opensc-devel — discussion of developement of OpenSC and related projects

[Opensc-devel] Fwd: [GitHub] At 100% of Git LFS data quota for OpenSC

[Ludovic R. <lud...@gm...>]

Hello OpenSC people,

As one of the OpenSC project github admins I received the email below.
I am not sure if we need to do something.

I just checked and I am still able to download the
opensc-0.21.0-rc1.tar.gz from github.
So I don't know what would happen if we do nothing.

Bye

---------- Forwarded message ---------
De : GitHub <su...@gi...>
Date: sam. 24 oct. 2020 à 03:42
Subject: [GitHub] At 100% of Git LFS data quota for OpenSC
To: OpenSC team <lud...@gm...>


You’ve used 100% of your data plan for Git LFS on the organization
OpenSC. Please purchase additional data packs to cover your bandwidth
and storage usage:

  https://github.com/organizations/OpenSC/billing/data/upgrade

Current usage as of 24 Oct 2020 01:42AM UTC:

  Bandwidth: 1.08 GB / 1 GB (108%)
  Storage: 0.58 GB / 1 GB (57%)


-- 
 Dr. Ludovic Rousseau

[Opensc-devel] OpenSC 0.21.0 release candidate 1

[Frank M. <fra...@gm...>]

Hi all!

You can find a release candidate for version 0.21.0 for testing on Github

https://github.com/OpenSC/OpenSC/releases/tag/0.21.0-rc1

We are looking forward about your feedback. Advices for systematic testing
can be found here
https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing

Regards,
Frank.

Re: [Opensc-devel] OpenSC for Android

[Frank M. <fra...@gm...>]

I've compiled OpenSC for Android about two years ago and used the
PKCS#11 module with some card via NFC.
There should have been no porting issues introduced since then. You
don't need the full pcscd at all. The tricky part is to implement your
own libpcsclite which communicates with your App's NFC tag. This is
the part from my implementation which is not published, but it is
somewhat similar to the combination of
https://github.com/frankmorgner/vsmartcard/tree/master/virtualsmartcard/src/pcsclite-vpcd
and https://github.com/frankmorgner/vsmartcard/blob/master/remote-reader/app/src/main/java/com/vsmartcard/remotesmartcardreader/app/VPCDWorker.java

Regards, Frank.

Am Di., 22. Sept. 2020 um 19:17 Uhr schrieb Douglas E Engert
<dee...@gm...>:
>
> I believe at one time OpenSC was ported to Android.
>
> There is renewed interest in using OpenSC supported smart cards with SM over NFC from phones and tablets.
>
>
> But I can not find much at all on it.
>
> These are no longer valid.
>
> http://code.google.com/p/seek-for-android/wiki/SmartCardPKI
> http://seek-for-android.googlecode.com/files/opensc_android.patch
>
>
> https://opensc-devel.narkive.com/7cDMLZJr/opensc-on-android#selection:1.1444.65
> is the closest and it is 9 years ago.
>
> Any one got an update?
>
>
> --
>
>   Douglas E. Engert  <DEE...@gm...>
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel

[Opensc-devel] OpenSC for Android

[Douglas E E. <dee...@gm...>]

I believe at one time OpenSC was ported to Android.

There is renewed interest in using OpenSC supported smart cards with SM over NFC from phones and tablets.


But I can not find much at all on it.

These are no longer valid.

http://code.google.com/p/seek-for-android/wiki/SmartCardPKI
http://seek-for-android.googlecode.com/files/opensc_android.patch


https://opensc-devel.narkive.com/7cDMLZJr/opensc-on-android#selection:1.1444.65
is the closest and it is 9 years ago.

Any one got an update?


-- 

  Douglas E. Engert  <DEE...@gm...>

[Opensc-devel] libp11 release

[Ondřej S. <on...@su...>]

Hi,

can I ping the list again about 0.4.11 release of libp11 that has necessary fixes
for BIND 9 with engine_pkcs11?  The last time I asked, the plan was to release it
around January 2020 :-)

Ondrej
--
Ondřej Surý (He/Him)
on...@su...

