<div dir="ltr">Well, it seems to work without issues on the nitrokeys I upgraded earlier via DFU, but it still bricks my only non-borked non-upgraded Nitrokey start:<br><br>Before upgrade (my only non-bricked nitrokey still in the original case):<br><br> $ gpg --card-status<br> Reader ...........: 20A0:4211:FSIJ-1.0.4-52FF6C06:0<br> Application ID ...: D276000124010200FFFE52FF6C060000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 52FF6C06<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: rsa2048 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: [none]<br><br><br> $ python2 usb_strings.py <br> Device: <br> Vendor: Nitrokey<br> Product: Nitrokey Start<br> Serial: FSIJ-1.0.4-52FF6C06<br> Revision: release/1.0.4-6-g739e00e<br> Config: NITROKEY_START:dfu=no:debug=no:pinpad=no:certdo=yes:keygen=yes<br> Sys: 1.0<br><br><br><br><br>Upgrade fails:<br><br>n python2 ./upgrade_by_passwd.py -f ../regnual/regnual.bin ../src/build/gnuk.bin<br>../regnual/regnual.bin: 4372<br>../src/build/gnuk.bin: 110592<br>CRC32: f3fafa79<br><br>Device: <br>Configuration: 1<br>Interface: 0<br>20001400:20004a00<br>Downloading flash upgrade program...<br>start 20001400<br>end 20002500<br>Run flash upgrade program...<br>Waiting for device to appear:<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>- Wait 1 seconds...<br>^CTraceback (most recent call last):<br> File "./upgrade_by_passwd.py", line 134, in <module><br> main(wait_e, keyno, passwd, data_regnual, data_upgrade[4096:])<br> File "./upgrade_by_passwd.py", line 75, in main<br> time.sleep(wait_e)<br>KeyboardInterrupt<br><br><br><br>Nitrokey blinks, green light.<br><br>The ealier-upgraded versions do work:<br><br>Before upgrade (Nitrokey start key upgraded via DFU):<br><br> $ gpg --card-status<br> Reader ...........: 20A0:4211:FSIJ-1.2.1-87042430:0<br> Application ID ...: D276000124010200FFFE870424300000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: rsa2048 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: [none]<br><br><br><br> $ python2 usb_strings.py <br> Device: <br> Vendor: <br> Product: Nitrokey<br> Serial: FSIJ-1.2.1-87042430<br> Revision: release/1.2.1-1-g2b784cb-modified<br> Config: NITROKEY_START:dfu=no:debug=no:pinpad=no:certdo=no<br> Sys: 3.0<br><br><br><br>Upgrade:<br><br><br><br> ../regnual/regnual.bin: 4372<br> ../src/build/gnuk.bin: 110592<br> CRC32: f3fafa79<br><br> Device: <br> Configuration: 1<br> Interface: 0<br> 20002800:20005000<br> Downloading flash upgrade program...<br> start 20002800<br> end 20003900<br> Run flash upgrade program...<br> Waiting for device to appear:<br> - Wait 1 seconds...<br> Device: <br> 08001000:08020000<br> Downloading the program<br> start 08001000<br> end 0801b000<br> Resetting device<br> Update procedure finished<br><br><br><br>After upgrade:<br><br> $ python2 usb_strings.py <br> Device: <br> Vendor: Nitrokey<br> Product: Nitrokey Start<br> Serial: FSIJ-1.2.2-87042430<br> Revision: release/1.0.2-471-g1a76ab5<br> Config: NITROKEY_START:dfu=no:debug=no:pinpad=no:certdo=no<br> Sys: 3.0<br><br><br> $ gpg --card-status<br> Reader ...........: 20A0:4211:FSIJ-1.2.2-87042430:0<br> Application ID ...: D276000124010200FFFE870424300000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: rsa2048 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: [none]<br><br><br><br><br>EC keys:<br><br> [10:09:28] [remy@gateway] [ ~/repo/nitrokey-upfix/tool (gnuk1.2-regnual-fix) ]<br> $ gpg-connect-agent "SCD SETATTR KEY-ATTR --force 1 22 ed25519" /bye<br> OK<br><br> [10:09:31] [remy@gateway] [ ~/repo/nitrokey-upfix/tool (gnuk1.2-regnual-fix) ]<br> $ gpg --card-status<br> Reader ...........: 20A0:4211:FSIJ-1.2.2-87042430:0<br> Application ID ...: D276000124010200FFFE870424300000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: ed25519 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: [none]<br><br><br> [10:09:33] [remy@gateway] [ ~/repo/nitrokey-upfix/tool (gnuk1.2-regnual-fix) ]<br> $ gpg-connect-agent "SCD SETATTR KEY-ATTR --force 3 22 ed25519" /bye<br> OK<br><br> [10:10:05] [remy@gateway] [ ~/repo/nitrokey-upfix/tool (gnuk1.2-regnual-fix) ]<br> $ gpg-connect-agent "SCD SETATTR KEY-ATTR --force 2 18 cv25519" /bye<br> OK<br><br><br> $ gpg --card-status<br> Reader ...........: 20A0:4211:FSIJ-1.2.2-87042430:0<br> Application ID ...: D276000124010200FFFE870424300000<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: ed25519 cv25519 ed25519<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: [none]<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: [none]<br><br><br> <br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><br><br><a href="https://raymii.org" target="_blank">https://raymii.org</a><br></div></div>
<br><div class="gmail_quote">On Fri, Dec 16, 2016 at 11:27 AM, Jan Suhr | Nitrokey <span dir="ltr"><<a href="mailto:jan@nitrokey.com" target="_blank">jan@nitrokey.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="font-size:10pt;font-family:Verdana,Geneva,sans-serif">
<p>Hi Remy,</p>
<p>we prepared a fix for regnual to enable updating a Nitrokey Start. It is here: <a href="https://github.com/Nitrokey/nitrokey-start-firmware/tree/gnuk1.2-regnual-fix" target="_blank">https://github.com/Nitrokey/<wbr>nitrokey-start-firmware/tree/<wbr>gnuk1.2-regnual-fix</a></p>
<p>Please let me know if it works for you.</p><span class="">
<p>Best regards,<br>Jan</p>
<p>Am 12.10.2016 19:50, schrieb Remy van Elst:</p>
</span><div><div class="h5"><blockquote type="cite" style="padding:0 0.4em;border-left:#1010ff 2px solid;margin:0">
<div dir="ltr">I tried to do the update with the provided scripts, but that failed with the same symptoms as before. The green LED keeps blinking, waiting a few minutes doesn't give any progress and after reinsertion the Nitrokey seems to not do anything. A DFU flash fixes that.<br><br>Before the upgrade<br><br> $ python2 usb_strings.py <br> Device: <br> Vendor: <br> Product: Nitrokey<br> Serial: FSIJ-1.2.1-87042430<br> Revision: release/1.2.1-1-g2b784cb-<wbr>modified<br> Config: NITROKEY_START:dfu=no:debug=<wbr>no:pinpad=no:certdo=no<br> Sys: 3.0<br><br><br>Running the update:<br><br> $ python2 upgrade_by_passwd.py -f ../regnual/regnual.bin ../src/build/gnuk.bin <br> ../regnual/regnual.bin: 4412<br> ../src/build/gnuk.bin: 110592<br> CRC32: 303d2f62<br><br> Device: <br> Configuration: 1<br> Interface: 0<br> 20002800:20005000<br> Downloading flash upgrade program...<br> start 20002800<br> end 20003900<br> Run flash upgrade program...<br> Wait 1 seconds...<br> Wait 1 seconds...<br> Wait 1 seconds...