opensc-devel — discussion of developement of OpenSC and related projects

Re: [Opensc-devel] pam_pkcs11 0.6.12

[Ludovic R. <lud...@gm...>]

Le ven. 3 févr. 2023 à 23:41, Paul Wolneykien <ma...@al...> a écrit :
>
> В Fri, 3 Feb 2023 15:25:54 +0100
> Ludovic Rousseau <lud...@gm...> пишет:
>
> > Hello Paul,
> >
> > Do you plan to work on pam_pkcs11 issues and pull requests at
> > https://github.com/OpenSC/pam_pkcs11 ?
> >
> > I ask because I received a merge request at
> > https://salsa.debian.org/debian/pam-pkcs11/-/merge_requests/3 that
> > should go upstream instead in the Debian packaging repository.
> > https://github.com/OpenSC/pam_pkcs11/issues has many issues with no feedback.
> >
> > pam_pkcs11 needs some love (and work).
>
>   Hi, Ludovic. Procrastination is a very bad thing, I'm sorry.
> Yes, I have plans to return to pam_pkcs11 and to work on that issues
> too. However, would it be ok to start that next weekend? If there's
> a strong need for an immediate release of a new version, I can little
> help until the next week.

The patch I mentioned is already included in pam_pkcs11 version 0.6.12.
But Debian only provides version 0.6.11, and that is my fault. I have
seen that version 0.6.12 was available (since July 2021).
Maybe because version 0.6.12 is not available at
https://sourceforge.net/projects/opensc/files/pam_pkcs11/ ? :-)

I will package the new version for Debian.
No urgency on your side.

Bye

-- 
 Dr. Ludovic Rousseau

Re: [Opensc-devel] pam_pkcs11 0.6.12

[Paul W. <ma...@al...>]

В Fri, 3 Feb 2023 15:25:54 +0100
Ludovic Rousseau <lud...@gm...> пишет:

> Hello Paul,
> 
> Do you plan to work on pam_pkcs11 issues and pull requests at
> https://github.com/OpenSC/pam_pkcs11 ?
> 
> I ask because I received a merge request at
> https://salsa.debian.org/debian/pam-pkcs11/-/merge_requests/3 that
> should go upstream instead in the Debian packaging repository.
> https://github.com/OpenSC/pam_pkcs11/issues has many issues with no feedback.
> 
> pam_pkcs11 needs some love (and work).

  Hi, Ludovic. Procrastination is a very bad thing, I'm sorry.
Yes, I have plans to return to pam_pkcs11 and to work on that issues
too. However, would it be ok to start that next weekend? If there's
a strong need for an immediate release of a new version, I can little
help until the next week.

Re: [Opensc-devel] pam_pkcs11 0.6.12

[Ludovic R. <lud...@gm...>]

Hello Paul,

Do you plan to work on pam_pkcs11 issues and pull requests at
https://github.com/OpenSC/pam_pkcs11 ?

I ask because I received a merge request at
https://salsa.debian.org/debian/pam-pkcs11/-/merge_requests/3 that
should go upstream instead in the Debian packaging repository.
https://github.com/OpenSC/pam_pkcs11/issues has many issues with no feedback.

pam_pkcs11 needs some love (and work).

Regards,

Le lun. 5 juil. 2021 à 12:29, Paul Wolneykien <ma...@al...> a écrit :
>
> В Mon, 31 May 2021 21:25:07 +0300
> Paul Wolneykien <ma...@al...> пишет:
>
> >   Hi!
> >
> >   I think we are ready to release the new version of pam_pkcs11
> > (0.6.12). Tomorrow I'm going to test the current master with the
> > tokens I have and tag the release at the end of the week if
> > everything will be ok.
>
>   The release 0.6.12 is out:
>
>     https://github.com/OpenSC/pam_pkcs11/releases/tag/pam_pkcs11-0.6.12
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel



-- 
 Dr. Ludovic Rousseau

Re: [Opensc-devel] support for infineon sle78 based cards

[Frank M. <fra...@gm...>]

Yes, CardOS 5.3 is supported, though there may be some issues, see [1]. 
For cards that were confirmed to be tested for a release, see [2].

Regards, Frank.

[1] https://github.com/OpenSC/OpenSC/issues?q=is%3Aissue+is%3Aopen+cardos

[2] https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing

On 27.01.23 10:52, Pawel Jasinski wrote:
> hi,
>
> Does opensc support sle78 based cards, for example:
> Atos CardOS V5.3 https://www.cryptoshop.com/atos-cardos-v5-3.html
>
> Thanks in advance
> Pawel
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

[Opensc-devel] support for infineon sle78 based cards

[Pawel J. <paw...@gm...>]

hi,

Does opensc support sle78 based cards, for example:
Atos CardOS V5.3 https://www.cryptoshop.com/atos-cardos-v5-3.html

Thanks in advance
Pawel

[Opensc-devel] OpenSC 0.23.0 released

[Jakub J. <jj...@re...>]

Hello all,

We are happy to announce the latest release of OpenSC 0.23.0. You can 
find the full summary of changes, release tarballs and binaries on github:

https://github.com/OpenSC/OpenSC/releases/tag/0.23.0

The most important changes are full support for OpenSSL 3.0, Libressl, 
improved support for symmetric keys, removal of DSA support and 
disablement of some old smart card drivers that were not touched for 
long time.

