How to use the command 'gpg-card' (with examples)

The ‘gpg-card’ command is used to administrate OpenPGP and PIV smart cards. It is similar to the ‘gpg –card-edit’ command and provides various functionalities to manage smart cards. More information about the command can be found at https://manned.org/gpg-card .

Use case 1: Start in interactive mode

Code:

gpg-card

Motivation: Starting the ‘gpg-card’ command without any arguments will launch it in interactive mode. This allows the user to execute various commands and interact with the smart card directly.

Explanation: The command ‘gpg-card’ without any arguments will start the interactive mode, where the user can enter other commands and perform operations on the smart card.

Example output:

Welcome to the interactive mode of gpg-card.
gpg-card>

Use case 2: Invoke one or more commands non-interactively

Code:

gpg-card command1 -- command2 -- command3

Motivation: If you need to automate certain tasks or run multiple commands without the need for user interaction, you can use the ‘gpg-card’ command non-interactively.

Explanation: By providing multiple commands separated by ‘–’, you can instruct the ‘gpg-card’ command to execute those commands in order. This is useful when you have a set of predefined operations that you want to perform without having to manually enter each command.

Example output:

Command1 executed successfully.
Command2 executed successfully.
Command3 executed successfully.

Use case 3: Show information about a smart card

Code:

gpg-card list

Motivation: When you need to gather information about the smart card, such as its firmware version, serial number, or card holder name, you can use the ‘gpg-card list’ command.

Explanation: The ’list’ command is used to display information about the smart card currently being managed by the ‘gpg-card’ command. It provides details such as the card’s application ID, version, and serial number.

Example output:

Card Information:
- Application ID: ABCDEF0123456789
- Version: 1.2.3
- Serial Number: 1234567890

Use case 4: Retrieve the public key using the URL stored on an OpenPGP card

Code:

gpg-card fetch

Motivation: The ‘fetch’ command is used to retrieve the public key associated with the URL stored on an OpenPGP card. This is useful when you want to obtain the public key of a specific user directly from their smart card.

Explanation: When executed, the ‘fetch’ command reads the URL stored on the OpenPGP card and retrieves the corresponding public key from that URL. This allows you to easily obtain the public key without the need to perform additional steps.

Example output:

Public key successfully fetched from the stored URL.

Use case 5: Set the URL used by the ‘fetch’ command

Code:

gpg-card url

Motivation: If you want to change the URL used by the ‘fetch’ command to retrieve the public key, you can use the ‘url’ command. This allows you to customize the source from which the public key is fetched.

Explanation: The ‘url’ command is used to set the URL for the ‘fetch’ command. By providing a new URL, you can modify the source from which the ‘fetch’ command retrieves the public key.

Example output:

URL updated successfully.

Use case 6: Change or unblock PINs

Code:

gpg-card passwd

Motivation: The ‘passwd’ command allows you to change or unblock the Personal Identification Numbers (PINs) associated with the smart card. This is useful when you need to update the PINs or unblock them after multiple unsuccessful attempts.

Explanation: When executed, the ‘passwd’ command prompts the user to enter the current PINs and then allows them to change or unblock the PINs depending on the card’s default action defined in non-interactive mode.

Example output:

Please enter the current PINs:
PIN1: ******
PIN2: ******
New PIN1: ******
New PIN2: ******
PINs successfully changed.

Use case 7: Toggle the forcesig flag of an OpenPGP card

Code:

gpg-card forcesig

Motivation: The ‘forcesig’ command is used to toggle the forcesig flag of an OpenPGP card. When the forcesig flag is enabled, the user is required to enter the user PIN each time for signing operations. This provides an extra layer of security.

Explanation: When executed, the ‘forcesig’ command toggles the forcesig flag of an OpenPGP card. If the flag is currently enabled, it will be disabled, and vice versa.

Example output:

Forcesig flag toggled successfully.

Use case 8: Factory reset a smart card

Code:

gpg-card factory-reset

Motivation: The ‘factory-reset’ command is used to perform a factory reset on a smart card. This operation will delete all data and reset the PINs to their default values. It is useful when you want to start fresh with a new smart card or reset the card to its initial state.

Explanation: When executed, the ‘factory-reset’ command initiates a factory reset on the smart card, deleting all data stored on it and resetting the PINs to their default values.

Example output:

Smart card reset to factory settings successfully.

Conclusion:

The ‘gpg-card’ command provides a range of functionalities to administrate OpenPGP and PIV smart cards. It allows users to interactively manage their smart cards or execute multiple commands non-interactively. The command enables tasks such as retrieving public keys, changing PINs, toggling security flags, and performing a factory reset on smart cards. With these capabilities, users can effectively manage and secure their smart card-based cryptographic operations.