Skip to content

522 encryption algorithm support is vague or has typos #533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daringer merged 2 commits into from
Jan 12, 2026
Merged

522 encryption algorithm support is vague or has typos #533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fe4dd5
table fix
alexgithublab Nov 24, 2025
2981f2e
algorithms choice more clear with a list cmd
alexgithublab Jan 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions source/components/nitrokeys/features/openpgp-card/certificate-authority.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,20 +10,27 @@ This article shows you how to setup your own private certificate authority backe
Choose Cryptographic Algorithms
-------------------------------

I’m going to assume that you’re as paranoid as I am, so I will be using the following command for generating private keys:
Prior generating your private key you can use this command in order to list all compatible algorithms:

.. code-block:: bash

pkcs11-tool -l --keypairgen --key-type EC:secp384r1 --label root
pkcs11-tool -M

When you will need to generate your private key, you can use this command:

.. code-block:: bash

pkcs11-tool -l --keypairgen --key-type <algorithm> --label root

But, if you’re less paranoid that I am, you can safely choose the following options:
Some examples here:

.. code-block:: bash

pkcs11-tool -l --keypairgen --key-type EC:secp384r1 --label root
pkcs11-tool -l --keypairgen --key-type EC:secp256r1 --label root
pkcs11-tool -l --keypairgen --key-type rsa:4096 --label root

Likewise, I will be using the sha512 algorithm throughout this article, but sha256 can safely be used.
`NIST P-384` and `sha512` algorithms will be used throughout this article, but `NIST P-256` or `RSA-4096` and `sha256` can safely be used.

Preparing to Start
------------------
Expand Down
2 changes: 1 addition & 1 deletion source/components/nitrokeys/features/openpgp-card/openpgp-keygen-on-device.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ The following table illustrates which algorithm can be used on which device.
:widths: auto

================ ===== ============= =================
Start Pro + Storage Pro 2 + Storage 2
Algorithm Start Pro + Storage Pro 2 + Storage 2
================ ===== ============= =================
rsa1024 ✓ ✓
rsa2048 ✓ ✓ ✓
Expand Down