<br> [...] #repeats until cancelled<br><br> ^CTraceback (most recent call last):<br> File "upgrade_by_passwd.py", line 130, in <module><br> main(wait_e, keyno, passwd, data_regnual, data_upgrade[4096:])<br> File "upgrade_by_passwd.py", line 73, in main<br> time.sleep(wait_e)<br> KeyboardInterrupt<br><br><br><br><br>dmesg output during the update:<br><br> [ 2464.228628] usb 2-1.2: USB disconnect, device number 4<br> [ 2468.101333] usb 1-1.1: new full-speed USB device number 3 using ehci-pci<br> [ 2541.541385] usb 1-1.1: USB disconnect, device number 3<br> [ 2542.831257] usb 1-1.1: new full-speed USB device number 4 using ehci-pci<br> [ 2554.745022] usb 1-1.1: USB disconnect, device number 4<br> [ 2557.543186] usb 1-1.1: new full-speed USB device number 5 using ehci-pci<br><br><br><br><br></div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_-4775524976067433208gmail_signature"><br><br><a href="https://raymii.org" target="_blank">https://raymii.org</a></div>
</div>
<br>
<div class="gmail_quote">On Wed, Oct 12, 2016 at 1:38 PM, Jan Suhr <span><<a href="mailto:jan@nitrokey.com" target="_blank">jan@nitrokey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-size:10pt;font-family:Verdana,Geneva,sans-serif">
<p>Hi Remy,</p>
<p>I understand your Nitrokey Start is flashed with latest Gnuk 1.2 but I'm curious if regnual would work from now on or not. Did you try to update Gnuk 1.2 via regnual? (Perhaps "update" to the same Gnuk version just for the sake of testing it.)</p>
<p>Regards,<br>Jan</p>
<div>
<div class="m_-4775524976067433208h5">
<p><br></p>
<p>Am 11.10.2016 17:33, schrieb Remy van Elst:</p>
<blockquote style="padding:0 0.4em;border-left:#1010ff 2px solid;margin:0">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div>Small update, <br><br>I fried one Nitrokey when trying to solder on the ST Link headers. Bummer.<br><br></div>
I hot-air desoldered an USB header from an old motherboard in the e-waste bin and used the standard USB pinout, which suprisingly, worked. (<a href="https://i.imgur.com/PQ7QG2B.png" target="_blank">https://i.imgur.com/PQ7QG2B.p<wbr>ng</a>).<br><br></div>
The stm32flash tool was unable to remove the flash protection:<br><br> $ sudo stm32flash -u /dev/ttyUSB0 <br> stm32flash 0.5<br><br> <a href="http://stm32flash.sourceforge.net/" target="_blank">http://stm32flash.sourceforge.<wbr>net/</a><br><br> Interface serial_posix: 57600 8E1<br> Version : 0x22<br> Option 1 : 0x00<br> Option 2 : 0x00<br> Device ID : 0x0410 (STM32F10xxx Medium-density)<br> - RAM : 20KiB (512b reserved by bootloader)<br> - Flash : 128KiB (size first sector: 4x1024)<br> - Option RAM : 16b<br> - System RAM : 2KiB<br> Write-unprotecting flash<br> Got NACK from device on command 0x73<br> Done.<br><br></div>
so I had to use the Windows ST Demo loader tool. It worked, and I'm able to flash the gnuk 1.2 release to the Nitrokey start. (Not the fried one, another one). That seems to work so far:<br><br><br><br>$ gpg --card-status<br><br> Reader ...........: Nitrokey Nitrokey Start (FSIJ-1.2.1-87042430) 00 00<br> Application ID ...: D276000124010200FFFE8704243000<wbr>00<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: rsa2048 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 4<br> Signature key ....: 3D1B 8501 882B EA0D D813 6CAC 1437 62A5 87BD 54FE<br> created ....: 2016-10-11 15:06:29<br> Encryption key....: 9898 208B 7876 4F65 A06E 3E65 637A 80D6 31D5 21C2<br> created ....: 2016-10-11 15:06:29<br> Authentication key: 2141 3E30 8EFF F2D0 FB3D 4C9E DA3D F5B9 7130 1532<br> created ....: 2016-10-11 15:06:29<br> General key info..: pub rsa2048/0x143762A587BD54FE 2016-10-11 Remy test (Test gnuk1.2) <<a href="mailto:remy@test.nl" target="_blank">remy@test.nl</a>><br> sec> rsa2048/0x143762A587BD54FE created: 2016-10-11 expires: 2016-10-18<br> <wbr> card-no: FFFE 87042430<br> ssb> rsa2048/0xDA3DF5B971301532 created: 2016-10-11 expires: 2016-10-18<br> <wbr> card-no: FFFE 87042430<br> ssb> rsa2048/0x637A80D631D521C2 created: 2016-10-11 expires: 2016-10-18<br> <wbr> card-no: FFFE 87042430<br><br><br><br></div>
