opensc-devel — discussion of developement of OpenSC and related projects

[Opensc-devel] OpenCT - Aladdin eToken PRO

[Steve G. <ste...@ie...>]

Hello,

I seem to be going around in circles trying to find out why my installation of openct and opensc don’t appear to be working.

I’m using FreeBSD 11.1

Below are the commands I’ve issued to try and see where it fails, but I really don’t know where to look next, any help will be greatly appreciated.

--------------------

~ # dmesg | tail
ugen0.4: <AKS eToken Pro 4254> at usbus0

~ # /usr/local/etc/rc.d/openct start
Starting openct.

~ # openct-tool -v
OpenCT 0.6.20

~ # openct-tool list
0 Aladdin eToken PRO

~ # openct-tool atr
Detcted Aladdin eToken PRO
Card present, status changed
ATR: 3b f2 98 00 ff c1 10 31 fe 55 c8 03 15

~ # opensc-tool -i
OpenSC 0.16.0 [gcc 4.2.1 Compatible FreeBSD Clang 4.0.0 (tags/RELEASE_400/final 297347)]
Enabled features: locking zlib openssl openct

~ # opensc-tool -l
# Detected readers (openct)
Nr.  Card  Features  Name
0    Yes             Aladdin eToken PRO
1    No              OpenCT reader (detached)

~ # opensc-tool -a
Using reader with a card: Aladdin eToken PRO
Failed to connect to card: Card command failed

~ # pkcs11-tool -lt
error: PKCS11 function C_GetSlotInfo failed: rv = CKR_GENERAL_ERROR (0x5)

Aborting.

--------------------


Thanks and Regards, 
Steve 

If you have received this message in error, please reply to this e-mail to notify the sender of its incorrect delivery, and then delete both it and your reply. Thank you.

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Vlastimil P. <vla...@ce...>]

Hello,

a good place to check for java card capabilities is Petr Švenda's JCAlgTest at:

https://www.fi.muni.cz/~xsvenda/jcalgtest/

Good luck!
VLP

______________________________________________________________
> Od: Pali Rohár <pal...@gm...>
> Komu: ope...@li...
> Datum: 23.04.2018 21:57
> Předmět: [Opensc-devel] Java Card with 4096 bit RSA
>
>Hello, I browsed more eshops which sells smart cards (ideally Java Card
>on which can be loaded own applets), but I was not able to find any
>which supports 4096 bit RSA keys. Is 4096 bit RSA support really missing
>on market? Or do you know some Java Cards with 4096 bit RSA key support?
>
>-- 
>Pali Rohár
>pal...@gm...
>
>
>----------
>
>------------------------------------------------------------------------------
>Check out the vibrant tech community on one of the world's most
>engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>----------
>
>_______________________________________________
>Opensc-devel mailing list
>Ope...@li...
>https://lists.sourceforge.net/lists/listinfo/opensc-devel
>
>

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Pali R. <pal...@gm...>]

Hi! It seems that this is not a smart card, but rather USB token.
Or have you found smart card?

On Tuesday 08 May 2018 11:55:54 Luka Logar wrote:
> Hi,
> 
> SmartCafe Expert 7.0 does support 4096bit RSA. I got them here:
> http://www.idpendant.de
> 
> Regards,
> Luka
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

-- 
Pali Rohár
pal...@gm...

[Opensc-devel] OpenSCToken 1.0 released

[Frank M. <fra...@gm...>]

Hi again!

I'm proud to announce the first release of OpenSCToken, a token provider
for macOS' CryptoTokenKit. It has support for all the cards and features
that you can find in OpenSC 0.18.0. The release is available here
https://github.com/frankmorgner/OpenSCToken/releases/tag/v1.0.

CryptoTokenKit is Apple's successor of the long deprecated Tokend
infrastructure with support of all the standard use cases for smart cards
on macOS. For more details, please refer to the documentation
https://github.com/frankmorgner/OpenSCToken

Regards, Frank.

[Opensc-devel] pam_p11 0.2.0 released

[Frank M. <fra...@gm...>]

Hi all!

I'm happy to announce the new pam_p11 release 0.2.0, which can be found
here https://github.com/OpenSC/pam_p11/releases/tag/pam_p11-0.2.0.
<https://github.com/OpenSC/pam_p11/releases/tag/pam_p11-0.2.0> This release
is the first after 10 years of mostly inactivity and I hope you find the
new features as exciting as I do.

Regards, Frank.

[Opensc-devel] OpenSC 0.18.0 released

[Frank M. <fra...@gm...>]

Hi all!

I'm happy to announce the new OpenSC release 0.18.0, which be found here
https://github.com/OpenSC/OpenSC/releases/tag/0.18.0. After almost one year
of work, it contains a lot of bug fixes and new features.

