sub rosa¶

Compatible Nitrokeys
✓ active	⨯ inactive	⨯ inactive	✓ active	⨯ inactive	✓ active	✓ active	⨯ inactive

Compatible Nitrokeys

sub rosa is an Android application that allows you to program a static password onto a hardware security key, which can act as a keyboard when touched. Plug it into your phone, tablet, or laptop, touch it, and it automatically types out a sequence of characters.

Simple: no need to memorize multiple complex passwords. No need to carry multiple devices either — you can program a Nitrokey with a password, use it, and then program it with a different password whenever needed.

sub rosa can program an OpenPGP key onto your Nitrokey, allowing you to encrypt, decrypt, cryptographically sign documents, or authenticate to remote servers via SSH. An OpenPGP key acts as your digital identity.

Just like KeePassDroid managing passwords, OpenKeychain or PGPony manage OpenPGP keys. You can easily import OpenPGP keys generated or stored by these apps in sub rosa and then program them onto your Nitrokey.

Note

For further information or issue/feature proposal, please refer to the source repository here.

Installation¶

sub rosa is available on F-Droid here if you have the IzzyOnDroid repository.
On the Google Play Store here.
In the source repository here.

Features¶

Fonction	Action	Nitrokey 3 USB	Nitrokey 3 NFC	Nitrokey Pro USB	Nitrokey Storage
Static password	Write	❌	❌	❌	❌
Static password	Read	❌	❌	❌	❌
Static password	Wipe	❌	❌	❌	❌
OpenPGP	Write	✅	❌	✅	✅
OpenPGP	Read	✅	❌	✅	✅
OpenPGP	Wipe	✅	❌	✅	✅
OpenPGP	Change User PIN	✅	❌	✅	✅
OpenPGP	Reset User PIN	✅	❌	✅	✅
OpenPGP	Change Admin PIN	✅	❌	✅	✅

OpenKeychain supported algorithm	Nitrokey 3 USB	Nitrokey 3 NFC	Nitrokey Pro	Nitrokey Storage
RSA 2048	✅	✅	✅	✅
RSA 3072	✅	✅	✅	✅
RSA 4096	✅	✅	✅	✅
ECC NIST P-256	✅	✅	✅	✅
ECC NIST P-521	✅	✅	✅	✅
Ed25519/X25519	✅	✅	❌	❌

Note

Other algorithms have not been tested.

Import OpenPGP Keys From OpenKeychain¶

sub rosa works closely with OpenKeychain. OpenKeychain manages OpenPGP keys, handling generation, secure storage, and backups.

Importing keys from OpenKeychain is a breeze. Share a key backup with sub rosa and enter the backup code provided by OpenKeychain. Because this backup code—consisting of 36 numbers and dashes—cannot be copied directly to the clipboard from OpenKeychain, sub rosa includes Tesseract (an Optical Character Recognition library) to make the process effortless:

Take a screenshot of the OpenKeychain app displaying the backup code and share that screenshot with sub rosa.
Select the region containing the backup code and tap EXTRACT PASSWORD.
The backup code will be copied to your clipboard. Return to OpenKeychain and tap SHARE BACKUP.
Paste the backup code into sub rosa and get ready to write your private OpenPGP key to your security key.

Use Your Nitrokey for SSH Authentication¶

Generate a new OpenPGP key with OpenKeychain.
Select Change key configuration and add an Authentication subkey.
Import this OpenPGP key into sub rosa and write it to your security key.

On a clean Debian machine, ensure all required packages are installed:

sudo apt update
sudo apt install openssh-client gnupg scdaemon pinentry-curses pcscd

Identify where pinentry is installed:
```
which pinentry
```
The output should look similar to:
```
/usr/bin/pinentry
```

Take note of that path, then configure gpg-agent to enable SSH support and use that pinentry binary:

echo "enable-ssh-support" > ~/.gnupg/gpg-agent.conf
echo "pinentry-program /usr/bin/pinentry" >> ~/.gnupg/gpg-agent.conf

Restart the agent to apply the configuration:

gpgconf --kill gpg-agent
gpgconf --launch gpg-agent
gpgconf --list-dirs agent-ssh-socket

This should output a path like:

/run/user/1000/gnupg/S.gpg-agent.ssh

Note this path and add it to your ~/.ssh/config:
```
echo "Host *" > ~/.ssh/config
echo "  IdentityAgent /run/user/1000/gnupg/S.gpg-agent.ssh" >> ~/.ssh/config
```
Note

Be sure to replace /run/user/1000/gnupg/S.gpg-agent.ssh with the actual path output on your system.

Now query the security key:

gpg-connect-agent "scd learn --force" /bye

This displays details of the OpenPGP key written to your security key. The output will look similar to:

S KEYPAIRINFO 5BBF795A5F93498C2FF6C6CD3ABF896302DC9FA0 OPENPGP.1 sc 1782525925 ed25519
S KEYPAIRINFO D1B359A6A77A68B1776ABFA085E65AFA1582E6D6 OPENPGP.2 e 1782525925 cv25519
S KEYPAIRINFO 36F40BE75662CEA929402AAA360A64F448E35ABB OPENPGP.3 a 1782525925 ed25519
OK

To configure SSH to use the authentication key, add its keygrip to ~/.gnupg/sshcontrol:
```
echo "36F40BE75662CEA929402AAA360A64F448E35ABB" >> ~/.gnupg/sshcontrol
gpgconf --kill gpg-agent
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
ssh-add -L
```
Note

Replace 36F40BE75662CEA929402AAA360A64F448E35ABB with the keygrip of your specific Authentication subkey (the line ending in a).

The ssh-add -L command should display your public key card identifier, for example:
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGfZlzyF4mwdtAnUNJVz1TxOkotdHNizIaA56IOepfA/ cardno:000F_D52FD320
```
Copy this line and add it to ~/.ssh/authorized_keys on your remote server.

When logging into your remote server via SSH, you will be prompted for a PIN. This is the User PIN (default: 123456), not the Admin PIN (default: 12345678).