ESP32-S3: RSA 2048+ Generation Causes System Crash, Card Error in PGP GUI, and PIN Authentication Failures #44

New Issue

2025-11-24T20:56:01+08:00

jinxing-liu commented

2025-11-24 20:56:01 +08:00

(Migrated from github.com)

Hi,

I’m experiencing several critical issues on ESP32-S3 using pico-openpgp, mostly related to stability and compatibility with OpenPGP tooling:

1. RSA Key Generation Crash

When generating RSA keys with size 2048 bits or greater, the ESP32-S3 frequently enters a deadlock or infinite loop.
This triggers the watchdog timer, causing repeated resets and making the device unusable until power-cycled.
It seems the large key generation is not optimized for the ESP32-S3 hardware and stalls the main task.

2. OpenPGP Card Error in Windows GUI

When configuring the card using Windows-based OpenPGP GUI tools (such as Kleopatra or GnuPG’s smartcard tools), I often see “Card Error” dialogs.
The card is not recognized correctly, or the connection repeatedly fails during operations such as key import, PIN change, or key management.

3. PIN Authentication Defect

PIN authentication logic has major flaws:
- Entering the correct PIN via PGP software still returns “Bad Password” or “Authentication Failed.”
- Sometimes, after a few attempts, the card becomes unresponsive or blocks further PIN input, requiring a reset.
- The state machine behind PIN management and card status appears unstable and does not follow expected OpenPGP Card protocol.

Repro Steps

Use ESP32-S3, load pico-openpgp firmware.
Try generating RSA2048 keys directly on the card.
Set up the card in Windows PGP GUI (e.g., Kleopatra, GnuPG).
Attempt PIN authentication and other smartcard operations.

Expected Behavior

Card should generate RSA2048 keys without crashing.
Windows OpenPGP tools should recognize and manage the card without errors.
Correct PIN should pass authentication; state machine and retry logic should closely follow the OpenPGP Card spec.

Please advise how to fix these issues, or if there is any firmware workaround or patch available. Thank you!

Hi, I’m experiencing several critical issues on ESP32-S3 using pico-openpgp, mostly related to stability and compatibility with OpenPGP tooling: **1. RSA Key Generation Crash** - When generating RSA keys with size 2048 bits or greater, the ESP32-S3 frequently enters a deadlock or infinite loop. - This triggers the watchdog timer, causing repeated resets and making the device unusable until power-cycled. - It seems the large key generation is not optimized for the ESP32-S3 hardware and stalls the main task. **2. OpenPGP Card Error in Windows GUI** - When configuring the card using Windows-based OpenPGP GUI tools (such as Kleopatra or GnuPG’s smartcard tools), I often see “Card Error” dialogs. - The card is not recognized correctly, or the connection repeatedly fails during operations such as key import, PIN change, or key management. **3. PIN Authentication Defect** - PIN authentication logic has major flaws: - Entering the correct PIN via PGP software still returns “Bad Password” or “Authentication Failed.” - Sometimes, after a few attempts, the card becomes unresponsive or blocks further PIN input, requiring a reset. - The state machine behind PIN management and card status appears unstable and does not follow expected OpenPGP Card protocol. **Repro Steps** - Use ESP32-S3, load pico-openpgp firmware. - Try generating RSA2048 keys directly on the card. - Set up the card in Windows PGP GUI (e.g., Kleopatra, GnuPG). - Attempt PIN authentication and other smartcard operations. **Expected Behavior** - Card should generate RSA2048 keys without crashing. - Windows OpenPGP tools should recognize and manage the card without errors. - Correct PIN should pass authentication; state machine and retry logic should closely follow the OpenPGP Card spec. Please advise how to fix these issues, or if there is any firmware workaround or patch available. Thank you!

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/pico-openpgp#44