Currently, there are already some new features and minor bugs fixes waiting
to be integrated, so you can soon expect the next release...

Regards, Frank.

Re: [Opensc-devel] Keychain Access only lists expired certificates on my PIV card

[Frank M. <fra...@gm...>]

The problem you're experiencing could be the one from this ticket:
https://github.com/OpenSC/OpenSC/issues/1300. You could try to check
whether an older version of macOS is effected and/or in what regard the
expired certificates differ from the current one (other than thevalidity
period).

Regards, Frank.

2018-05-11 18:32 GMT+02:00 Douglas E Engert <dee...@gm...>:

>
>
> On 5/11/2018 9:42 AM, Matthew X. Economou wrote:
>
>> Dear all,
>>
>> When I open the "PIV_II" keychain, Keychain Access only lists expired
>> certificates.  The same is true for apps that use Apple's APIs for
>> smartcard authentication, e.g., Safari, Slack, Outlook.  This is OpenSC
>> 0.18-rc2 running on macOS 10.13.4.  `pkcs11-tool --login --test`
>> completes successfully.
>>
>> I can use the PIV card with Firefox, so the card itself has valid
>> certificates on it.
>>
>> I experienced the same behavior in OpenSC 0.17, so this isn't a
>> regression.
>>
>> Any suggestions on what I should try next?  I saw a debug logging knob
>> in opensc.conf, so I'm starting there.
>>
>
>
> See: https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC
> It shows how use the debugging.
>
> You say it lists only expired certificates. Are any of the certificates on
> the card actually expired?
> The PIV normally has 4 certificates and matching keys: Auth, Sign, Key
> Management and Card Auth.
> But it can also have retired Key Management keys and certificates. These
> are there to allow you to
> decrypt older messages and files.
>
> If this is a US gov issued card for a number of years and it has been
> updated, you may have some
> of these retired keys and their matching expired certificates.
>
> pkcs11-tool -O
> would show if you have any of these. For example using a NIST Demo card 15
> with
> 3 retired keys with on-card certificates, and 2 retired keys with off-card
> certificates,
> one of them shows up like:
>
> Public Key Object; RSA 2048 bits
>   label:      Retired KEY MAN 2
>   ID:         06
>   Usage:      encrypt, wrap
> Certificate Object; type = X.509 cert
>   label:      Retired Certificate for Key Management 2
>   subject:    DN: C=US, O=Test Government, OU=Test Department, OU=Test
> Agency, CN=Test E. Cardholder XV
>   ID:         06
>
> Then to read the above cert with ID 06 and display it with OpenSSL use:
>
> pkcs11-tool --read-object --id 06 --type cert | openssl x509 -noout -dates
> -inform DER
>
> Using slot 0 with a present token (0x0)
> notBefore=Apr  3 19:56:01 2008 GMT
> notAfter=Apr  3 19:56:01 2010 GMT
>
> (replace -dates with -text to see the full certificate.)
>
>
> I am not a MacOS person, but it could be the OS has cached some
> certificates?
> Why it is not showing the unexpired certificates is not clear.
>
>
>
>> Best wishes,
>> Matthew
>>
>>
>>
> --
>
>  Douglas E. Engert  <DEE...@gm...>
>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>

Re: [Opensc-devel] Keychain Access only lists expired certificates on my PIV card

[Douglas E E. <dee...@gm...>]

On 5/11/2018 9:42 AM, Matthew X. Economou wrote:
> Dear all,
> 
> When I open the "PIV_II" keychain, Keychain Access only lists expired
> certificates.  The same is true for apps that use Apple's APIs for
> smartcard authentication, e.g., Safari, Slack, Outlook.  This is OpenSC
> 0.18-rc2 running on macOS 10.13.4.  `pkcs11-tool --login --test`
> completes successfully.
> 
> I can use the PIV card with Firefox, so the card itself has valid
> certificates on it.
> 
> I experienced the same behavior in OpenSC 0.17, so this isn't a
> regression.
> 
> Any suggestions on what I should try next?  I saw a debug logging knob
> in opensc.conf, so I'm starting there.


See: https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC
It shows how use the debugging.

You say it lists only expired certificates. Are any of the certificates on the card actually expired?
The PIV normally has 4 certificates and matching keys: Auth, Sign, Key Management and Card Auth.
But it can also have retired Key Management keys and certificates. These are there to allow you to
decrypt older messages and files.