Re: [Opensc-devel] pam_pkcs11 -- Pull requests and advice for another bug fix

[Jakub J. <jj...@re...>]

On Mon, 2020-08-03 at 03:05 -0700, Logan Garbarini wrote:
> Ah, understood. I missed that part of the mailing list, it's a shame
> no one
> from Canonical or Red Hat have stepped in as they both advertise
> smart card
> support using pam_pkcs11!

We are using sssd for smart cards authentication now. If you do not
have too complicated use case, it might actually work for you too.

Regards,
-- 
Jakub Jelen
Senior Software Engineer
Security Technologies
Red Hat, Inc.

Re: [Opensc-devel] pam_pkcs11 -- Pull requests and advice for another bug fix

[Ludovic R. <lud...@gm...>]

Le lun. 3 août 2020 à 12:06, Logan Garbarini <lo...@ie...> a écrit :
>
> Ah, understood. I missed that part of the mailing list, it's a shame no one from Canonical or Red Hat have stepped in as they both advertise smart card support using pam_pkcs11!

Or they could hire me to maintain pam-pkcs11 :-)

> I will happily help with some basic maintenance so getting write access would be greatly appreciated.

I just sent you a github invitation.
Welcome onboard!

> I'm unlikely to have time, but if a rewrite is in order is the best path still through libp11 as mentioned four years ago?

No idea.

Bye

-- 
 Dr. Ludovic Rousseau

Re: [Opensc-devel] pam_pkcs11 -- Pull requests and advice for another bug fix

[Logan G. <lo...@ie...>]

Ah, understood. I missed that part of the mailing list, it's a shame no one
from Canonical or Red Hat have stepped in as they both advertise smart card
support using pam_pkcs11!

I will happily help with some basic maintenance so getting write access
would be greatly appreciated.

I'm unlikely to have time, but if a rewrite is in order is the best path
still through libp11 as mentioned four years ago?

Best,
Logan

On Mon, Aug 3, 2020 at 2:34 AM Ludovic Rousseau <lud...@gm...>
wrote:

> Hello,
>
> I used to be the maintainer of pam_pkcs11.
> 4 years ago I asked for help
>
> https://opensc-devel.narkive.com/iYD5vBPl/pam-pkcs-11-needs-a-new-maintainer-s-soon-or-it-will-die
>
> If you plan to use pam_pkcs11 personally and professionally then it is
> a good idea to engage in its development.
> I can add you to the pam_pkcs11-maintainers team so you have write access.
>
> Regards,
>
> Le lun. 3 août 2020 à 11:15, Logan Garbarini <lo...@ie...> a écrit :
> >
> > Hi all,
> >
> > I've been starting to use OpenSC and pam_pkcs11 personally and
> professionally and have discovered a couple issues in `pam_pkcs11`. It
> looks like the mailing list is the proper avenue for raising some of these
> issues so here I go.
> >
> > 1) I've put up a pull request for one bug that has been verified by
> another user here, this seems to be primarily an issue with OpenSSL
> versions and how they are handled:
> >
> > https://github.com/OpenSC/pam_pkcs11/pull/45
> >
> > 2) I've found what appears to be a much trickier issue in the ECDSA
> signature verification of cert_vfy.c (
> https://github.com/OpenSC/pam_pkcs11/issues/44). I'll reproduce the
> salient parts of the issue below:
> >
> >> When using signature verification in pam_pkcs11, I immediately run into
> the following verification issue on ECDSA certs/keys in verify_signature():
> >>
> >> verify_signature() failed: EVP_VerifyFinal() failed: error:25066067:DSO
> support routines:dlfcn_load
> >>
> >> The primary issues seems to be "Signed big-endian encoding of minimal
> length", from the stackexchange post How can I convert a DER ECDSA
> signature to ASN.1?. The current upstream code doesn't seem to even yield a
> properly terminated ASN1 signatures on modern OpenSSL versions (1.1.0) and
> even if it did lacks handling of BIGNUMs that may be interpreted as signed
> integers if not properly padded (see above stack exchange).
> >
> >
> > I have attached a hacky demo patch file that along with the linked stack
> exchange posts clarifies my issue and what appears to be the necessary
> solution.
> >
> > This leads me into my primary question, as someone who hasn't had too
> much exposure to OpenSC and is certainly not an expert in the OpenSSL API,
> what is the best way to contribute?
> >
> > It seems like EVP_Verify is a much older API and EVP_DigestVerify is now
> recommended, has better documentation, and has better support for ECDSA
> signatures (https://wiki.openssl.org/index.php/EVP_Signing_and_Verifying).
> However, this would be a much bigger change than trying to reassemble the
> ASN1 encoding using BN_bin2bn and ECDSA_SIG_get0_*.
> >
> > Best,
> > Logan
> >
> > _______________________________________________
> > Opensc-devel mailing list
> > Ope...@li...
> > https://lists.sourceforge.net/lists/listinfo/opensc-devel
>
>
>
> --
>  Dr. Ludovic Rousseau
>

