oem-factory-reset: allow to set gpg key algorithm

* CONFIG_GPG_DEFAULT_ALGO defaults to RSA 3072 if not set
* currently only p256 is supported as alternative
* added p256 for nitropad ns50/nv41 boards

Author: daringer

boards/nitropad-ns50/nitropad-ns50.config

@@ -41,6 +41,8 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=igfx_off"
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 
+export CONFIG_GPG_DEFAULT_ALGO=p256
+
 #TPM2 requirements
 export CONFIG_TPM2_TOOLS=y
 export CONFIG_PRIMARY_KEY_TYPE=ecc

boards/nitropad-nv41/nitropad-nv41.config

@@ -41,6 +41,8 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=igfx_off"
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 
+export CONFIG_GPG_DEFAULT_ALGO=p256
+
 # TPM2 requirementspick
 export CONFIG_TPM2_TOOLS=y
 export CONFIG_PRIMARY_KEY_TYPE=ecc

initrd/bin/oem-factory-reset

@@ -101,24 +101,52 @@ gpg_key_reset()
             whiptail_error_die "GPG Key forcesig toggle on failed!\n\n$ERROR"
         fi
     fi
-    # Set RSA key length
-    {
-        echo admin
-        echo key-attr
-        echo 1 # RSA
-        echo ${RSA_KEY_LENGTH} #Signing key size set to RSA_KEY_LENGTH
-        echo ${ADMIN_PIN_DEF}
-        echo 1 # RSA
-        echo ${RSA_KEY_LENGTH} #Encryption key size set to RSA_KEY_LENGTH
-        echo ${ADMIN_PIN_DEF}
-        echo 1 # RSA
-        echo ${RSA_KEY_LENGTH} #Authentication key size set to RSA_KEY_LENGTH
-        echo ${ADMIN_PIN_DEF}
-    } | gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit \
-        > /tmp/gpg_card_edit_output 2>&1
-    if [ $? -ne 0 ]; then
-        ERROR=`cat /tmp/gpg_card_edit_output`
-        whiptail_error_die "Setting key attributed to RSA ${RSA_KEY_LENGTH} bits in USB security dongle failed."
+
+    # use p256 for key generation if requested
+    if [ "$CONFIG_GPG_DEFAULT_ALGO" = "p256" ];then
+
+      {
+          echo admin
+          echo key-attr
+          echo 2 # ECC
+          echo 3 # P-256
+          echo ${ADMIN_PIN_DEF}
+          echo 2 # ECC
+          echo 3 # P-256
+          echo ${ADMIN_PIN_DEF}
+          echo 2 # ECC
+          echo 3 # P-256
+          echo ${ADMIN_PIN_DEF}
+      } | gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit --expert \
+          > /tmp/gpg_card_edit_output 2>&1
+      if [ $? -ne 0 ]; then
+          ERROR=`cat /tmp/gpg_card_edit_output`
+          whiptail_error_die "Setting key to NIST-P256 in USB security dongle failed."
+      fi
+
+    # fallback to RSA key generation by default
+    else
+
+      # Set RSA key length
+      {
+          echo admin
+          echo key-attr
+          echo 1 # RSA
+          echo ${RSA_KEY_LENGTH} #Signing key size set to RSA_KEY_LENGTH
+          echo ${ADMIN_PIN_DEF}
+          echo 1 # RSA
+          echo ${RSA_KEY_LENGTH} #Encryption key size set to RSA_KEY_LENGTH
+          echo ${ADMIN_PIN_DEF}
+          echo 1 # RSA
+          echo ${RSA_KEY_LENGTH} #Authentication key size set to RSA_KEY_LENGTH
+          echo ${ADMIN_PIN_DEF}
+      } | gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit \
+          > /tmp/gpg_card_edit_output 2>&1
+      if [ $? -ne 0 ]; then
+          ERROR=`cat /tmp/gpg_card_edit_output`
+          whiptail_error_die "Setting key attributed to RSA ${RSA_KEY_LENGTH} bits in USB security dongle failed."
+      fi
+
     fi
     # Generate OEM GPG keys
     {