If this is a US gov issued card for a number of years and it has been updated, you may have some
of these retired keys and their matching expired certificates.

pkcs11-tool -O
would show if you have any of these. For example using a NIST Demo card 15 with
3 retired keys with on-card certificates, and 2 retired keys with off-card certificates,
one of them shows up like:

Public Key Object; RSA 2048 bits
   label:      Retired KEY MAN 2
   ID:         06
   Usage:      encrypt, wrap
Certificate Object; type = X.509 cert
   label:      Retired Certificate for Key Management 2
   subject:    DN: C=US, O=Test Government, OU=Test Department, OU=Test Agency, CN=Test E. Cardholder XV
   ID:         06

Then to read the above cert with ID 06 and display it with OpenSSL use:

pkcs11-tool --read-object --id 06 --type cert | openssl x509 -noout -dates -inform DER

Using slot 0 with a present token (0x0)
notBefore=Apr  3 19:56:01 2008 GMT
notAfter=Apr  3 19:56:01 2010 GMT

(replace -dates with -text to see the full certificate.)


I am not a MacOS person, but it could be the OS has cached some certificates?
Why it is not showing the unexpired certificates is not clear.


> 
> Best wishes,
> Matthew
> 	
> 

-- 

  Douglas E. Engert  <DEE...@gm...>

[Opensc-devel] Keychain Access only lists expired certificates on my PIV card

[Matthew X. E. <xen...@ir...>]

Dear all,

When I open the "PIV_II" keychain, Keychain Access only lists expired
certificates.  The same is true for apps that use Apple's APIs for
smartcard authentication, e.g., Safari, Slack, Outlook.  This is OpenSC
0.18-rc2 running on macOS 10.13.4.  `pkcs11-tool --login --test`
completes successfully.

I can use the PIV card with Firefox, so the card itself has valid
certificates on it.

I experienced the same behavior in OpenSC 0.17, so this isn't a
regression.

Any suggestions on what I should try next?  I saw a debug logging knob
in opensc.conf, so I'm starting there.

Best wishes,
Matthew
	
-- 
"The lyf so short, the craft so longe to lerne."

[Opensc-devel] Java Card with 4096 bit RSA

[Luka L. <luk...@ci...>]

Hi,

SmartCafe Expert 7.0 does support 4096bit RSA. I got them here: 
http://www.idpendant.de

Regards,
Luka

Re: [Opensc-devel] Upcoming release 0.18.0 needs testing

[Frank M. <fra...@gm...>]

Hi again!

I've updated the release candidate on Github
<https://github.com/OpenSC/OpenSC/releases/tag/0.18.0-rc2> with some more
or less cosmetic changes. Please feel encouraged to document your testing
results in the wiki
<https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing#opensc-0180>
.

Regards, Frank.

2018-04-13 23:44 GMT+02:00 Frank Morgner <fra...@gm...>:

> Hi all!
>
> You'll find a pre-release of OpenSC 0.18.0 on Github
> <https://github.com/OpenSC/OpenSC/releases/tag/0.18.0-rc1>. A draft
> version of the user visible changes is available in this ticket
> <https://github.com/OpenSC/OpenSC/issues/1260>.
>
> I've updated the wiki page
> <https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing> on how
> to  systematically test your card. Please extend the page with test results
> from your smart cards.
>
> Regards,
> Frank.
>

Re: [Opensc-devel] opensc-0.18.0-rc1 notifications

[Frank M. <fra...@gm...>]

Currently there's only the compile time option for disabling notifications.

The warnings should be fixed in master.

Am 3. Mai 2018 12:12:05 MESZ schrieb Peter Popovec <pop...@gm...>:
>Hi
>
>On debian system (stretch, KDE) I have new problem with 
>opensc-0.18.0-rc1
>. If I run ssh to remote computer with opensc-pkcs11 module,
>notification
>window is displayed (card info/ card unlocked. etc). This is OK, but is
>there way to disable/configure this behavior per user?
>
>Second problem .. this notification window is not stable .. after
>logging
>into KDE session, only first notification is OK, rest notifications
>fails
>with message:
>
>GLib-GIO-CRITICAL **: g_application_send_notification: assertion
>'g_application_get_is_registered (application)' failed
>
>better example below, with long pause - about 10 seconds before PIN is
>asked ..
>
>
>
>$ ssh  *****
>
>(process:2975): GLib-GIO-CRITICAL **: g_application_send_notification:
>assertion 'g_application_get_is_registered (application)' failed
>Enter PIN for 'MyEID':
>
>(process:2975): GLib-GIO-CRITICAL **: g_application_send_notification:
>assertion 'g_application_get_is_registered (application)' failed
>
>The programs included with the Debian GNU/Linux system are free
>software;
>the exact distribution terms for each program are described in the
>individual files in /usr/share/doc/*/copyright.
>
>Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
>permitted by applicable law.
>You have mail.
>Last login: Thu May  3 10:35:26 2018 from XX.XX.XX.XX
>****@****:~$
>
>This seems to be similar to
>https://github.com/OpenSC/OpenSC/issues/1186
>but not same ..
>
>If I switch from KDE to text console, there is same long pause before
>PIN
>prompt....
>Same long pause if I run pkcs11-tool --login --test  (in console and
>KDE)..  After KDE restart then 1st  notification is OK..
>
>
>
>Peter.