Re: [Opensc-devel] pam_pkcs11 -- Pull requests and advice for another bug fix

[Ludovic R. <lud...@gm...>]

Hello,

I used to be the maintainer of pam_pkcs11.
4 years ago I asked for help
https://opensc-devel.narkive.com/iYD5vBPl/pam-pkcs-11-needs-a-new-maintainer-s-soon-or-it-will-die

If you plan to use pam_pkcs11 personally and professionally then it is
a good idea to engage in its development.
I can add you to the pam_pkcs11-maintainers team so you have write access.

Regards,

Le lun. 3 août 2020 à 11:15, Logan Garbarini <lo...@ie...> a écrit :
>
> Hi all,
>
> I've been starting to use OpenSC and pam_pkcs11 personally and professionally and have discovered a couple issues in `pam_pkcs11`. It looks like the mailing list is the proper avenue for raising some of these issues so here I go.
>
> 1) I've put up a pull request for one bug that has been verified by another user here, this seems to be primarily an issue with OpenSSL versions and how they are handled:
>
> https://github.com/OpenSC/pam_pkcs11/pull/45
>
> 2) I've found what appears to be a much trickier issue in the ECDSA signature verification of cert_vfy.c (https://github.com/OpenSC/pam_pkcs11/issues/44). I'll reproduce the salient parts of the issue below:
>
>> When using signature verification in pam_pkcs11, I immediately run into the following verification issue on ECDSA certs/keys in verify_signature():
>>
>> verify_signature() failed: EVP_VerifyFinal() failed: error:25066067:DSO support routines:dlfcn_load
>>
>> The primary issues seems to be "Signed big-endian encoding of minimal length", from the stackexchange post How can I convert a DER ECDSA signature to ASN.1?. The current upstream code doesn't seem to even yield a properly terminated ASN1 signatures on modern OpenSSL versions (1.1.0) and even if it did lacks handling of BIGNUMs that may be interpreted as signed integers if not properly padded (see above stack exchange).
>
>
> I have attached a hacky demo patch file that along with the linked stack exchange posts clarifies my issue and what appears to be the necessary solution.
>
> This leads me into my primary question, as someone who hasn't had too much exposure to OpenSC and is certainly not an expert in the OpenSSL API, what is the best way to contribute?
>
> It seems like EVP_Verify is a much older API and EVP_DigestVerify is now recommended, has better documentation, and has better support for ECDSA signatures (https://wiki.openssl.org/index.php/EVP_Signing_and_Verifying). However, this would be a much bigger change than trying to reassemble the ASN1 encoding using BN_bin2bn and ECDSA_SIG_get0_*.
>
> Best,
> Logan
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel



-- 
 Dr. Ludovic Rousseau

[Opensc-devel] pam_pkcs11 -- Pull requests and advice for another bug fix

[Logan G. <lo...@ie...>]

Hi all,

I've been starting to use OpenSC and pam_pkcs11 personally and
professionally and have discovered a couple issues in `pam_pkcs11`. It
looks like the mailing list is the proper avenue for raising some of these
issues so here I go.

