Second OpenPGP-card

Hardware Accessories
1

I do use an OpenPGP-card, bought from Purism in one of my L5 and I want to buy a second one for my other L5. I use two L5, one in Europe, the other in Cuba with a cuban SIM card. I could buy the 2nd card in Purism to, but would have to pay $65 shipping fee for the $15 card. So, can I buy this card here in Europe or even in Germany?

Next question: Can I transfer somehow the key from one card to the other to use the same encrypted files foo.gpg from my password store:

purism@pureos:~$ find .password-store/ -type f | wc -l
373
2

Yes, at the FLOSS-Shop, although currently the connection to it seems to be timing out.

No, once you put the subkeys in, you cannot take them out, as the OpenPGP card is designed to be tamper-proof.

3

However if you generate the key externally, you can copy it on multiple devices and then each device can move it to the card.

Another approach, which may be more prudent, is to use multiple keys. Pass does support multiple keys after all..

4

Right, I am only working with the information provided in this thread and answering the questions as is.

5

My password store was years ago initialized with something like:

pass init gpg-key-matthias

When I now have setup my second card as gpg-key-emil, then I must run on the existing(!) password store again

pass init gpg-key-emil

which will re-encrypt all files as well with the new key, and afterwards I can copy them over to the second L5 and use them there with the second key.

Do I read this correctly? Will do a backup in any case before run the 2nd init.

6

I’ll admit I have never used the multiple key approach (yet), so I can’t say for sure but definitely making a backup is the prudent approach.

The manpage says this (password-store - Simple password manager using gpg and ordinary unix directories.)

Initialize new password storage and use gpg-id for encryption. Multiple gpg-ids may be specified, in order to encrypt each password with multiple ids. This command must be run first before a password store can be used. If the specified gpg-id is different from the key used in any existing files, these files will be reencrypted to use the new id.
Note that use of gpg-agent(1) is recommended so that the batch decryption does not require as much user intervention. If –path or -p is specified, along with an argument, a specific gpg-id or set of gpg-ids is assigned for that specific sub folder of the password store. If only one gpg-id is given, and it is an empty string, then the current .gpg-id file for the specified sub-folder (or root if unspecified) is removed.

So I think you need to run pass init specifying multiple keys, at once.

7

The FLOSS-Shop is accessible again, so now you can order a second OpenPGP card.

8

No, you can’t order a Micro OpenPGP card there. You must cut it yourself to this form with the risk of damaging it.

9

Okay, you can message the FLOSS Shop if you are able to request a special order.

FLOSS Shop EN

10

I talked to them by mail some time ago: No, they can’t do the cut due to the lack of a specialized cutter. I ordered the 2nd one in the store of Purism together with an USB-C (…) hub. $69 for the hardware and $69 for UPS :frowning:

11

Okay, you may be able to use a workaround and order the Nitrokey Pro 2, as it uses the same OpenPGP card by ZeitControl.

12

This seens to be an external USB-A key. I want to have the card inside my L5.

13

You can disassemble it just like the Librem Key and extract the OpenPGP card. (0:28)

14

Very late to the party, but I’d like to share my experience cutting the OpenPGP card without the help of a SIM card puncher in case it helps anyone.

I didn’t want to pay Purism’s world shipping rates for a cheap card, so I ordered a couple of OpenPGP cards from FLOSS-Shop. I didn’t want to pay for a SIM card cutter either, so I ended up using the milling spindle from our tiny workshop to cut it down to the Micro-SIM (3FF) form factor that the L5’s built-in smart card reader needs.

The resulting 3FF card works fine! Here’s how I did it:

  1. Order an OpenPGP card in the variant that is pre-punched for the ID-000 form factor (i.e. 2FF aka Mini-SIM).

  2. Break out the 2FF card.

  3. Download and print a MiniSIM (2FF) to MicroSIM (3FF) template at 100 % scale.

  4. Cut out the 2FF contour from the printout. You get a 2FF-shaped piece of paper with 3FF contours printed on it.

  5. Verify that the piece of paper has exactly the same size as your 2FF card. If not, fix your printer settings so it prints the PDF at exactly 100 % scale.

  6. Tape the 2FF-shaped piece of paper to the card using double-sided tape.

    • If you have a milling spindle, clamp and mill the card alongside the 3FF edges. (That’s how I did it, except for the 45-degree notch, for which I used the craft knife.)
    • Otherwise, use a craft knife and a cutting mat. The plastic of the OpenPGP card is pretty sturdy, so you may have to cut the same edge several times to create a breaking point, then break off the excess manually.

  8. Remove the paper and the double-sided tape from the card. You might notice that the array of contacts looks slightly off-center (as Micro-SIM cards do) when compared to the one from Purism’s shop; don’t worry about that, it doesn’t matter.

  9. Insert the card into the Librem 5 and confirm that it works.