Thanks everyone who made this release possible by reporting issues or 
contributing pull requests.

Regards,
Jakub Jelen
and the OpenSC team

Re: [Opensc-devel] How to create minidriver on OpenSC

[Douglas E E. <dee...@gm...>]

On 11/25/2022 4:51 PM, Cui Alan wrote:
> Hi,
>> for OpenSC, you need to modify the registry so that your token is
>> recognized by the OpenSC MD, see
> Yes, I had motified the registry and OpenSC 0.22.0 Minidriver recognized my card correctly
> But it still reported my card is read-only.

NIST left it up the card vendor on how to initialize a card. NIST does not define how to write a key to the card, only how to generate a key on the card. And you need to authenticate to the card 
before writing using the 9B key, but many vendor's use non PIV commands to initialize their cards. So the OpenSC PIV driver and minidriver only support read only cards.

NIST designed the PIV to be issued by government agencies using card vendor software.

There is an OpenSC piv-tool that can do the minimum, but it does not use the minidriver.

Yubico has a minidriver and a yubico-piv-tool https://developers.yubico.com/yubico-piv-tool/

>
>> for PIV, you may need to disable the Windows' builtin MD for PIV.
> I recently disabled it in gpedit.msc for OpenSC 0.23.0-rc2
> And
>> Microsoft has it own PIV support by checking for PIV AID and and adding to registry.
>> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\PIV Device ATR Cache"
>> You may need to remove it andd your registry entries before inserting it again.
> I actually cannot understand what to do, but I motified the entry from uuid to my card name.
Not sure what you mean.

> It still not works. Read-only is still reported.
>
>> Every piv vendor I have seen has their own minidriver and they are installed via plug-and-play.
> Yes, I'm the vendor of the card and going to make minidriver by OpenSC.
That piece of the puzzle was never added to the OpenSC PIV code.

>
> Thanks for all of you.
>
> Alan.

-- 

  Douglas E. Engert  <DEE...@gm...>
  

Re: [Opensc-devel] How to create minidriver on OpenSC

[Cui A. <Ala...@ou...>]

Hi,
> for OpenSC, you need to modify the registry so that your token is
> recognized by the OpenSC MD, see
Yes, I had motified the registry and OpenSC 0.22.0 Minidriver recognized my card correctly
But it still reported my card is read-only.

> for PIV, you may need to disable the Windows' builtin MD for PIV.
I recently disabled it in gpedit.msc for OpenSC 0.23.0-rc2
And 
> Microsoft has it own PIV support by checking for PIV AID and and adding to registry. 
> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\PIV Device ATR Cache"
> You may need to remove it andd your registry entries before inserting it again.
I actually cannot understand what to do, but I motified the entry from uuid to my card name.
It still not works. Read-only is still reported.

> Every piv vendor I have seen has their own minidriver and they are installed via plug-and-play.
Yes, I'm the vendor of the card and going to make minidriver by OpenSC.

Thanks for all of you.

Alan.

Re: [Opensc-devel] How to create minidriver on OpenSC

[Douglas E E. <dee...@gm...>]

In addition to what Frank said:  See

  * Entries for PIV cards are not added to the registry by OpenSC.
      o Every piv vendor I have seen has their own minidriver and they are installed via plug-and-play.
  * Microsoft has it own PIV support by checking for PIV AID and and adding to registry. "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\PIV Device ATR Cache" You may need to remove it andd
    your registry entries before inserting it again.
  * OpenSC 0.22.0 minidriver does not support EC correctly. 0.23.0 release candidates have changes to fix that. See https://github.com/OpenSC/OpenSC/pull/2523 For PIV registry entries for 0.23.0 see
    https://github.com/OpenSC/OpenSC/issues/2426#issuecomment-1280934853



On 11/25/2022 4:07 AM, Cui Alan wrote:
> Hi,
> I'm the developer of the Minidriver of Canokey(https://www.canokeys.org/)
> I recently build OpenSC 0.22.0. Using /DDEBUG and following conf file:
>
> app default {
>         debug = 100;
>         debug_file = opensc-debug.txt;
> }
> app cardmod {
>         debug = 1000;
>         debug_file = opensc-debug.txt;
>         framework pkcs15 {
>                # use_file_caching = public;
>         }
>         reader_driver pcsc {
>         }
>         card_atr 3b:f7:11:00:00:81:31:fe:65:43:61:6e:6f:6b:65:79:99 {
>                name = "Canokey Piegon";
>                driver = "PIV-II";
>                flags = "keep_alive";
>         }Franks
> }
> And I got no output both in C:/tmp and C:\Program Files\OpenSC Project\OpenSC\tools\opensc-debug.txt
> At the same time, the notice of pluging in popped out as normal.
> I have no idea about how to config or debug it.
> Thank you.
>
> Alan.
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

-- 

  Douglas E. Engert<DEE...@gm...>
  

Re: [Opensc-devel] How to create minidriver on OpenSC

[Frank M. <fra...@gm...>]

Does your token work with `pkcs11-tool --test --login` and your configuration?

