Technical Inquiry: ECC Import Support (Ed25519/Brainpool)

[user1999455]

Hello everyone,

I am using the flexSecure Java Card Implant and I am trying to set up a GPG key structure that allows for external key import (to maintain a cold-storage backup).

I have successfully configured the card with RSA-4096. I was able to change the key attributes and successfully import an externally generated RSA-4096 key to the card. This confirms that the installed SmartPGP applet is likely the “Large” version with sufficient buffer size.

However, my goal is to use ECC (preferably Ed25519), but I am facing the following issues:

Ed25519 (Curve 25519):

When attempting to change the key attributes (key-attr) to Ed25519 (Curve 25519) in GnuPG, the card does not accept the attribute change at all. It seems this curve might be disabled in the pre-installed applet build.

Brainpool P-256:

I can successfully set the key attributes to brainpoolP256r1.

On-card generation works perfectly.

Importing an externally generated Brainpool key fails with the error: gpg: key operation not possible: Invalid value.

My Question:

Does the specific SmartPGP build pre-installed on the flexSecure support the import of ECC keys (specifically Ed25519 or Brainpool)? Since I rely on having a physical backup of my keys, on-card generation is not an option for me.

Is there a specific configuration or workaround to enable Ed25519 support or fix the Brainpool import issue?

Thank you for your assistance.

Best regards

[ashsh]

If I’m not mistaken, the P71 chip in the flexSecure doesn’t support Ed25519.

I believe Brainpool is supported, but if you are importing keys you will likely need to use the smartpgp-cli tool here first: GitHub - github-af/SmartPGP: SmartPGP is a JavaCard implementation of the OpenPGP card specifications

e.g., smartpgp-cli switch-bp256/switch-bp384/switch-bp512 -p [adminpin]

[GrimEcho]

@ashsh is correct, the P71 chip in the Apex and flexSecure implants uses Java Card 3.0.5, which predates support for ED25519 (and other named curves). Brainpool should be supported for key lengths up to 640 bits (more than enough for brainpoolP256r1). I’ve never tried generating or importing any Brainpool keys though.

Here are some other posts that discuss it in more detail:

Apex ED25519 support

Hi! Can the Apex Flex calculate ED25519? It would be good for a project, but I couldn’t find it anywhere.

Apex Flex Vivokey SmartPGP Issues?

Then, the curve your ECC key uses (ed25519) is not supported by the applet. Only NIST-P and Brainpool curves are. That seems like…a massive issue? Guidance for Choosing an Elliptic Curve Signature Algorithm in 2022 - Dhole Moments TL;DR Ed25519 is great. NIST P-256 and P-384 are okay (with caveats). Anything else is questionable, and their parameter selection should come with a clear justification.

Here is the public security policy that NXP submitted to NIST for the P71D600 (a newer variant of the P71 that runs JCOP 4.5 instead of JCOP 4)

140sp4679.pdf

It covers all of the algorithms supported, and it explicitly mentions support for brainpoolP256r1 key generation. The section on ECKey Session (page 29/30), explicitly mentions the ability to import P-256 public keys, and the table on page 56/57 says “Entered during manufacturing/personalization or imported in secure challen specified by GP-AMD-I” in regards to APP-ECC-RT-PRIV_KA. Those capabilities are based on the SEMS Lite applet developed by NXP, though.

I also found the Security Target documentation for the P71 JCOP 4, and while it does generally seem to support importing keys, I didn’t see anything explicit about P-256/braintrust256

NSCIB-CC-180212_3-STLite.pdf