Openpgpjs: Support for keys stored on smartcards

Created on 20 Oct 2015 · 8Comments · Source: openpgpjs/openpgpjs

I have my private OpenPGP key on a YubiKey NEO and it would be nice to use it with OpenPGP.js.

Thinking about how to implement this: Chrome has a USB API available from JavaScript, which is flexible enough to allow FIDO U2F to be implemented in JavaScript. I would assume it is possible to implement support for CCID as well, and then on top off that, the OpenPGP Card Applet protocol in order to talk to the device.

Alternatively, call out to some host daemon to perform the private key operations for the browser.

Feature

Source

jas4711

👍8

Most helpful comment

Is there a timeline on this, or at least an open issue in another repo? Thanks!

pbudzon on 19 Nov 2016

👍6

All 8 comments

reuterbal on 22 Jan 2016

Chrome has a USB API available from JavaScript, which is flexible enough to allow FIDO U2F to be implemented in JavaScript.

We're in the process of moving optional functionality to external modules and keeping the core crypto lib nice and lean. I'd recommend a seperate openpgp-smartcard-storage npm module for this feature.

tanx on 20 Mar 2016

Is there a timeline on this, or at least an open issue in another repo? Thanks!

pbudzon on 19 Nov 2016

👍6

Yea hm, closing this issue is fine if there is some other issue tracking the feature...but where would that be?

shuffle2 on 3 Feb 2017

👍3

Hi, I'm curryently trying to create a NativeMessagingHost application that uses the gpgme library for this kind of actions.
I would like to provide such an external modules, do you offer any mechanisms to create a drop-in that would overwrite central functionality of openpgp.js?

phryneas on 25 Apr 2017

WebCrypto could allow access to (PKCS11) hardware/software tokens for keystorage, but it is not fully specified, so I dont know if there are implementations. In any case that would not be a pure "key storage" module, as it also offloads the sign/verify/encrpt operations with that key. Anyway, if there is an implementation which can use a agent-side keystore (PKCS11/NSS) it just needs some additional slot management.

ecki on 23 Jun 2017

👍1

I was thinking of making an app using the Native messaging host too, @phryneas did you end up doing that ? Is this something you released somewhere by any chance ?