You need to make debug_file an absolute path, otherwise the
application uses some home directory which may be quite obscure in
some cases. opensc-minidriver.dll is loaded into the applications
memory space, say iexplore.exe, for example. You can attach to that
process and set a breakpoint in some minidriver function.

for OpenSC, you need to modify the registry so that your token is
recognized by the OpenSC MD, see
https://github.com/OpenSC/OpenSC/wiki/MS-BaseCSP-MiniDriver-(for-Windows-XP,-Windows-Vista,-Windows-7)

for PIV, you may need to disable the Windows' builtin MD for PIV.
(disable smartcard plug&play)

Regards, Frank.

Am Fr., 25. Nov. 2022 um 11:08 Uhr schrieb Cui Alan <Ala...@ou...>:
>
> Hi,
> I'm the developer of the Minidriver of Canokey(https://www.canokeys.org/)
> I recently build OpenSC 0.22.0. Using /DDEBUG and following conf file:
>
> app default {
>        debug = 100;
>        debug_file = opensc-debug.txt;
> }
> app cardmod {
>        debug = 1000;
>        debug_file = opensc-debug.txt;
>        framework pkcs15 {
>               # use_file_caching = public;
>        }
>        reader_driver pcsc {
>        }
>        card_atr 3b:f7:11:00:00:81:31:fe:65:43:61:6e:6f:6b:65:79:99 {
>               name = "Canokey Piegon";
>               driver = "PIV-II";
>               flags = "keep_alive";
>        }
> }
> And I got no output both in C:/tmp and C:\Program Files\OpenSC Project\OpenSC\tools\opensc-debug.txt
> At the same time, the notice of pluging in popped out as normal.
> I have no idea about how to config or debug it.
> Thank you.
>
> Alan.
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

[Opensc-devel] How to create minidriver on OpenSC

[Cui A. <Ala...@ou...>]

Hi,
I'm the developer of the Minidriver of Canokey(https://www.canokeys.org/)
I recently build OpenSC 0.22.0. Using /DDEBUG and following conf file:

app default {
       debug = 100;
       debug_file = opensc-debug.txt;
}
app cardmod {
       debug = 1000;
       debug_file = opensc-debug.txt;
       framework pkcs15 {
              # use_file_caching = public;
       }
       reader_driver pcsc {
       }      
       card_atr 3b:f7:11:00:00:81:31:fe:65:43:61:6e:6f:6b:65:79:99 {
              name = "Canokey Piegon";
              driver = "PIV-II";
              flags = "keep_alive";
       }
}
And I got no output both in C:/tmp and C:\Program Files\OpenSC Project\OpenSC\tools\opensc-debug.txt
At the same time, the notice of pluging in popped out as normal.
I have no idea about how to config or debug it.
Thank you.

Alan.

Re: [Opensc-devel] OpenSSL3/libp11 RSA keygen

[Alexandre G. <ale...@tr...>]

Hi Jakub,

Thanks for your feedback.
I will have a look at the provider and start to play with it.

Best Regards,
Alexandre.
________________________________
From: Jakub Jelen <jj...@re...>
Sent: Friday, November 18, 2022 12:01 PM
To: ope...@li... <ope...@li...>
Subject: Re: [Opensc-devel] OpenSSL3/libp11 RSA keygen

On 11/15/22 15:55, Alexandre Gonzalo via Opensc-devel wrote:
> Hi All,
>
> I'd like to know if the libp11 engine officially supports OpenSSL v3.
> I am trying to generate an RSA key with the following command and I have
> an error:
> openssl genrsa -out dummy 4096
> Error setting RSA length
> F85455EE79000000:error:03000093:digital envelope
> routines:evp_pkey_ctx_ctrl_int:command not
> supported:crypto/evp/pmeth_lib.c:1324:
>
> It is working fine when I don't use the engine.
>
> I initially thought that it was a bug in OpenSSL and reported the issue:
> https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fopenssl%2Fopenssl%2Fissues%2F19680&amp;data=05%7C01%7Calexandre.gonzalo%40trustonic.com%7Cf6469657171b4589a26308dac9544253%7C923aa3d7d8884cf2a36a9a9c3c53e9ae%7C0%7C0%7C638043660973489085%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=bs6DP%2BPd6VcepeAgfs9FgenS8C7m%2BhDBrLD1VzR%2BTcE%3D&amp;reserved=0
> <https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fopenssl%2Fopenssl%2Fissues%2F19680&amp;data=05%7C01%7Calexandre.gonzalo%40trustonic.com%7Cf6469657171b4589a26308dac9544253%7C923aa3d7d8884cf2a36a9a9c3c53e9ae%7C0%7C0%7C638043660973489085%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=bs6DP%2BPd6VcepeAgfs9FgenS8C7m%2BhDBrLD1VzR%2BTcE%3D&amp;reserved=0>