-- 
Frank Morgner

[Opensc-devel] opensc-0.18.0-rc1 notifications

[Peter P. <pop...@gm...>]

Hi

On debian system (stretch, KDE) I have new problem with  opensc-0.18.0-rc1
. If I run ssh to remote computer with opensc-pkcs11 module, notification
window is displayed (card info/ card unlocked. etc). This is OK, but is
there way to disable/configure this behavior per user?

Second problem .. this notification window is not stable .. after logging
into KDE session, only first notification is OK, rest notifications fails
with message:

GLib-GIO-CRITICAL **: g_application_send_notification: assertion
'g_application_get_is_registered (application)' failed

better example below, with long pause - about 10 seconds before PIN is
asked ..



$ ssh  *****

(process:2975): GLib-GIO-CRITICAL **: g_application_send_notification:
assertion 'g_application_get_is_registered (application)' failed
Enter PIN for 'MyEID':

(process:2975): GLib-GIO-CRITICAL **: g_application_send_notification:
assertion 'g_application_get_is_registered (application)' failed

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have mail.
Last login: Thu May  3 10:35:26 2018 from XX.XX.XX.XX
****@****:~$

This seems to be similar to https://github.com/OpenSC/OpenSC/issues/1186
but not same ..

If I switch from KDE to text console, there is same long pause before PIN
prompt....
Same long pause if I run pkcs11-tool --login --test  (in console and
KDE)..  After KDE restart then 1st  notification is OK..



Peter.

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Pali R. <pal...@gm...>]

On Wednesday 25 April 2018 12:16:14 Frank Morgner wrote:
> NXP's SmartMX P60 with JCOP3 supports RSA4096. I can't recommend an online
> store, though.

Hm... I was not able to find any such card even on NXP's websites...
Only just some (marketing?) information that chip was introduced in 2017.

-- 
Pali Rohár
pal...@gm...

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Pali R. <pal...@gm...>]

On Monday 23 April 2018 21:40:24 Bernd Eckenfels wrote:
> But a side note, If you are not bound to JavaCard, take a look at the Zeitcontrol BasicCard professional?

Personally for development and hacking is JavaCard better then
BasicCard. Also for JavaCard there are e.g. experimental applets with
ed25591 / curve25591 ECC system.

> There’re are 4K-RSA variants which are still pretty cheap. openPGP cards use that platform as well.

I know, there is OpenPGP card which supports 4096 RSA, but does not
support e.g. ed25591. IIRC last version of OpenPGP supports elliptic
curves, but you cannot use general curve defined in Weierstrass form.

-- 
Pali Rohár
pal...@gm...

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Frank M. <fra...@gm...>]

NXP's SmartMX P60 with JCOP3 supports RSA4096. I can't recommend an online
store, though.

2018-04-23 23:40 GMT+02:00 Bernd Eckenfels <ec...@zu...>:

> Was looking for the same thing.
>
> But a side note, If you are not bound to JavaCard, take a look at the
> Zeitcontrol BasicCard professional? There’re are 4K-RSA variants which are
> still pretty cheap. openPGP cards use that platform as well.
>
> Gruss
> Bernd
> --
> http://bernd.eckenfels.net
> ------------------------------
> *From:* Pali Rohár <pal...@gm...>
> *Sent:* Monday, April 23, 2018 9:57:19 PM
> *To:* ope...@li...
> *Subject:* [Opensc-devel] Java Card with 4096 bit RSA
>
> Hello, I browsed more eshops which sells smart cards (ideally Java Card
> on which can be loaded own applets), but I was not able to find any
> which supports 4096 bit RSA keys. Is 4096 bit RSA support really missing
> on market? Or do you know some Java Cards with 4096 bit RSA key support?
>
> --
> Pali Rohár
> pal...@gm...
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>
>

Re: [Opensc-devel] Java Card with 4096 bit RSA

[Bernd E. <ec...@zu...>]

Was looking for the same thing.

But a side note, If you are not bound to JavaCard, take a look at the Zeitcontrol BasicCard professional? There’re are 4K-RSA variants which are still pretty cheap. openPGP cards use that platform as well.

Gruss
Bernd
--
http://bernd.eckenfels.net
________________________________
From: Pali Rohár <pal...@gm...>
Sent: Monday, April 23, 2018 9:57:19 PM
To: ope...@li...
Subject: [Opensc-devel] Java Card with 4096 bit RSA

Hello, I browsed more eshops which sells smart cards (ideally Java Card
on which can be loaded own applets), but I was not able to find any
which supports 4096 bit RSA keys. Is 4096 bit RSA support really missing
on market? Or do you know some Java Cards with 4096 bit RSA key support?

