R09 — OpenPGP Card 3.4 with standard GnuPG

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R01/R07 passed; recognised PC/SC reader and GnuPG/scdaemon; isolated test GNUPGHOME; no trezor-agent or other connected card.

Steps

1. Create a private campaign GNUPGHOME with mode 700. Set disable-ccid and pcsc-shared in its scdaemon.conf. Run gpg --card-status and record card version 3.4, roles and serial number.
2. Change initial PW1/PW3 under Cryptography → OpenPGP and generate Ed25519/X25519 after clock synchronisation; compare client fingerprints. Alternatively use gpg --card-edit, admin, generate. Retain the public certificate and revocation information.
3. Sign a test file and verify outside the card using the public certificate. Encrypt to the decryption key, decrypt with the card and compare the plaintext. Exercise the authentication subkey through standard GnuPG/gpg-agent.
4. Verify local role/fingerprint consent and the notice for an uninterpreted digest. Refuse a request and let another expire; both must fail. Test incorrect PW1, retry counters and PIN changes without losing keys.
5. Back up, repeat with RSA-2048, then restore on the other revision. Repeat gpg --card-status (a new card serial is expected) and verify the same keys.

Expected result

Standard GnuPG discovers, generates and uses the card without a proprietary agent; independent signature/decryption/authentication checks succeed; refusal is respected; ECC/RSA work within client compatibility.

Evidence to retain

GnuPG/scdaemon versions, isolated configuration, public certificate/fingerprints, actual verify/cmp commands and results, refusal/counter transcript and redacted cross-revision evidence.