After flashing it with the Windows tool, stm32flash does work:<br><br><br><br> $ sudo stm32flash -w build/gnuk.bin -g 0x0 /dev/ttyUSB0 <br> stm32flash 0.5<br><br> <a href="http://stm32flash.sourceforge.net/" target="_blank">http://stm32flash.sourceforge.<wbr>net/</a><br><br> Using Parser : Raw BINARY<br> Interface serial_posix: 57600 8E1<br> Version : 0x22<br> Option 1 : 0x00<br> Option 2 : 0x00<br> Device ID : 0x0410 (STM32F10xxx Medium-density)<br> - RAM : 20KiB (512b reserved by bootloader)<br> - Flash : 128KiB (size first sector: 4x1024)<br> - Option RAM : 16b<br> - System RAM : 2KiB<br> Write to memory<br> Erasing memory<br> Wrote address 0x0801b000 (100.00%) Done.<br><br> Starting execution at address 0x08000000... done.<br><br></div>
I can also place an ecc 25519 key on the device:<br><br> $ gpg --card-status<br><br> Reader ...........: Nitrokey Nitrokey Start (FSIJ-1.2.1-87042430) 00 00<br> Application ID ...: D276000124010200FFFE8704243000<wbr>00<br> Version ..........: 2.0<br> Manufacturer .....: unmanaged S/N range<br> Serial number ....: 87042430<br> Name of cardholder: [not set]<br> Language prefs ...: [not set]<br> Sex ..............: unspecified<br> URL of public key : [not set]<br> Login data .......: [not set]<br> Signature PIN ....: forced<br> Key attributes ...: ed25519 rsa2048 rsa2048<br> Max. PIN lengths .: 127 127 127<br> PIN retry counter : 3 3 3<br> Signature counter : 0<br> Signature key ....: 3678 F2EE 1CCB 4B24 B107 38BA 101D 491F 08E7 FD60<br> created ....: 2016-10-11 15:31:27<br> Encryption key....: [none]<br> Authentication key: [none]<br> General key info..: pub ed25519/0x101D491F08E7FD60 2016-10-11 test remy ecc (gnuk 1.2) <<a href="mailto:nitrokey@raymii.nl" target="_blank">nitrokey@raymii.nl</a>><br> sec> ed25519/0x101D491F08E7FD60 created: 2016-10-11 expires: 2016-10-18<br> <wbr> card-no: FFFE 87042430<br><br><br></div>
Yay!<br>
<div>
<div> </div>
</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="m_-4775524976067433208m_1973079774880891057gmail_signature"><br><br><a href="https://raymii.org" target="_blank">https://raymii.org</a></div>
</div>
<br>
<div class="gmail_quote">On Fri, Sep 16, 2016 at 3:26 PM, NIIBE Yutaka <span><<a href="mailto:gniibe@fsij.org" target="_blank">gniibe@fsij.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, Jan,<br> <span><br> On 09/16/2016 05:38 PM, Jan Suhr wrote:<br> > Nitrokey Start hardware is based on FST-01. In particular the MCU is<br> > identical. The main differences are:<br> > - No external flash<br> > - Different pinning. See:<br> > <a href="https://github.com/Nitrokey/nitrokey-start-firmware/commit/c98d6cbc4a225f10bca8f2d7b86effcbdcf534f4" target="_blank">https://github.com/Nitrokey/ni<wbr>trokey-start-firmware/commit/c<wbr>98d6cbc4a225f10bca8f2d7b86effc<wbr>bdcf534f4</a><br> ><br> > Do you think the different pinning may be a cause for the update issue?