--
Pali Rohár
pal...@gm...

[Opensc-devel] Java Card with 4096 bit RSA

[Pali R. <pal...@gm...>]

Hello, I browsed more eshops which sells smart cards (ideally Java Card
on which can be loaded own applets), but I was not able to find any
which supports 4096 bit RSA keys. Is 4096 bit RSA support really missing
on market? Or do you know some Java Cards with 4096 bit RSA key support?

-- 
Pali Rohár
pal...@gm...

Re: [Opensc-devel] opensc-0.18.0-rc1 tests with MyEID card

[Peter P. <pop...@gm...>]

Hi,

On Mon, Apr 23, 2018 at 12:32 PM, Frank Morgner <fra...@gm...>
wrote:



> I have no idea what could go wrong with the change you've pointed out.
> Does certutil.exe work as expected (note that the output of the tool may
> also indicate some problem)? certutil uses both, authentication and
> signature key (and PIN). Could you send a debug log of both cases?
>
>

If I run certutil -v -scinfo  with  opensc from apveyor 0.17.0.1461  or
0.17.0.1462, result is same (identical lines in CMD window). The test card
contains one certificate, certutil -scinfo can import this cert (there is
2x PIN dialog before certificate is available for import) Only EDGE browser
fails .. PIN dialog is not displayed (version 0.17.0.1462, same in
opensc-0.18.0-rc1).

Version 0.17.0.1461 is working, normal PIN dialog is displayed in EDGE...


Here cases what EDGE display in small window after connect to site that
need TLS client auth (for 0.17.0.1462, same in 0.18.0-rc1) :

1. no smart card in reader - EDGE window "Connect a smart card"
2. different smart card (with diffent keys/certificates" EDGE window
"Checking status"
     and some moment later "The smart card cannot perform the requested
operation or the operation requires a different smartcard"
3. after inserting correct smart card EDGE window "The smart card is ready
for use" I can push "OK" button now, but no PIN is requested, connect to
site fails

It is possilble that EDGE request this pin from PIN-Pad and, because I do
not have reader with PIN-Pad  this  pin requester fails ? I'm no familiar
with the windows API...


There is small difference certutil -v -scinfo (maybe importatnt) in
0.18.0-rc1 and 0.17.0.1462 ..  I am prompted for PIN (2x) and then I can
check certificate details, and install certificate.. In both versions
certificate is installed and import reports no error, but, in 0.18.0-rc1
there are several lines in cmd window:

P:2660 T:7408 2018-04-23 14:45;04:01 Cannot connect card in reader 'Generic
EMV Smartcard Reader 0'
(Tomorrow I will try to find out which version is first affected with this
problem)



Peter

Re: [Opensc-devel] opensc-0.18.0-rc1 tests with MyEID card

[Frank M. <fra...@gm...>]

Your ATR has never been registered. If you make a pull request, then we can
add it to the Windows installer. (Note that if multiple smart card provier
are available in the registry, Windows just picks the first one. So OpenSC
may not work as expected in conjunction with the official driver.)

I have no idea what could go wrong with the change you've pointed out. Does
certutil.exe work as expected (note that the output of the tool may also
indicate some problem)? certutil uses both, authentication and signature
key (and PIN). Could you send a debug log of both cases?

2018-04-23 10:30 GMT+02:00 Peter Popovec <pop...@gm...>:

>
> Hi
>
> After receiving the information about opensc-mindriver.dll location change
> (thanks to Frank Morgner), now MyEID card is recognized by certutil -scinfo
> in WIN 10 (64 bit).
>
> (
> replacing KEY in MyEID registry:
> old:
> "80000001"="opensc-minidriver.dll"
> new:
> "80000001"="C:\Program Files\OpenSC Project\OpenSC\minidriver\opensc-minidriver.dll"
>
> )
>
>
> Still I am wondering, why opensc installer does not install myeid registry
> info.
>
>
> But here is second problem ..  EDGE browser fails for TLS client auth.  If
> I access web server, browser inform me that I need my credentials - here
> the correct certificate is displayed. If I confirm this step by OK, browser
> checks card status and after small time tells me that smart card is ready
> for use. If I  push "OK" button, there is no PIN dialog  and browser tells
> me that I can't connect to page..
> In last working version there is no window with "checking smart card
> status".. but after small time PIN dialog appears.
>
> last working version:
> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1461
>
> first failing version:
> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1462
>
> Relevant changes in this diff ..
>
> git diff 6a4e120b447acd12072e3bc23b6030de34a4a111
> 498aedd165de1de8251b52702cbd8f054d633d7f
>
>
> Peter
>
>
> On Fri, Apr 20, 2018 at 2:52 PM, Peter Popovec <pop...@gm...>
> wrote:
>
>> Hi,
>>
>> Seems to be problem with certutil -scifo in win 10 (64 bit) can be
>> isolated to one patch:
>>
>> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1391
>> - failed
>> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1390
>> - working
>>
>> Please check:
>> git diff 172f320c9a1b5664240be5fa3e143622941b2845
>> 2765b7b1a097daa46e412b58933ec5a6e85f6ce3
>>
>> Peter
>>
>>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>
>