1) I've put up a pull request for one bug that has been verified by another
user here, this seems to be primarily an issue with OpenSSL versions and
how they are handled:

https://github.com/OpenSC/pam_pkcs11/pull/45

2) I've found what appears to be a much trickier issue in the ECDSA
signature verification of cert_vfy.c (
https://github.com/OpenSC/pam_pkcs11/issues/44). I'll reproduce the salient
parts of the issue below:

When using signature verification in pam_pkcs11, I immediately run into the
> following verification issue on ECDSA certs/keys in verify_signature():
>
verify_signature() failed: EVP_VerifyFinal() failed:
error:25066067:DSO support routines:dlfcn_load
>
> The primary issues seems to be "Signed big-endian encoding of minimal
> length", from the stackexchange post How can I convert a DER ECDSA
> signature to ASN.1?
> <https://crypto.stackexchange.com/questions/1795/how-can-i-convert-a-der-ecdsa-signature-to-asn-1/1797>.
> The current upstream code doesn't seem to even yield a properly terminated
> ASN1 signatures on modern OpenSSL versions (1.1.0) and even if it did lacks
> handling of BIGNUMs that may be interpreted as signed integers if not
> properly padded (see above stack exchange).
>

I have attached a hacky demo patch file that along with the linked stack
exchange posts clarifies my issue and what appears to be the necessary
solution.

This leads me into my primary question, as someone who hasn't had too much
exposure to OpenSC and is certainly not an expert in the OpenSSL API, what
is the best way to contribute?

It seems like EVP_Verify is a much older API and EVP_DigestVerify is now
recommended, has better documentation, and has better support for ECDSA
signatures (https://wiki.openssl.org/index.php/EVP_Signing_and_Verifying).
However, this would be a much bigger change than trying to reassemble the
ASN1 encoding using BN_bin2bn and ECDSA_SIG_get0_*.

Best,
Logan

Re: [Opensc-devel] OpenSC in 12% of Debian systems?

[Douglas E E. <dee...@gm...>]

Very interesting.

Is there anyway to use this tool or other tool to show which smart cards people are using with OpenSC?

Any way to show by country?


On 7/7/2020 9:41 AM, Ludovic Rousseau wrote:
> Hello,
> 
> I tried to make some statistics about the use of smart cards in Debian.
> It seems that OpenSC is installed in 12.34% of Debian systems. I also
> like this magic number. It looks like a PIN code value :-)
> 
> You can find my results at
> https://ludovicrousseau.blogspot.com/2020/07/smart-card-usage-in-debian-applications.html
> 
> Bye
> 

-- 

  Douglas E. Engert  <DEE...@gm...>

[Opensc-devel] OpenSC in 12% of Debian systems?

[Ludovic R. <lud...@gm...>]

Hello,

I tried to make some statistics about the use of smart cards in Debian.
It seems that OpenSC is installed in 12.34% of Debian systems. I also
like this magic number. It looks like a PIN code value :-)

You can find my results at
https://ludovicrousseau.blogspot.com/2020/07/smart-card-usage-in-debian-applications.html

Bye

-- 
 Dr. Ludovic Rousseau

[Opensc-devel] Proposed improvements in the IAS-ECC card support

[Zoltan K. <mis...@gm...>]

Hi,

I have done some work with updating the IAS-ECC card driver, mainly to 
get it working with Idemia (Oberthur) Cosmo cards. Some of the changes 
should benefit other cards as well, especially if you care about PIN-pad 
support.

