Part V — Mobile Use with GPG Tools on Smartphones and Devices
Status: Work area (outline, not elaborated). This part collects the earlier findings from old chats (Mobile Device Encryption & Backup Strategy 250828, GPG Key Signing & Verification Flow 250829, GitCover® Identity Verification Procedures 250831) as a community work area: Solutions are to be developed here that the community can collaborate on — the entrepreneur/SME needs mobile signature and evidence capability, but the tool landscape is fragmented.
Why Mobile Is Its Own Work Area
Parts I–IV describe the procedures at the desktop/repo level. But the entrepreneur's practice is mobile: Contracts are signed on the go (Facsimile on the tablet), evidence is verified at the customer's computer, eID certification runs via NFC smartphone + AusweisApp. The tool chain (GnuPG, Kleopatra, git commit -S) is desktop-first — the mobile gap is real.
Tool Landscape (State of Findings)
| Tool/Platform | Platform | Role | Maturity/Note |
|---|---|---|---|
| OpenKeychain | Android | GPG key management, signing/decryption | established; integration into mail apps; no git commit -S |
| Kleopatra (GnuPG) | Windows/macOS/Linux | Desktop reference | no native mobile counterpart |
| AusweisApp des Bundes | Android/iOS/Windows/macOS/Linux | eID authentication (Governikus flow, Part IV DS21) | BSI-certified; NFC required |
| PassKey/FIDO2 | cross-platform | Identity anchor (WebAuthn) | Part of the mobile strategy (Chat 250828) |
| YubiKey/Nitrokey | USB/NFC | Hardware keys | Mobile only with adapter/NFC variant |
| Facsimile-SVG/PNG | everywhere | positioned signature graphic (Part II DS07) | platform-neutral — strength of the GitCover approach |
Findings from the Old Chats
1. Mobile PassKey/GPG Environment (Chat 250828)
The initial question: "Set up a PassKey and GPG key environment with a mobile device, with which backups on removable devices can be encrypted with at least SHA-256 quality; possession of the PassKey should suffice for decryption."
Findings:
- BSI/AO/GoBD: The safeguarding is sufficient, with additions — SHA-256 is only a hash; the actual encryption needs AES-256-GCM; the combination PassKey + GPG + GitCover meets the regulatory requirements; process documentation per GoBD required.
- Crypto stack: AES-256-GCM (encryption), Ed25519 (GPG signing), FIDO2/WebAuthn (PassKey).
- 3-stage backup: (1) encrypted on Removable Device, (2) in the GitCover repository, (3) tertiary.
- Device loss: Reconstruction possible if the master GPG key is securely stored in the GitCover system, recovery codes exist, and the recovery procedure has been documented and tested.
2. GPG Key Signing & Verification Flow (Chat 250829)
The flow (canvas artifact with Mermaid) documents signing and
verification as the basis for the chain of evidence — plus the
retention findings (ELSTER documents, Bundesanzeiger filing), which
flow into the retention layer of the GCPN container
(retention.retention_until).
3. Mobile eID Certification (Chat 250831)
The Governikus flow (Part IV DS21) is mobile by nature: NFC smartphone + AusweisApp + PIN. That is the mobile strength of the procedure — official certification works on the device that every entrepreneur carries in their pocket.
UX Challenges (Community Questions)
| Question | Challenge |
|---|---|
| Git commit -S on mobile? | GnuPG does not run natively on Android/iOS; git signing via terminal apps (Termux) is expert territory — UX solution missing |
| Drawing Facsimile on mobile? | Touch drawing of the signature graphic on the device (instead of a prepared SVG) — authenticity question (drawing = factor of control?) |
| Verifying containers on mobile? | sha256sum/jq routine (DS04) on the smartphone — is there a verification app for .gcpn.zip? |
| PassKey ↔ GPG binding? | PassKey as gatekeeper for the GPG key (Chat 250828) — how to anchor this in the Identity Registry (Part IV DS15)? |
| Offline/online transition? | Reading and verifying the Stage 1 package (DS11) on mobile — file manager integration |
Community Work Areas (Outline)
- Mobile verification app: A lightweight tool (PWA or app) that
opens
.gcpn.zippackages and executes the DS04 routine (SHA-256 chain, flags result) without expert knowledge. - Facsimile on touch devices: Drawing → SVG/PNG → SHA-256 → signature doc — with the labeling rule ("digitally signed") from the template.
- OpenKeychain integration: Cloning case repos, signing commits — on Android (Termux/OpenKeychain bridge) with UX guardrails.
- PassKey gatekeeper: PassKey/FIDO2 as control over the GPG key — anchoring in the Identity Registry (Part IV).
- AusweisApp flow as mobile reference: The Governikus flow shows what an official mobile signing experience looks like — UX pattern for the community tools.
Openness
This part is deliberately kept superficial: It collects the findings and names the work areas — the elaboration is community work. Contributions (verification app, OpenKeychain integration, touch Facsimile) are welcome as GCBoK contributions and will be tied back via the normative axes (techniques/procedures).
Cross-References
- Part II DS11 — Connecting external partners (stage model, mobile as endpoint)
- Part IV DS21 — gpg.governikus.de (eID flow, mobile via NFC)
- Chat 250828 — Mobile Device Encryption & Backup Strategy
(
AIChats/…/250828_032614_Mobile_Device_Encryption_and_Backup_Strategy/) - Chat 250829 — GPG Key Signing & Verification Flow
- Chat 250831 — GitCover® Identity Verification Procedures
Created: 260913 | Part V (work area, outline) of the digital-signage series