ECC Crypto for S/MIME key generation and usage should be implemented.
Original report:
Hello
I would like create a X.509 Key with ECDSA option to specify a max validity date.
But the option is anavailable (grey).
Why? (A software parameter is wrong?)
How to do ?
Thanks for your answer
Serg67
| rK libksba | |||
| rK71a2f1e87790 Finish creation of ECDSA and EdDSA certificates. | |||
| rG GnuPG | |||
| rG7c3aeb2a57ea gpgsm: Support signing using ECDSA. | |||
| rGed62b74a175e gpgsm: Create ECC certificates with AKI and SKI by default. | |||
| rG44676819f287 sm: Create ECC certificates with AKI and SKI by default. | |||
| rGf44d395bdfec sm: Support signing using ECDSA. | |||
| rG68b857df13c8 sm: Allow decryption using dhSinglePass-stdDH-sha1kdf-scheme. | |||
| rGee6d29f1797e sm: Support decryption of ECDH data using a smartcard. | |||
| rGd5051e31a8fc sm: Support encryption using ECDH keys. | |||
| rG95d83cf90617 sm: Support decryption of ECDH data. | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Resolved | • werner | T4098 GpgSM: Add ECC support | ||
| Resolved | • gniibe | T4888 GpgSM: Support ECC key generation by gpgsm_genkey | ||
| Resolved | • werner | T4092 Certificate requests generated from card-based ECDSA keys are incorrectly marked as RSA-signed | ||
| Open | • werner | T4896 ksba: Ed25519 support for CMS | ||
| Resolved | • werner | T4920 Support ECDH in Libksba | ||
| Resolved | • werner | T4921 Support import of PKCS#12 encoded ECC private keys. | ||
| Resolved | • werner | T4938 Support Signature Card V2.0 (NKS15) | ||
| Resolved | • ebo | T6253 GpgSM: Backport ECC support to 2.2 | ||
| Resolved | • werner | T6252 Support ECC for Netkey cards also in 2.2 |
There is currently no ECC key support in the S/MIME component of Gpg4win. I've edited the task a bit to reflect that. So it is impossible to generate an ECC Key for S/MIME with Kleopatra.
It should definitely be implemented but this is no small task :-/
There are two code paths to generate key: gpgsm_genkey and gpgsm_gencertreq_tty. Latter is partially supported with card key.
Firstly, I'm going to work for T4888.
I am working on the Telesec Signature Card v2. I will add encryption support to gpgsm.
Basic en- and decryption test against Governikus_Signer has now been done. Beware: I had to add a debug option to gpgsm to workaround non-compliance in algorithm support of Governikus; see the rG68b857df13c8a4e6cae5e3a29fd065bf90764547 for details.
Signing using ECDSA does now also work. Tested with 3 in disk keys: nistp256, nistp384 and RSA and verified using gpgsm and Governikus Signer.
GnuTLS seems to have some CMS support; see https://gitlab.com/gnutls/gnutls/-/issues/227 .