The OpenSSL 3.0 deprecated engines and libp11 is an openssl engine so
they might keep working, but they will be phased out. The libp11 engine
to my understanding does not support key generation unless the following
pull request will be merged:

https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FOpenSC%2Flibp11%2Fpull%2F474&amp;data=05%7C01%7Calexandre.gonzalo%40trustonic.com%7Cf6469657171b4589a26308dac9544253%7C923aa3d7d8884cf2a36a9a9c3c53e9ae%7C0%7C0%7C638043660973489085%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=25RJIcrErB8LMgqO7BAvACYdaXc%2FRgrV0N0tCHkpu3o%3D&amp;reserved=0

On the other hand, there is a pkcs11 provider implementation in progress
and I AFAIK the key generation is part of the testsuite already and that
part should work:

https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flatchset%2Fpkcs11-provider&amp;data=05%7C01%7Calexandre.gonzalo%40trustonic.com%7Cf6469657171b4589a26308dac9544253%7C923aa3d7d8884cf2a36a9a9c3c53e9ae%7C0%7C0%7C638043660973489085%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=Li%2FPIMbjORYAyHxr0ASxOqqz%2BWCAaUvX%2FwDqCobxlBs%3D&amp;reserved=0

But keep in mind that this is still in development so it might not have
all the corner cases resolved, but any feedback would be welcomed.

Regards,
--
Jakub Jelen
Crypto Team, Security Engineering
Red Hat, Inc.



_______________________________________________
Opensc-devel mailing list
Ope...@li...
https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fopensc-devel&amp;data=05%7C01%7Calexandre.gonzalo%40trustonic.com%7Cf6469657171b4589a26308dac9544253%7C923aa3d7d8884cf2a36a9a9c3c53e9ae%7C0%7C0%7C638043660973489085%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=sSgRDXiFcU%2F%2FIKMGJC8snz6jofhpyXLKHbzkrMie3ZY%3D&amp;reserved=0
CAUTION: This email originated from outside of Trustonic. The message might not be safe, be cautious of attachments and links herein. If in doubt, contact the sender by other means or discard this message, especially if the origin is unexpected and the sender is unknown.



Trustonic SAS - 535 route de Lucioles, Les Aqueducs Batiment 2, Sophia Antipolis 06560 Valbonne, France - SAS au capital de 3 038 000EUR - RCS Grasse - SIRET 480 011 998 00055 - TVA intracommunautaire : FR02 480 011 998

Re: [Opensc-devel] OpenSSL3/libp11 RSA keygen

[Jakub J. <jj...@re...>]

On 11/15/22 15:55, Alexandre Gonzalo via Opensc-devel wrote:
> Hi All,
> 
> I'd like to know if the libp11 engine officially supports OpenSSL v3.
> I am trying to generate an RSA key with the following command and I have 
> an error:
> openssl genrsa -out dummy 4096
> Error setting RSA length
> F85455EE79000000:error:03000093:digital envelope 
> routines:evp_pkey_ctx_ctrl_int:command not 
> supported:crypto/evp/pmeth_lib.c:1324:
> 
> It is working fine when I don't use the engine.
> 
> I initially thought that it was a bug in OpenSSL and reported the issue:
> https://github.com/openssl/openssl/issues/19680 
> <https://github.com/openssl/openssl/issues/19680>

The OpenSSL 3.0 deprecated engines and libp11 is an openssl engine so 
they might keep working, but they will be phased out. The libp11 engine 
to my understanding does not support key generation unless the following 
pull request will be merged:

https://github.com/OpenSC/libp11/pull/474

On the other hand, there is a pkcs11 provider implementation in progress 
and I AFAIK the key generation is part of the testsuite already and that 
part should work:

https://github.com/latchset/pkcs11-provider

But keep in mind that this is still in development so it might not have 
all the corner cases resolved, but any feedback would be welcomed.

Regards,
-- 
Jakub Jelen
Crypto Team, Security Engineering
Red Hat, Inc.

[Opensc-devel] OpenSSL3/libp11 RSA keygen

[Alexandre G. <ale...@tr...>]

Hi All,

I'd like to know if the libp11 engine officially supports OpenSSL v3.
I am trying to generate an RSA key with the following command and I have an error:
openssl genrsa -out dummy 4096
Error setting RSA length
F85455EE79000000:error:03000093:digital envelope routines:evp_pkey_ctx_ctrl_int:command not supported:crypto/evp/pmeth_lib.c:1324:

It is working fine when I don't use the engine.

I initially thought that it was a bug in OpenSSL and reported the issue:
https://github.com/openssl/openssl/issues/19680

Do you have any idea?

Regards,
Alexandre.




Trustonic SAS - 535 route de Lucioles, Les Aqueducs Batiment 2, Sophia Antipolis 06560 Valbonne, France - SAS au capital de 3 038 000EUR - RCS Grasse - SIRET 480 011 998 00055 - TVA intracommunautaire : FR02 480 011 998

Re: [Opensc-devel] Various patches for pkcs11-tool

[Jakub J. <jj...@re...>]

On 11/14/22 11:10, Alexandre Gonzalo via Opensc-devel wrote:
> Hi all,
> 
> I recently had time to test the first release candidate and I tried the 
> HMAC sign/verify now available for the pkcs11-tool.
> I had several minor issues that I fixed with the following attached patches:
> -0005-feat-pkcs11-tool-add-CKM_SHA3_XXX_HMAC-mechanisms.patch
> -0006-feat-pkcs11-tool-usage-sign-is-also-for-secret-keys.patch
> -0007-feat-pkcs11-tool-add-MF_GENERIC_HMAC_FLAGS-for-CKM_M.patch
> 
> If you want, I can create a new PR with these fixes.
> 
> I also have two other patches for new features:
>   - 0002-feat-pkcs11-tool-print-CKA_UNIQUE_ID-value-for-keys-.patch
>   - 0003-feat-pkcs11-tool-add-new-undestroyable-option-to-spe.patch
> 
> Please, let me know if you want them for the future releases.

