• provisioner-app: Remove ReformatFilesystem command
• fido-authenticator: Increase the maximum number of discoverable credentials (resident keys) to 100.
  • Note that the actual number of discoverable credentials that can be stored on a device depends on the model and the space used by other applications.
• piv-authenticator: Update to v0.5.0
  • Add support for RSA 3072, RSA 4096 and NIST P-384
• fido-authenticator: Improve compliance with CTAP 2.1 specification:
  • Forbid up = false when using the hmac-secret extension (fido-authenticator#19)
    • Note that this may break systemd-cryptenroll setups with --fido2-with-user-presence=no. If you have been using this option, regenerate the key slot with --fido2-with-user-presence=yes before updating.
  • Allow creating credentials without PIN (makeCredUvNotRqd, fido-authenticator#34)
  • Support clientPin getRetries without PIN protocol (fido-authenticator#118)
• OpenPGP: Update to opcard v1.6.1
  • Add support for secp256k1

Migration notes

This updates will change the way internal data is stored for the FIDO application in order to reduce data usage.
It is possible that your device already uses a lot of storage (especially if you're using FIDO resident keys).
If that is the case, the update will be blocked by pynitrokey or the Nitrokey app 2.

To solve this, you can do some operations that will free up space on the internal filesystem:

• Deleting FIDO resident keys
• Factory resetting the other applications
  While applications other than the FIDO application use mainly the external filesystem, they still use the internal filesystem for some critical state.

If you have backups and want to try anyway to perform the migration, you can use the --ignore-warning ifs-migration-v2 command line flag in pynitrokey, but be aware that it may leave your device in an inconsistent state, require a factory-reset of the FIDO application.

Known Issues

With this firmware sometimes the Nitrokey 3 communication after an OpenPGPCard factory-reset (using gpg) becomes stale, this can be solved by power-cycling the Nitrokey 3. This means with this firmware the HEADS oem-factory-reset mechanism fails to complete - we are already working on a solution.