<br> <br> </span>Thanks for the pointer.<br> <br> The file is a bit different to the one in Chopstx (Gnuk 1.2).<br> <br> <a href="https://git.gniibe.org/gitweb/?p=chopstx/chopstx.git;a=commitdiff;h=8650bde8a056ca8d7954837bfd6692958e263634;hp=6e7334dcfff83898ff6b8568bf24c6fe90deaa9c" target="_blank">https://git.gniibe.org/gitweb/<wbr>?p=chopstx/chopstx.git;a=commi<wbr>tdiff;h=8650bde8a056ca8d795483<wbr>7bfd6692958e263634;hp=6e7334dc<wbr>fff83898ff6b8568bf24c6fe90deaa<wbr>9c</a><br> <br> I had thought that it's because of revision change of hardware. If it<br> is same hardware, I think that Gnuk 1.0 on Nitrokey Start doesn't work<br> well with upgrade through USB.<br> <br> One of my friends kindly showed me the board of Nitrokey Start.<br> I also examined the KiCAD schematic of:<br> <br> <a href="https://github.com/Nitrokey/nitrokey-pro-hardware" target="_blank">https://github.com/Nitrokey/ni<wbr>trokey-pro-hardware</a><br> <br> Well, examining schematic is not that easy, even for such a simple<br> one.<br> <br> PA9 and PA10 is connected to USB-D- and USB-D+. And with the<br> configuration of Gnuk 1.0 for Nitrokey Start, those pins of PA9 and<br> PA10 is pulled up by Vdd. I think that this interferes the USB<br> shutdown and re-enumeration process of USB upgrade.<br> <br> I think that the configuration of Gnuk 1.2 for Nitrokey Start is<br> better.<br> <span class="m_-4775524976067433208m_1973079774880891057HOEnZb"><span style="color:#888888">--<br> </span></span>
<div class="m_-4775524976067433208m_1973079774880891057HOEnZb">
<div class="m_-4775524976067433208m_1973079774880891057h5"><br> ______________________________<wbr>_________________<br> gnuk-users mailing list<br> <a href="mailto:gnuk-users@lists.alioth.debian.org" target="_blank">gnuk-users@lists.alioth.debian<wbr>.org</a><br> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" target="_blank">https://lists.alioth.debian.or<wbr>g/mailman/listinfo/gnuk-users</a></div>
</div>
</blockquote>
</div>
</div>
<br>
<div class="m_-4775524976067433208m_1973079774880891057pre" style="margin:0;padding:0;font-family:monospace">______________________________<wbr>_________________<br> gnuk-users mailing list<br> <a href="mailto:gnuk-users@lists.alioth.debian.org" target="_blank">gnuk-users@lists.alioth.debian<wbr>.org</a><br> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" target="_blank">https://lists.alioth.debian.or<wbr>g/mailman/listinfo/gnuk-users</a></div>
</blockquote>
</div>
</div>
</div>
<br>______________________________<wbr>_________________<br> gnuk-users mailing list<br> <a href="mailto:gnuk-users@lists.alioth.debian.org" target="_blank">gnuk-users@lists.alioth.debian<wbr>.org</a><br> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" target="_blank">https://lists.alioth.debian.or<wbr>g/mailman/listinfo/gnuk-users</a><br> </blockquote>
</div>
</div>
<br>
<div class="m_-4775524976067433208pre" style="margin:0;padding:0;font-family:monospace">______________________________<wbr>_________________<br> gnuk-users mailing list<br> <a href="mailto:gnuk-users@lists.alioth.debian.org" target="_blank">gnuk-users@lists.alioth.<wbr>debian.org</a><br> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" target="_blank">https://lists.alioth.debian.<wbr>org/mailman/listinfo/gnuk-<wbr>users</a></div>
</blockquote>
</div></div></div>
</blockquote></div><br></div>