Hi,
thank you for testing, the email and patches!

All of them look useful on the first sight, so please, open a new PR on 
https://github.com/OpenSC/OpenSC/ -- it makes it easier for us to review 
the changes and run some sanity checks on them, if this is not a problem 
for you.

Regards,
-- 
Jakub Jelen
Crypto Team, Security Engineering
Red Hat, Inc.

[Opensc-devel] Various patches for pkcs11-tool

[Alexandre G. <ale...@tr...>]

Hi all,

I recently had time to test the first release candidate and I tried the HMAC sign/verify now available for the pkcs11-tool.
I had several minor issues that I fixed with the following attached patches:
-0005-feat-pkcs11-tool-add-CKM_SHA3_XXX_HMAC-mechanisms.patch
-0006-feat-pkcs11-tool-usage-sign-is-also-for-secret-keys.patch
-0007-feat-pkcs11-tool-add-MF_GENERIC_HMAC_FLAGS-for-CKM_M.patch

If you want, I can create a new PR with these fixes.

I also have two other patches for new features:
 - 0002-feat-pkcs11-tool-print-CKA_UNIQUE_ID-value-for-keys-.patch
 - 0003-feat-pkcs11-tool-add-new-undestroyable-option-to-spe.patch

Please, let me know if you want them for the future releases.

Regards,
Alexandre.



Trustonic SAS - 535 route de Lucioles, Les Aqueducs Batiment 2, Sophia Antipolis 06560 Valbonne, France - SAS au capital de 3 038 000EUR - RCS Grasse - SIRET 480 011 998 00055 - TVA intracommunautaire : FR02 480 011 998

[Opensc-devel] Security devroom on FOSDEM 2023

[Jakub J. <jj...@re...>]

Hi all,
as you might now, I was organizing Security Devroom on Fosdem few times 
already and we are going to have one next year.

If you have some interesting topic you would like to talk about smart 
cards or anything related to security, we would be glad to see your 
submissions.

All the information is available on the github or on the official 
devroom page:

https://github.com/security-devroom/fosdem-2023
https://fosdem.org/2023/schedule/track/security/

If you would like just to come along and say hi, it would be great to 
see you in person.

Regards,
-- 
Jakub Jelen
Crypto Team, Security Engineering
Red Hat, Inc.

Re: [Opensc-devel] M1 Mac - Monterey - Signing operation fails - OpenSC fails with SCARD_E_NO_SERVICE (0x8010001d)

[Ludovic R. <lud...@gm...>]

Le ven. 28 oct. 2022 à 00:21, Sasi Palaka via Opensc-devel
<ope...@li...> a écrit :
>
> Hi,

Hello,

> We have been using OpenSC 0.22.0 latest build on our company Macs. We have integration with Yubikey.
>
> On the new M1s, signing operations frequently fail with the following error.
>
> ===
> P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] framework-pkcs15.c:4143:pkcs15_prkey_sign: Initiating signing operation, mechanism 0x1041.
> P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] card.c:471:sc_lock: called
> P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] card.c:476:sc_lock: mutex obtained, lock_count: 0
> P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] reader-pcsc.c:688:pcsc_lock: called
> P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11] reader-pcsc.c:695:pcsc_lock: Yubico YubiKey OTP+FIDO+CCID:SCardBeginTransaction status: : 0x8010001d
> P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11] reader-pcsc.c:698:pcsc_lock: Yubico YubiKey OTP+FIDO+CCID:SCardBeginTransaction returned: 0x8010001d
> P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11] reader-pcsc.c:728:pcsc_lock: Yubico YubiKey OTP+FIDO+CCID:SCardBeginTransaction failed: 0x8010001d
> P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11] card.c:522:sc_lock: returning with: -1101 (No readers found)
> ===
>
> Non-M1 macs are working fine.
>
> Any pointers on how to debug this further? What makes the reader lose connection and error with "The smart card resource manager is not running". What should I look for? is that resource manager is something that can be restarted externally through code?
>
> We gather Apple has implemented PCSC.framework with CryptoTokenKit library. When the error happens, we only see one copy of
>
> /System/Library/Frameworks/PCSC.framework/Versions/A/XPCServices/com.apple.ctkpcscd.xpc/Contents/MacOS/com.apple.ctkpcscd
>
> running in the background. When it works we usually see two processes of ctkpcscd running in the background. So, I am guessing, the forked process is somehow dying in the background, and OpenSC is erroring out afterwards.

It looks like a problem with CryptoTokenKit or PCSC.framework and not
with OpenSC itself.

