# fetch rules
$ curl -OL https://raw.githubusercontent.com/Nitrokey/nitrokey-udev-rules/main/41-nitrokey.rules

# move rules to udev rules
> mv 41-nitrokey.rules /etc/udev/rules.d/

# change permissions
> chown root:root /etc/udev/rules.d/41-nitrokey.rules
> chmod 644 /etc/udev/rules.d/41-nitrokey.rules

# reload rules and trigger event manually
> udevadm control --reload-rules \
  && udevadm trigger

# install python pipx
> pacman -S python-pipx

# install nitropy
$ pipx ensurepath \
  && pipx install pynitrokey
# will be stored in "$HOME/.local/bin/nitropy"

# example command are:
$ nitropy nk3 'list|update|factory-reset'

# update device
$ nitropy nk3 factory-reset

# reset after update
$ nitropy nk3 factory-reset

# disables the built-in CCID driver of GnuPG's scdaemon
disable-ccid

# cache passphrase for 300 seconds
default-cache-ttl 300
# maximum time how long the passphrase can be cached at all
max-cache-ttl 7200

# check card status
$ gpg2 -vvv --card-status
  ...
  gpg: enabled compatibility flags:
  gpg: selecting card failed: No such device
  gpg: OpenPGP card not available: No such device

# kill agent if the cmd prints error
$ pkill gpg-agent

# try it again
$ gpg2 -vvv --card-status
  ...
  Reader ...........: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00
  Application ID ...: XXXXXXXXXXXXXXXXXXXXXXXX
  Application type .: OpenPGP
  Version ..........: 3.4
  Manufacturer .....: Nitrokey

# set/change fido pin
$ nitropy fido2 set-pin
$ nitropy fido2 change-pin

# set/change secrets pin
$ nitropy nk3 secrets set-pin
$ nitropy nk3 secrets change-pin

# set openpgp card user pin (default is: 123456)
$ gpg --card-edit
  passwd

# set openpgp card admin pin (default is: 12345678)
$ gpg --card-edit
  admin
  passwd
  3

# change piv (default is: 123456), requires pkg: 'pivy'
$ pivy-tool change-pin

# change puk (default is: 123456), requires pkg: 'pivy'
$ pivy-tool change-puk

# check current algorithm
$ gpg --card-status | grep Key\ attributes
  ...
  Key attributes ...: rsa2048 rsa2048 rsa2048

# open card
$ gpg2 --card-edit
  gpg/card> admin
  ...
  Admin commands are allowed

  # change attributes
  gpg/card> key-attr
  Changing card key attribute for: Signature key
  Please select what kind of key you want:
     (1) RSA
     (2) ECC
  Your selection? 2
  Please select which elliptic curve you want:
     (1) Curve 25519 *default*
     (4) NIST P-384
     (6) Brainpool P-256
  Your selection? 1
  The card will now be re-configured to generate a key of type: ed25519
  Note: There is no guarantee that the card supports the requested
        key type or size.  If the key generation does not succeed,
        please check the documentation of your card to see which
        key types and sizes are supported.
  Changing card key attribute for: Encryption key
  Please select what kind of key you want:
     (1) RSA
     (2) ECC
  Your selection? 2
  Please select which elliptic curve you want:
     (1) Curve 25519 *default*
     (4) NIST P-384
     (6) Brainpool P-256
  Your selection? 1
  The card will now be re-configured to generate a key of type: cv25519
  Changing card key attribute for: Authentication key
  Please select what kind of key you want:
     (1) RSA
     (2) ECC
  Your selection? 2
  Please select which elliptic curve you want:
     (1) Curve 25519 *default*
     (4) NIST P-384
     (6) Brainpool P-256
  Your selection? 1
  The card will now be re-configured to generate a key of type: ed25519

# leave card and check status again
> gpg --card-status | grep Key\ attributes
  ...
  Key attributes ...: ed25519 cv25519 ed25519

# open card editor
> gpg2 --card-edit

  # change to admin
  gpg/card> admin
  ...
  Admin commands are allowed

  # create keys
  gpg/card> generate

  # no off-card backups
  Make off-card backup of encryption key? (Y/n) n

  # key dont expire
  Key is valid for? (0)

  # add details
  Real name: Jane Doe
  Email address: jane@example.com
  Comment: jdoe
  You selected this USER-ID:
  "Jane Doe (jdoe) <jane@example.com>"

  # confirm data
  Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

  # expected output
  public and secret key created and signed.

# list all private keys and pick your target key_id
> gpg --list-secret-keys --keyid-format=long

# edit the target key
> gpg --edit-key XXXXXXXXXXXX

  # add aliases
  gpg> adduid

  # add name, email address and comments
  Real name: Jane Doe
  Email address: jane2@example.com
  Comment: jdoe2
  You selected this USER-ID:
  "Jane Doe (jdoe2) <jane2@example.com>"

  # confirm data
  Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

  # system will ask for device pin

  # save key
  gpg> save

# install pivy-tool to "/opt/pivy/bin/"
$ git clone https://github.com/arekinath/pivy
$ cd pivy; make
> make install

# reset PIV smartcard if nothing works like on my side
# the rest of the device will stay untouched
$ opensc-tool \
  -s 00:A4:04:00:0B:A000000308000010000100 \
  -s 00:20:00:80:08:FFFFFFFFFFFFFFFF \
  -s 00:20:00:80:08:FFFFFFFFFFFFFFFF \
  -s 00:20:00:80:08:FFFFFFFFFFFFFFFF \
  -s 00:FB:00:00

# setup after reset
$ pivy-tool setup

# get smartcard info
$ pivy-tool list

# fetch public key from PIV smartcard
$ pivy-tool -a eccp256 generate 9A
$ pkcs15-tool --read-ssh-key 1

# connect to server using pkcs#11
$ ssh example.org -I /usr/lib64/opensc-pkcs11.so

# use pivy-agent to benefit from ssh-agent
# pivy-agent -g <your_guid> <your_shell>
> pivy-agent -g XXXXXXXXXXX zsh

# enter piv pin to unlock agent
> ssh-add -X

# check ssh-agent in sub-shell
> ssh-add -l