Ledger did an OpenPGP Card 3.0 implementation that looks interesting, though the token is pricey: https://github.com/LedgerHQ/blue-app-openpgp-card
Some gnuk tokens, such as the Nitrokey Start support Curve25519, also for SSH authentication (I use this). Of course, gnuk tokens have a different set of trade-offs:
- In contrast to Yubikeys, the firmware is open source and can be verified.
- It uses a curve that is considered safe [1]. Some security experts don't trust the NIST curves.
- In contrast to the Yubikey, it does not use tamper-resistant storage, but just a regular microcontroller. AFAIK it does store the keys encrypted though.
- There is no physical confirmation for key use, only PIN confirmation (with a maximum number of tries).
However, gnuk keys are very affordable. E.g. I purchased my Nitrokeys for 29 Euro each.
A completely different approach is to use your phone (and its secure element) as a crypto token. E.g. using Krypton [2]. Of course, this is only viable if you trust your phone manufacturer and operating system.
[1] https://safecurves.cr.yp.to
[2] https://krypt.co
(BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
Version 2.2.5.
The keyspace for PINs is tiny and trivially brute-forceable.
Good point!
For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked.
Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.
https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/READ...