You can get some logs using the scripts log_macOS_ifdbundle.sh and
log_macOS_ifdreader.sh from
https://github.com/LudovicRousseau/PCSC-contrib
Use them with the argument "-d" to get more logs.
Maybe you will find something.

You an also use pcsctest to see if the readers are still available.
See https://ludovicrousseau.blogspot.com/2014/03/level-1-smart-card-support-on-mac-os-x.html

Bye

-- 
 Dr. Ludovic Rousseau

[Opensc-devel] M1 Mac - Monterey - Signing operation fails - OpenSC fails with SCARD_E_NO_SERVICE (0x8010001d)

[Sasi P. <pa...@ya...>]

Hi,

We have been using OpenSC 0.22.0 latest build on our company Macs. We have
integration with Yubikey.

On the new M1s, signing operations frequently fail with the following
error.

===
P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11]
framework-pkcs15.c:4143:pkcs15_prkey_sign: Initiating signing operation,
mechanism 0x1041.
P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] card.c:471:sc_lock:
called
P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11] card.c:476:sc_lock:
mutex obtained, lock_count: 0
P:5819; T:0x8672658944 12:49:26.341 [opensc-pkcs11]
reader-pcsc.c:688:pcsc_lock: called
P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11]
reader-pcsc.c:695:pcsc_lock: Yubico YubiKey
OTP+FIDO+CCID:SCardBeginTransaction status: : 0x8010001d
P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11]
reader-pcsc.c:698:pcsc_lock: Yubico YubiKey
OTP+FIDO+CCID:SCardBeginTransaction returned: 0x8010001d
P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11]
reader-pcsc.c:728:pcsc_lock: Yubico YubiKey
OTP+FIDO+CCID:SCardBeginTransaction failed: 0x8010001d
P:5819; T:0x8672658944 12:49:26.343 [opensc-pkcs11] card.c:522:sc_lock:
returning with: -1101 (No readers found)
===

Non-M1 macs are working fine.

Any pointers on how to debug this further? What makes the reader lose
connection and error with "The smart card resource manager is not running".
What should I look for? is that resource manager is something that can be
restarted externally through code?

We gather Apple has implemented PCSC.framework with CryptoTokenKit library.
When the error happens, we only see one copy of

/System/Library/Frameworks/PCSC.framework/Versions/A/XPCServices/com.apple.ctkpcscd.xpc/Contents/MacOS/com.apple.ctkpcscd

running in the background. When it works we usually see two processes of
ctkpcscd running in the background. So, I am guessing, the forked process
is somehow dying in the background, and OpenSC is erroring out afterwards.


Thanks,
Sasi.

[Opensc-devel] [OpenSC/libp11] Unable to enumerate public keys

[Alexandre G. <ale...@tr...>]

Hello OpenSC team,

I have an issue with the latest version of the libp11-0.4.12.
It was working fine with the previous version.

In my test, I am creating EC, EC_EDWARDS and EC_MONTGOMERY keys with the pkcs11-tool.
I can list the objects as you can see below:

Private Key Object; EC
  ID:         30
  Usage:      sign
  Access:     sensitive, always sensitive, extractable, local
  Unique ID:  1bc0000866ac3ec4346a4a8a753fd396fec524fc2d4542b8d20a348ecdafd8e97febccebd40f55232456ab73fea4ede820d409d719153c1bef5f3ba76b0263e8
Private Key Object; EC_EDWARDS
  ID:         31
  Usage:      sign
  Access:     sensitive, always sensitive, extractable, local
  Unique ID:  b80251e75b7c07aa5fd149ea4f408d6b9986de9ed4217f3ded957d9f5d6e48c2cd79c09280f8073efe0289a17e83f18942c7c28fa3830638a0ade67f823cc315
Public Key Object; EC  EC_POINT 256 bits
  EC_POINT:   0441048a17deb5642b21ee7c6582cf0ccef7d3404fb2aa2174e9cab525bd9ebf57a576ba044683fe5331434ca19a9d6c7a1a1122fc482bc1b5e68a0383db1e91575538
  EC_PARAMS:  06082a8648ce3d030107
  ID:         30
  Usage:      verify
  Access:     local
  Unique ID:  b4bda529c0274024287613f2ea0c7968cff6a29b1eaefa32d0dbf3a22b094fbdd8a68a8b0213553cfa9e5877d66d9a131c20de1d0081b1628f9fc859bfa4d2b6
Public Key Object; EC_MONTGOMERY  EC_POINT 32 bytes
  EC_POINT:   04208feef18f8f5f6e8b3eb285244145fd5d200305399e31a3bfa6dd38fcff7b6620
  EC_PARAMS:  130a63757276653235353139 (x25519)
  ID:         32
  Usage:      verify
  Access:     local
  Unique ID:  8d207940a60058acd89251d4da407b48ed87cc7630266ab731a1e4567bed1ff164767da192918f4fcbf85a99ace88c4288e9d94aa8990b6e2f65e85d084e670d
Private Key Object; EC_MONTGOMERY
  ID:         32
  Usage:      sign
  Access:     sensitive, always sensitive, extractable, local
  Unique ID:  99c9f7f54d8952174c6e02b9989c0120f3e1e413cd2582320b8ca74369011b23ad776699924adb389c2c9591eae4d93b9a55ea26662b7391d61e41c90fc9e7d7
Public Key Object; EC_EDWARDS  EC_POINT 32 bytes
  EC_POINT:   042003a700641101974ecb5e4684984b2990e7fe5fea2c16708a465bc8f1d541e13f
  EC_PARAMS:  130c656477617264733235353139 (ed25519)
  ID:         31
  Usage:      verify
  Access:     local
  Unique ID:  1755adc73f371b563a78ddf6189c7cf2078edd05cf18c23504e39c510ff56e804a8fbc1994b31c869b60c66bf71a12a55a737cd5587f0a8cf5848bd532fa1238

