I turns out that Nitrokey works perfectly fine via qubes-usb-proxy and
the nitrokey-app is in the standard debian repository. I had to add
‘user’ to the ‘plugdev’ group in ‘vault’ so it would work without ‘sudo’.
For gnupg to recognize the key as an external card, scdaemon needs to be
installed too and it too requires that ‘user’ is in the ‘plugdev’ group
in ‘vault’. In addition one should install one of the graphical pinentry
modules. I decided to use pinentry-gtk2 for smooth integration with my
So now when e.g. Thunderbird wants to sign a mail, it uses
qubes-gpg-client-wrapper, which connect to ‘vault’ as usual. Next I see
a dialog from ‘vault’ telling me to connect the Nitrokey (if it isn’t
already). This I do by assigning the Nitrokey from ‘sys-usb’ to ‘vault’
the usual way. Next I see the pin entry dialog also from ‘vault’ … I
enter the pin and the mail gets signed.
I love this solution as it means I didn’t have to compromise on USB
isolation and I get to use the all the features of the Nitrokey from
‘vault’ while qubes-gpg-split continues to work as intended. No need to
assign a USB controller to ‘vault’ (I really didn’t want to do this for
Actually my T430 has three (3 !!!) built in USB controllers. One for the
two ports on the left, one for the port on the right as well as the
webcam and other internal devices and a third one for the charging port
on the back and whatever one connects to the dock. What luxury! I don’t
even need the additional USB express card anymore.
I assigned one of the controllers (that has only user ports and nothing
else on it) to the Windows qube and the other two to sys-usb which
remains disposable. Excellent!