Re: [Opensc-devel] opensc-0.18.0-rc1 tests with MyEID card

[Peter P. <pop...@gm...>]

Hi

After receiving the information about opensc-mindriver.dll location change
(thanks to Frank Morgner), now MyEID card is recognized by certutil -scinfo
in WIN 10 (64 bit).

(
replacing KEY in MyEID registry:
old:
"80000001"="opensc-minidriver.dll"
new:
"80000001"="C:\Program Files\OpenSC
Project\OpenSC\minidriver\opensc-minidriver.dll"

)


Still I am wondering, why opensc installer does not install myeid registry
info.


But here is second problem ..  EDGE browser fails for TLS client auth.  If
I access web server, browser inform me that I need my credentials - here
the correct certificate is displayed. If I confirm this step by OK, browser
checks card status and after small time tells me that smart card is ready
for use. If I  push "OK" button, there is no PIN dialog  and browser tells
me that I can't connect to page..
In last working version there is no window with "checking smart card
status".. but after small time PIN dialog appears.

last working version:
https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1461

first failing version:
https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1462

Relevant changes in this diff ..

git diff 6a4e120b447acd12072e3bc23b6030de34a4a111
498aedd165de1de8251b52702cbd8f054d633d7f


Peter


On Fri, Apr 20, 2018 at 2:52 PM, Peter Popovec <pop...@gm...>
wrote:

> Hi,
>
> Seems to be problem with certutil -scifo in win 10 (64 bit) can be
> isolated to one patch:
>
> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1391
> - failed
> https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1390
> - working
>
> Please check:
> git diff 172f320c9a1b5664240be5fa3e143622941b2845
> 2765b7b1a097daa46e412b58933ec5a6e85f6ce3
>
> Peter
>
>

Re: [Opensc-devel] SO PIN creation

[Maksym T. <mr...@bu...>]

Hi,

Debug output is attached:

activation_without_SO_PIN: activation attempt without SO PIN

activation_card_without_SO_PIN_overwrited_4401: activation attempt with
overwrited 4401 file

Following commands were used:

pkcs15-init --erase-card --reader 0

pkcs15-init --create-pkcs15 --label 'Maksym Tiurin' --reader 0 --so-pin '11111111' --so-puk '22222222' --pin '' --puk ''

pkcs15-init --store-pin --auth-id 01 --label 'mtiurin' --reader 0 --pin 12345678 --puk 87654321 --so-pin 11111111

cd /tmp

rm -f 4401.bin 5032.bin

opensc-explorer --reader 0


cd 5015

get 4401 4401.bin

get 5032 5032.bin

pkcs15-init --erase-card --reader 0 --so-pin '11111111'

pkcs15-init --create-pkcs15 --label 'Firstname Lastname' --reader 0 --so-pin '' --so-puk '' --pin '' --puk ''

pkcs15-init --store-pin --auth-id 01 --label 'nickname' --reader 0 --pin 12345678 --puk 87654321

OPENSC_DEBUG=255 pkcs15-init -F --reader 0

cd /tmp
opensc-explorer --reader 0

cd 5015
put 4401 4401.bin

OPENSC_DEBUG=255  pkcs15-init -F --reader 0


Also using this card I tried to activate it using opensc-explorer:

pkcs15-tool --reader 0 --dump

PKCS#15 Card [Firstname Lastname]:
    Version        : 0
    Serial number  : 00007169017181987395
    Manufacturer ID: Aventra Ltd.
    Last update    : 20180420190330Z
    Flags          : PRN generation, EID compliant

PIN [Security Officer PIN]
    Object Flags   : [0x3], private, modifiable
    ID             : ff
    Flags          : [0xB0], initialized, needs-padding, soPin
    Length         : min_len:4, max_len:8, stored_len:8
    Pad char       : 0xFF
    Reference      : 3 (0x03)
    Type           : ascii-numeric