But when I am trying to verify a signature with OpenSSL, it is not able to find my public key.

engine "pkcs11" set.
Unable to enumerate public keys
Unable to enumerate public keys
The public key was not found at: pkcs11:id=0
PKCS11_load_public_key returned NULL
cannot load key file from engine
484453151992:error:80068065:pkcs11 engine:ctx_load_pubkey:object not found:/OpenSC_libp11/Out/Code/src/eng_back.c:871:
484453151992:error:26097081:engine routines:ENGINE_load_public_key:failed loading public key:crypto/engine/eng_pkey.c:108:
unable to load key file

That's because in pkcs11_init_key() we now call pkcs11_object_from_handle() but this function does not support the EC_EDWARDS and EC_MONTGOMERY types.
So, the function returns an error, and the enumeration is stopped.
I suggest that in that case, we don't check the error returned by pkcs11_init_key() as you can see the below patch.

diff --git a/src/p11_key.c b/src/p11_key.c
index ec7f279..c849808 100644
--- a/src/p11_key.c
+++ b/src/p11_key.c
@@ -605,8 +605,7 @@ static int pkcs11_next_key(PKCS11_CTX_private *ctx, PKCS11_SLOT_private *slot,
        if (count == 0)
                return 1;

-       if (pkcs11_init_key(slot, session, obj, type, NULL))
-               return -1;
+       pkcs11_init_key(slot, session, obj, type, NULL);

        return 0;
 }

Please, let me know if I should create a pull request.

Regards,
Alexandre.



Trustonic SAS - 535 route de Lucioles, Les Aqueducs Batiment 2, Sophia Antipolis 06560 Valbonne, France - SAS au capital de 3 038 000EUR - RCS Grasse - SIRET 480 011 998 00055 - TVA intracommunautaire : FR02 480 011 998

[Opensc-devel] OpenSC 0.23.0 release candidate 1

[Jakub J. <jj...@re...>]

Hello all,

You can find a release candidate for version 0.23.0 for testing on Github:
https://github.com/OpenSC/OpenSC/releases/tag/0.23.0-rc1


The most important changes are support for OpenSSL 3.0, Libressl, 
removal of DSA support and disablement of some old smart card drivers 
that were not touched for long time.


We are looking forward about your feedback, which we may discuss via 
mail or here:
https://github.com/OpenSC/OpenSC/issues/2426

Advices for systematic testing can be found here:

https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing

We would like to release the final version in few weeks.

Regards,
Jakub Jelen
and the OpenSC team

Re: [Opensc-devel] OpenSSL 3 PKCS#11 Provider

[Graham L. <mi...@sh...>]

On 28 Jun 2022, at 06:42, Timo Teras <tim...@ik...> wrote:

> I am looking into implementing an OpenSSL 3 PKCS#11 Provider. Similar
> to libp11 engine, but targetting the new OpenSSL 3 APIs.
> 
> Are any of you aware of any such existing work/project? Or if someone
> is interested in helping in any way (coding, testing, documenting,
> etc.) feel free to contact me.

Certainly interested in testing - Redwax has a mod_ca_engine that is based on the old engine API for PKCS11, needs to support a provider as soon as there is one.

Regards,
Graham
—

[Opensc-devel] OpenSSL 3 PKCS#11 Provider

[Timo T. <tim...@ik...>]

Hi all,

I am looking into implementing an OpenSSL 3 PKCS#11 Provider. Similar
to libp11 engine, but targetting the new OpenSSL 3 APIs.

Are any of you aware of any such existing work/project? Or if someone
is interested in helping in any way (coding, testing, documenting,
etc.) feel free to contact me.

Thanks,
Timo

[Opensc-devel] Fix: wrong certificate selected when more than one is present

[Graham L. <mi...@sh...>]

Hi all,

I’d like to draw attention to this fix for libp11 - when multiple certificates are present and they have the same label (eg a blank label), the wrong certificate will be chosen even if an ID is also specified. This results in errors such as the key not matching the certificate.

You see this in cases where a renewed certificate is present on a token at the same time as an older cert. 

