On New Year’s Day, I received my CanoKey Pigeon which I bought at the end of last year.

Update on 3 January:

I finally received my Canokeys which I have been waiting for a long time. Here is a brief review of it, I won’t go into details of how to use every feature, you can refer to other people’s guides on Yubikeys for most of the usage.

If you don’t know what the hardware key like Yubikey, Canokey or similar, you can start with Zenithal H ’s blog post “From the Ant Design GitHub theft case: Is there an available 2FA in China” (Chinese only) and public talk “CanoKey Applications, Code and Implementation” (Chinese only) to get some introductions.

OpenPGP

This is what I use most at the moment, to sign my commits and to keep my ssh private key. Currently Canokey is going to be a backup key, so I need to import my GPG key into it.

So let’s back up the current ~/.gnupg, then disconnect the internet and gpg --import import the private key we saved before. Then keytocard will write the private key to the card.

But there is a problem here, gpg will record the relationship between the local private key and the smart card number, and only one card can be recorded. This results that I have inserted one card, but I am prompted to insert another card.

This can be solved at this point by using this command.

gpg-connect-agent "scd serialno" "learn --force" /bye

As for the OpenKeyChain on my Android phone, I plugged it in and it worked straight away.

FIDO2

Use systemd-cryptenroll for laptops to unlock full disk encryption, and systemd-homed for desktops to unlock /home and WebAuthn/FIDO2 for accounts such as Github and Google. Both Yubikey and Canokey work fine with the above features.

However, systemd is not very robust at the moment, as it cannot register multiple FIDO2 devices ¹, nor can it automatically fall back to entering the password ² when the key is not found at boot (the only way to enter the password to unlock is to remove the fido2 parameter, you need to add an extra boot entry). The automatic fallback to the input password is supported in systemd 250, see here for a solution.

OATH (TOTP)

You can use Yubico Authenticator on your computer, just turn on Custom reader in the settings to support Canokey.

Canokey is ignored on Android phones due to the ID whitelisting of the USB, but group member @xierch has provided a patch that adds Canokey support.

It works fine for reading and writing TOTPs using USB. A pre-compiled version has been provided by group member @SparrowHe.

NDEF

Although I don’t have a use case for this yet, I did test this function in passing when NFC was available and NFC Tools can read and write NDEF information normally.

Summary

The functions that have been tested so far and the software used are as follows.

Since I don’t have a PIV scenario at the moment, I haven’t tested this feature yet.

Overall, the Canokey Pigeon pretty much covers my current Yubikey 5 NFC usage scenarios, (none of them have Type-C support, so you need to buy an adapter separately), with a few issues to be resolved.

NFC

The NFC performance of CanoKey Pigeon is not really comparable to YubiKey due to the limitation of power consumption of the chip.

I have used Yubikey’s NFC before without any obstacles, but I have not been able to use this Canokey successfully so far, probably because of my posture. I’m not sure how to use it.

But it was fixed after a group member gave me a APDU code , you can refer to the official usage advice and repair guide (Chinese only).

“NFC is really easy to identify when you find the key point”

-- a group member who wishes to remain anonymous

Web Console

Most settings can be managed on the Web Console . Note that Firefox does not support WebUSB³, so you may need to install an additional Chromium.

If you’re using Linux like me, you’ll probably get a device busy error because the gpg-agent is fighting with it. All you have to do is killall gpg-agent and you’ll be fine.

The Web Console does not currently support adding or removing OATH (TOTP/HOTP), you need to use another tool to write to it.

The ykman command requires the -r canokey parameter to specify the reader. openPGP related settings can also be done directly with gpg --edit-card.