The work is available in the following pull request:
https://github.com/OpenSC/OpenSC/pull/2070

Zoltan Kelemen

Re: [Opensc-devel] OpenSC and PIV references in US Gov web sites

[Douglas E E. <dee...@gm...>]

On 6/15/2020 9:23 AM, J.W...@mi... wrote:
> Hi Douglas,
> 
> Your message (Or actually one of the referenced URL's) left me slightly confused.
> I was (perhaps mistakenly) under the impression that PIV-cards, or PIV-I-cards, could work directly with the opensc-libraries.

Yes they can. If the cards follow the NIST 800-73-3 PIV standards.

NIST 800-73-4 introduces a number of *optional* features including Secure messaging, Virtual Contact Interface
and Pairing code. These allow for access to a PIV card using NFC i.e. contactless interface, with security to
prevent sniffing of the data over NFC.

IDEMIA (formally Oberthur) makes many different cards for government and commercial use.
They can use the same card for multiple usages by loading different applets on the same card,
and some cards can have more then one applet.

I am not familiar with YPSID most likely it is another applet required in France.

PIV is really one of these applets defined by US government (also used by NATO, I see you are from mindef.nl)
and many card manufacturers offer cards accredited by NIST as PIV. IDEMIA also offeres CAC/PIV cards.
I don't know if you could get a PIV with YPSID. You would have to ask them. In any case OPenSC can
use the PIV applet ifit is on a card.

And because Microsoft has a built in driver for PIV, on Windows, other manufacturers offer PIV-like-cards
(i.e. not approved by NIST) with additional features (and are missing required PIV features), but close enough
to work with Windows and OpenSC drivers for example Yubico and PIVKey. There are two PIV applets available on github.com too.
Yubico has PIV and OPenPGP applets (and others) on their devices.

I sent out the below note to highlight IDEMIA's PIV card has support for Secure Messaging, Virtual Contact Interface
and Pairing code and to point out that OpenSC is noted in US government web sites as usable with PIV cards
on any platform. I have it on one of my Raspberry Pi's.

I have one IDEMIA PIV V 2.4.0 card from them and am expecting a complete set of test cards
to test OpenSC support for these optional features. See https://github.com/OpenSC/OpenSC/pull/2053
As far as I know IDEMIA is the first to offer these optional features.

IDEMIA also has the optional PIV OCC fingerprint matching on card, which I believe they developed
for NIST. OpenSC does not support this, as obtaining a fingerprint from the user is outside
of scope, but would be easy to add, as the data needed is well defined, and sent just like a
long PIN to the card.


> However, noticing the mentioning idemia, does this not also imply the use of their middle ware "YPSID" ??

No it does not.

> 
> -----Original Message-----
> From: Douglas E Engert <dee...@gm...>
> Sent: Tuesday, June 9, 2020 9:39 PM
> To: OpenSC-devel <Ope...@li...>
> Subject: [Opensc-devel] OpenSC and PIV references in US Gov web sites
> 
> While looking Googling for: ID-One PIV v 2.4.0 on Cosmo V8.1 https://www.idmanagement.gov/idemia-id-one-piv-v2-4-0-on-cosmos-v8-1-1501381-2/
> 
> then under playbooks:
> https://www.idmanagement.gov/playbooks/
> 
> then under PIV Usage Guides:
> https://piv.idmanagement.gov/
> 
> then under getting started:
> https://piv.idmanagement.gov/start/#middleware
> 
> OpenSC
> 
> --
> 
>    Douglas E. Engert  <DEE...@gm...>
> 
> 
> 
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
> 
> Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.
> 
> This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
> 

-- 

  Douglas E. Engert  <DEE...@gm...>

Re: [Opensc-devel] OpenSC and PIV references in US Gov web sites

[<J.W...@mi...>]

Hi Douglas,

Your message (Or actually one of the referenced URL's) left me slightly confused.
I was (perhaps mistakenly) under the impression that PIV-cards, or PIV-I-cards, could work directly with the opensc-libraries.
However, noticing the mentioning idemia, does this not also imply the use of their middle ware "YPSID" ??