PIN [mtiurin]
    Object Flags   : [0x3], private, modifiable
    ID             : 01
    Flags          : [0x30], initialized, needs-padding
    Length         : min_len:4, max_len:8, stored_len:8
    Pad char       : 0xFF
    Reference      : 1 (0x01)
    Type           : ascii-numeric


opensc-explorer --reader 0

OpenSC Explorer version 0.16.0
OpenSC [3F00]> verify CHV1
Please enter PIN:
Code correct.
OpenSC [3F00]> verify CHV3
Please enter PIN:
Code correct.
OpenSC [3F00]> apdu 00 44 04 00 0c A0 00 00 00 63 50 4B 43 53 2D 31 35
Sending: 00 44 04 00 0C A0 00 00 00 63 50 4B 43 53 2D 31 35
Received (SW1=0x69, SW2=0x85)
Failure: Not allowed

WBR,
Maksym

On 04/19/18 22:22, Peter Popovec wrote:
> Hi,
>
> please check activation proces ..
>
> $ OPENSC_DEBUG=255 pkcs15-init -F
>
> (remove all sensitive information from output - PINs etc.. before
> sending this output here, or directly to me)
>
>
>
> There is way to activate card directly by APDU ..
> (https://webservices.aventra.fi/wordpress/wp-content/downloads/MyEID_PKI_JavaCard_Applet_Reference_Manual_2-1-4.pdf
> , page 37)
> (I can not guarantee you anything,  maybe opensc fails with this card
> after activation etc..).
>
>
> 1. opensc-explorer, check if pin ID1 and 3 is functional
>
> OpenSC [3F00]> verify CHV1
> Please enter PIN:
> Code correct.
> OpenSC [3F00]> verify CHV3
> Please enter PIN:
> Code correct.
>
>
> 2. use APDU to card activation:
> OpenSC [3F00]> apdu 00 44 04 00 0c A0 00 00 00 63 50 4B 43 53 2D 31 35
> Sending: 00 44 04 00 0C A0 00 00 00 63 50 4B 43 53 2D 31 35
> Received (SW1=0x90, SW2=0x00)
> Success!
> OpenSC [3F00]>
>
>
>
> On Thu, Apr 19, 2018 at 11:31 PM, Maksym Tiurin <mr...@bu...
> <mailto:mr...@bu...>> wrote:
>
>     Sounds like activation process is not so simple.
>
>     I tried to upload 4401 from card with SO pin.
>
>     I tried to upload 4401 and 5032 from card with SO pin.
>
>     Without any success :(
>
>     I see SO PIN in dump now:
>
>     PIN [Security Officer PIN]
>         Object Flags   : [0x3], private, modifiable
>         ID             : ff
>         Flags          : [0xB0], initialized, needs-padding, soPin
>         Length         : min_len:4, max_len:8, stored_len:8
>         Pad char       : 0xFF
>         Reference      : 3 (0x03)
>         Type           : ascii-numeric
>
>     But when I try to activate this card I receive the same error:
>
>     Failed to finalizing card: Not allowed
>
>
>
>

Re: [Opensc-devel] opensc-0.18.0-rc1 tests with MyEID card

[Peter P. <pop...@gm...>]

Hi,

Seems to be problem with certutil -scifo in win 10 (64 bit) can be isolated
to one patch:

https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1391  -
failed
https://ci.appveyor.com/project/LudovicRousseau/opensc/build/0.17.0.1390  -
working

Please check:
git diff 172f320c9a1b5664240be5fa3e143622941b2845
2765b7b1a097daa46e412b58933ec5a6e85f6ce3

Peter

Re: [Opensc-devel] opensc-0.18.0-rc1 tests with MyEID card

[Peter P. <pop...@gm...>]

Hi,

I can confirm, pkcs11-tool --login --test (MyEID card) is functional in WIN
10 if I use
https://ci.appveyor.com/project/frankmorgner/opensc/build/0.17.0.807/job/htduh03okdf2x976/artifacts

Back to certutil .. opensc-0.17.0 win10 64 bit, MyEID card.  If I remove
Aventra driver and if I add registry entry for MyEID  ATR to be handled by
opensc-minidriver.dll, certutil --scinfo is fully functional. I can import
certificates from card and I can use card for  TLS client auth in EDGE.

register info:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards\MyEID-opensc]
"80000001"="opensc-minidriver.dll"
"ATR"=hex:3b,f5,18,00,00,81,31,fe,45,4d,79,45,49,44,9a
"ATRmask"=hex:ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff
"Smart Card Key Storage Provider"="Microsoft Smart Card Key Storage
Provider"
"Crypto Provider"="OpenSC CSP"


Please check (partial) flog rom certutil runs:

opensc 0.17.0 certutil example (only 1st part.. ):

C:\Program Files\OpenSC Project\OpenSC\tools>certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
  0: Generic EMV Smartcard Reader 0
--- Reader: Generic EMV Smartcard Reader 0
--- Status: SCARD_STATE_PRESENT | SCARD_STATE_UNPOWERED
--- Status: The card is available for use.
---   Card: MyEID-opensc
---    ATR:
        3b f5 18 00 00 81 31 fe  45 4d 79 45 49 44 9a      ;.....1.EMyEID.


