1

are there smartcards that handle 4096-bit keys supported both by GPG and Enigmail (PAM would be additional benefit)? Preferably on USB.

3 Answers 3

1

I'm quoting somebody else here:

Actually the OpenPGP Card / Crypto Stick can handle 4k keys as well but GnuPG is not able to handle 4k keys of smart cards. To use 4k keys either GnuPG needs to be patched

4096 support in smart cards is relatively rare, the common size is currently 2048 for RSA (cards do have EC support though). The CryptoStick claims to support 3k RSA keys but apparently only because that's the limit for GnuPG, the card should be able to do more.

3
  • Any information where can I find a patch? Dec 21, 2010 at 21:31
  • None that I know of. Are you sure you need 4k keys?
    – martin
    Dec 22, 2010 at 8:19
  • Hi there. I've patched this, see the last thread of goo.gl/gtuoG :-) Apr 5, 2011 at 9:45
1

Not sure if you can get cryptocards that support 4096-bit keys, but as long as they're a PKCS11 smartcard, you'll find they'll work with most things. I formatted an unused Aladdin eToken as a standard PKCS11 token, and had it working with OpenSSH and Firefox. Getting it working with GPG, Enigmail and PAM would be trivial, I suspect.

Have a look at some of the stuff that uses OpenSC - that tends to support many different kinds of tokens and cryptocards.

0

The information in the previous answers is over seven years old now; the OpenPGP smart card has supported 4096-bit RSA keys for several years now, and also now supports ECC.

2
  • Yubikey Series 5 does support 4096 RSA as well (yubico.com/products/yubikey-5-overview)
    – aitorpazos
    Oct 26, 2018 at 23:52
  • What is the corresponding command to create a 4096 bit RSA key on an OpenPGP card? gpg(2) --card-edit; admin; generate --algo=???? I tried different values but everything results in 2048 bit key. Using Kleopatra I was able to generate 3072 bit keys on the card. I am using OpenPGP Cards V3.3, gpg (GnuPG) 2.2.27 and a ReinerSCT comfort card reader with latest driver from Ubuntu repository. Copy 4096 bit to the card is possible. I remember that several years ago there has been an issue to to some card readers limiting the key length when creating keys directly on the card.
    – LeifSec
    Jul 12, 2023 at 8:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .