheese.us 42 min. ago

@Larvitz @hko only odd thing I've noticed when playing with it is that it required I touch it 3 times to get the pubkey out

% oct pubkey --card 0006:17994593 --userid 0
Enter User PIN:
Touch confirmation needed for signing
Touch confirmation needed for signing
Touch confirmation needed for signing
OpenPGP card 0006:17994593

-----BEGIN PGP PUBLIC KEY BLOCK-----

but this isn't something I particularly care about as I don't do much PGP with it anymore, only SSH, and I was just curious

1+ more replies

Larvitz :fedora:

@Larvitz@burningboard.net 40 min. ago

@feld @hko That's indeed a bit odd. My test-key (a Nitrokey 3C) only requests touching once.

I use openphp-card-ssh-agent to utilize my key for SSH pubkey authentication via a lightweight rust-based SSH agent from the same stack. That one isn't in the ports yet (but the port is found on my Codeberg: https://codeberg.org/Larvitz/freebsd-openpgp-card-ports)

Codeberg.org

freebsd-openpgp-card-ports

AutumnOut Boy

@feld@friedcheese.us 38 min. ago

@Larvitz @hko oh I can use that instead of the gpg-agent?

Larvitz :fedora:

@Larvitz@burningboard.net 37 min. ago

@feld @hko That's exactly what it is for (and it works amazingly!) 😊 Inclusion in the freebsd ports tree is already being worked on 😊 https://bugs.freebsd.org/293962

293962 – [NEW PORT] security/openpgp-card-ssh-agent: SSH agent backed by OpenPGP cards