-----Original Message-----
From: Douglas E Engert <dee...@gm...>
Sent: Tuesday, June 9, 2020 9:39 PM
To: OpenSC-devel <Ope...@li...>
Subject: [Opensc-devel] OpenSC and PIV references in US Gov web sites

While looking Googling for: ID-One PIV v 2.4.0 on Cosmo V8.1 https://www.idmanagement.gov/idemia-id-one-piv-v2-4-0-on-cosmos-v8-1-1501381-2/

then under playbooks:
https://www.idmanagement.gov/playbooks/

then under PIV Usage Guides:
https://piv.idmanagement.gov/

then under getting started:
https://piv.idmanagement.gov/start/#middleware

OpenSC

--

  Douglas E. Engert  <DEE...@gm...>



_______________________________________________
Opensc-devel mailing list
Ope...@li...
https://lists.sourceforge.net/lists/listinfo/opensc-devel

Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

[Opensc-devel] OpenSC and PIV references in US Gov web sites

[Douglas E E. <dee...@gm...>]

While looking Googling for: ID-One PIV v 2.4.0 on Cosmo V8.1
https://www.idmanagement.gov/idemia-id-one-piv-v2-4-0-on-cosmos-v8-1-1501381-2/

then under playbooks:
https://www.idmanagement.gov/playbooks/

then under PIV Usage Guides:
https://piv.idmanagement.gov/

then under getting started:
https://piv.idmanagement.gov/start/#middleware

OpenSC

-- 

  Douglas E. Engert  <DEE...@gm...>

Re: [Opensc-devel] help with piv card

[Ray L. <cod...@in...>]

Hi again,

Just a quick final follow-up.  I did try cleaning the card & reader, as 
you suggested, but it didn't help.  I eventually got around to checking 
the system log (again) and this time I noticed errors from pcsc 
indicating a HW problem.  If I restart pcsc with no card present it 
reports HW errors talking to the reader and concludes that it cannot 
register the reader.  If I restart with the card present I see a lot 
card read errors (which tend to bury the HW messages).  I'm guessing 
this is how I missed those messages earlier, since I almost always leave 
the card in.

So, bottom line, it appears that the reader has in fact failed (although 
I still don't like the coincidence).  I have ordered a new usb reader 
from amazon and hopefully that will solve the problem.

Thanks again for everyone's help!