Fix is here:

https://github.com/OpenSC/libp11/pull/433

Regards,
Graham
—

Re: [Opensc-devel] Help needed in finding the correct object in token

[Muziket <ema...@ya...>]

 Thanks Douglas for the explanation!
I managed to solve my issue.
    On Friday, 10 September 2021, 12:11:08 am SGT, Douglas E Engert <dee...@gm...> wrote:  
 
 I don't think the problem is the -d 03. They look the same to me. Note in pkcs11-tool:

  807                        opt_object_id_len = sizeof(opt_object_id);
  808                        if (!hex_to_bin(optarg, opt_object_id, &opt_object_id_len)) {

this takes the optarg "03" and expects it to be a hex string and converts to binary 0x03 with length opt_object_id_len=1;


On 9/9/2021 7:20 AM, Muziket via Opensc-devel wrote:
> Hi,
> 
> I've been fiddling the codes of pkcs11-tool to understand opensc pkcs11 module.
> 
> I installed a RSA and ECC key onto my token. My ECC key is identified with ID: 03 and using pkcs11-tool.exe:
>       pkcs11-tool.exe -l -derive --input-file my_ecc_ephemeral_pubkey.der -d 03
> And I could get my token to derive a shared secret.
> 
> I then tried to write a sample application by reusing some of the snippets in pkcs11-tool.c with the opensc-libpkcs11.dll.
> It replied:
>       C_DeriveKey failed: rv = CKR_FUNCTION_NOT_SUPPORTED (0x54)
> 
> I dived into the logs produced by pkcs11-spy and noticed that the CKA_ID is different from when I used the pkcs11-tool.exe:
>      44: C_FindObjectsInit
>      2021-09-09 19:57:08.162
>      [in] hSession = 0x12c7bf0
>      [in] pTemplate[2]:
>          CKA_CLASS             CKO_PRIVATE_KEY
>          CKA_ID *00000000004a6080 */ 1
>          00000000  03  


the "/ 1" says it has length 1.
"0000000 03" is a hex dump starting at offset 000000 for 1 byte which is 0x03
                                              .
>      Returned:  0 CKR_OK
> 
> In my sample application, instead of using getopt, I chose to hardcode the id to opt_object_id[0], which essentially, gives the same value as when pkcs11-tool.exe was used by looking at the 
> pkcs11-tool.c codes.
> Hence, I'm not sure what translations are required to identify the correct ECC object for the shared secret derivation.
> 
> Any insight is appreciated.

This works for me:
pkcs11-tool --slot 0 --module /opt/ossl-1.1.1k/lib/pkcs11-spy.so -l --derive -m ECDH1-COFACTOR-DERIVE -O -d 03 -i /tmp/derive.2810.other.pubkey.der

Try adding the  equivelent to -m ECDH1-COFACTOR-DERIVE

so the C_DeriveKey looks something like this:

10: C_DeriveKey
2021-09-09 10:36:30.335
[in] hSession = 0x55d971f544a0
[in] pMechanism->type = CKM_ECDH1_COFACTOR_DERIVE
[in] pMechanism->pParameter->kdf = CKD_NULL
[in] pMechanism->pParameter->pSharedData[ulSharedDataLen] = NULL [size : 0x0 (0)]
[in] pMechanism->pParameter->pPublicData[ulPublicDataLen] = 000055d971f556d0 / 97
    00000000  04 71 11 01 1A 31 3E C9 C7 2A E2 38 6A 35 1C AD  .q...1>..*.8j5..
    00000010  FC 61 18 C9 D9 38 B3 47 D4 26 61 A4 52 E7 ED B3  .a...8.G.&a.R...
    00000020  B4 B7 08 62 10 2E B1 9F CB 69 49 59 70 69 0C 89  ...b.....iIYpi..
    00000030  24 BA 55 AB 17 A1 74 75 95 C5 6E 16 2C 48 5C 81  $.U...tu..n.,H\.
    00000040  04 75 EA 14 EF 27 95 6F A1 15 AF DD C7 09 C3 FB  .u...'.o........
    00000050  2F A6 3D 39 CF 65 7D 9D 3D E7 EA 1D 7B AD 89 16  /.=9.e}.=...{...
    00000060  88                                              .
[in] hBaseKey = 0x55d971f514f0
[in] pTemplate[10]:
    CKA_TOKEN            False
    CKA_CLASS            CKO_SECRET_KEY
    CKA_KEY_TYPE          CKK_GENERIC_SECRET
    CKA_SENSITIVE        False
    CKA_EXTRACTABLE      True
    CKA_ENCRYPT          True
    CKA_DECRYPT          True
    CKA_WRAP              True
    CKA_UNWRAP            True
    CKA_VALUE_LEN        00007ffd54a6dcc0 / 8
    00000000  30 00 00 00 00 00 00 00                          0.......
[out] hKey = 0x55d971f558a0
Returned:  0 CKR_OK

The pPublicData[ulPublicDataLen] in this case is the compressed public key from 384 bit EC key i.e. CKA_EC_POINT
Its the key of the peer, in your case from the "my_ecc_ephemeral_pubkey.der"
See
http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cs01/pkcs11-curr-v2.40-cs01.pdf or other versions as
v2.20 did not specify the format of the parameter.


> 
> Thank you.
> Muziket
> 
> 
> 
> 
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
> 

-- 

  Douglas E. Engert  <DEE...@gm...>



_______________________________________________
Opensc-devel mailing list
Ope...@li...
https://lists.sourceforge.net/lists/listinfo/opensc-devel