=======================================================
Analyzing card in reader: Generic EMV Smartcard Reader 0

--------------===========================--------------
================ Certificate 0 ================
--- Reader: Generic EMV Smartcard Reader 0
---   Card: MyEID-opensc
Provider = OpenSC CSP
Key Container = 19f848a2-d902-6fbb-b410-2f4b92678b6c [Default Container]

No AT_SIGNATURE key for reader: Generic EMV Smartcard Reader 0
Serial Number: b0dde4e9e3991049
Issuer: CN=Joe Random/emailAddress=joe.random@example.example, O=example,
L=Example, S=Example, C=EX
 NotBefore: 4/19/2018 12:41 PM
 NotAfter: 5/19/2018 12:41 PM
Subject: CN=Joe Random/emailAddress=joe.random@example.example, O=example,
L=Example, S=Example, C=EX
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): 148a469f2e6bae6825fe117bd48465342dd40321





Same with opensc 0.18.0-rc1 or from appveyor...


C:\Program Files\OpenSC Project\OpenSC\tools>certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
  0: Generic EMV Smartcard Reader 0
--- Reader: Generic EMV Smartcard Reader 0
--- Status: SCARD_STATE_PRESENT | SCARD_STATE_UNPOWERED
--- Status: The card is available for use.
---   Card: MyEID-opensc
---    ATR:
        3b f5 18 00 00 81 31 fe  45 4d 79 45 49 44 9a      ;.....1.EMyEID.


=======================================================
Analyzing card in reader: Generic EMV Smartcard Reader 0

--------------===========================--------------
================ Certificate 0 ================
--- Reader: Generic EMV Smartcard Reader 0
---   Card: MyEID-opensc
Provider = OpenSC CSP
Key Container = (null) [Default Container]

Cannot open the AT_SIGNATURE key for reader: Generic EMV Smartcard Reader 0
Cannot open the AT_KEYEXCHANGE key for reader: Generic EMV Smartcard Reader
0


--------------===========================--------------
================ Certificate 0 ================
--- Reader: Generic EMV Smartcard Reader 0
---   Card: MyEID-opensc
Provider = Microsoft Smart Card Key Storage Provider
Key Container = (null) [Default Container]

Cannot open the  key for reader: Generic EMV Smartcard Reader 0

--------------===========================--------------

Done.
CertUtil: -SCInfo command completed successfully.







If I compare these outputs, one thing is interesting:

Key Container = (null) [Default Container]     (opensc 0.18.0)
Key Container = 19f848a2-d902-6fbb-b410-2f4b92678b6c [Default Container]
(opensc 0.17.0)

maybe this "null"  is problem ..

Peter.

Re: [Opensc-devel] SO PIN creation

[Peter P. <pop...@gm...>]

Hi,

please check activation proces ..

$ OPENSC_DEBUG=255 pkcs15-init -F

(remove all sensitive information from output - PINs etc.. before sending
this output here, or directly to me)



There is way to activate card directly by APDU .. (
https://webservices.aventra.fi/wordpress/wp-content/downloads/MyEID_PKI_JavaCard_Applet_Reference_Manual_2-1-4.pdf
, page 37)
(I can not guarantee you anything,  maybe opensc fails with this card after
activation etc..).


1. opensc-explorer, check if pin ID1 and 3 is functional

OpenSC [3F00]> verify CHV1
Please enter PIN:
Code correct.
OpenSC [3F00]> verify CHV3
Please enter PIN:
Code correct.


2. use APDU to card activation:
OpenSC [3F00]> apdu 00 44 04 00 0c A0 00 00 00 63 50 4B 43 53 2D 31 35
Sending: 00 44 04 00 0C A0 00 00 00 63 50 4B 43 53 2D 31 35
Received (SW1=0x90, SW2=0x00)
Success!
OpenSC [3F00]>



On Thu, Apr 19, 2018 at 11:31 PM, Maksym Tiurin <mr...@bu...>
wrote:

> Sounds like activation process is not so simple.
>
> I tried to upload 4401 from card with SO pin.
>
> I tried to upload 4401 and 5032 from card with SO pin.
>
> Without any success :(
>
> I see SO PIN in dump now:
>
> PIN [Security Officer PIN]
>     Object Flags   : [0x3], private, modifiable
>     ID             : ff
>     Flags          : [0xB0], initialized, needs-padding, soPin
>     Length         : min_len:4, max_len:8, stored_len:8
>     Pad char       : 0xFF
>     Reference      : 3 (0x03)
>     Type           : ascii-numeric
>
> But when I try to activate this card I receive the same error:
>
> Failed to finalizing card: Not allowed
>
>
>