~ray

On 3/26/20 6:03 PM, Douglas E Engert wrote:
> Sounds like a physical contact problem between the reader and card. 
> Have you
> tried cleaning the contacts. a pencil eraser can be used.
>
> You say the reader worked for years. Look at the contacts, dirty or bent?
> You said: "and the new one works on Windows." I assume with a 
> different reader?
>
> Could also be power issue with new card needing more power then the 
> old one.
>
> Could be new card is a little out of spec, and does not make good contact
> with old reader.
>
> Google for: how to clean smart card reader
>
> I would try another reader on the same machine too.
>
>
>
>
> On 3/26/2020 4:04 PM, Ray Lambert wrote:
>> On 3/26/20 8:05 AM, Douglas E Engert wrote:
>>> What does `OPENSC_DEBUG=3 pkcs11-tool -O`
>>>
>>> Note PIV driver caches and parses the certificates early in the process
>>> and would show if the card is dead, or if certificates can not be 
>>> parsed.
>>>
>> Hi Douglas,
>>
>> Thanks for the response.  Not sure if I should post the whole output 
>> to this list (it's ~20k, 147 lines)?
>>
>> pcsc functions appear to be returning "-1113 (Unresponsive card 
>> (correctly inserted?))" consistently and the final error appears to 
>> be "CKR_DEVICE_ERROR (0x30)":
>>
>> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
>> pkcs11-global.c:596:C_GetSlotInfo: C_GetSlotInfo() card detect rv 0x30
>> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
>> pkcs11-global.c:613:C_GetSlotInfo: C_GetSlotInfo() flags 0x20
>> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
>> pkcs11-global.c:614:C_GetSlotInfo: C_GetSlotInfo(0x0) = CKR_DEVICE_ERROR
>> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
>> pkcs11-global.c:365:C_Finalize: C_Finalize()
>>
>> I've tried reinserting the card but no dice.  As I mentioned, the old 
>> card was working fine and the new one works on Windows. It would be 
>> quite a coincidence if the card reader died at the same time I got a 
>> new card(?).
>>
>> Please LMK if you need more.
>>
>> Thanks again!
>>
>> ~ray
>>
>>
>>>
>>>
>>> On 3/25/2020 6:53 PM, Ray Lambert wrote:
>>>> Hi,
>>>>
>>>> I'm trying to get a new PIV card to work and hoping someone can help.
>>>>
>>>> The old card was working perfectly for some time with openconnect 
>>>> vpn, pcsc, and p11-kit on Manjaro (fully updated).
>>>>
>>>> The new card is recognized and the ATR is accessible but the card 
>>>> is not otherwise visible (no tokens).
>>>>
>>>> I recently installed opensc to try to get it work but the results 
>>>> are the same.  I was advised (on the OC mailing list) that a 
>>>> different pkcs#11 driver may be needed.
>>>>
>>>> The card type (according to ActivClient on Windows) is "ID-One 
>>>> Cosmo v8.0 128K with PIV 2.3.5" (Oberthur).
>>>>
>>>> opensc results are:
>>>>
>>>> ####
>>>>
>>>> $ opensc-tool -l
>>>> # Detected readers (pcsc)
>>>> Nr.  Card  Features  Name
>>>> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard] 
>>>> (0123456789ABCD) 00 00
>>>>
>>>> $ opensc-tool -a
>>>>
>>>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
>>>> (0123456789ABCD) 00 00
>>>> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
>>>>
>>>> $ opensc-tool -n
>>>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
>>>> (0123456789ABCD) 00 00
>>>> Failed to connect to card: Unresponsive card (correctly inserted?)
>>>>
>>>> ####
>>>>
>>>> pcsc_scan returns the same ATR (different format) and identifies it 
>>>> (via smartcard_list.txt) as: "NASA Personal Identity Verification 
>>>> (PIV) card (eID)".  (Note: this is a USG-issued card but not from 
>>>> NASA.)
>>>>
>>>> I would greatly appreciate any insight or advice anyone can offer!
>>>>
>>>> Thanks,
>>>>
>>>> ~ray
>>>
>>
>>
>> .
>

Re: [Opensc-devel] help with piv card

[Douglas E E. <dee...@gm...>]

Sounds like a physical contact problem between the reader and card. Have you
tried cleaning the contacts. a pencil eraser can be used.

You say the reader worked for years. Look at the contacts, dirty or bent?
You said: "and the new one works on Windows." I assume with a different reader?

Could also be power issue with new card needing more power then the old one.

Could be new card is a little out of spec, and does not make good contact
with old reader.

Google for: how to clean smart card reader

I would try another reader on the same machine too.




On 3/26/2020 4:04 PM, Ray Lambert wrote:
> On 3/26/20 8:05 AM, Douglas E Engert wrote:
>> What does `OPENSC_DEBUG=3 pkcs11-tool -O`
>>
>> Note PIV driver caches and parses the certificates early in the process
>> and would show if the card is dead, or if certificates can not be parsed.
>>
> Hi Douglas,
> 
> Thanks for the response.  Not sure if I should post the whole output to this list (it's ~20k, 147 lines)?
> 
> pcsc functions appear to be returning "-1113 (Unresponsive card (correctly inserted?))" consistently and the final error appears to be "CKR_DEVICE_ERROR (0x30)":
> 
> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] pkcs11-global.c:596:C_GetSlotInfo: C_GetSlotInfo() card detect rv 0x30
> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] pkcs11-global.c:613:C_GetSlotInfo: C_GetSlotInfo() flags 0x20
> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] pkcs11-global.c:614:C_GetSlotInfo: C_GetSlotInfo(0x0) = CKR_DEVICE_ERROR
> P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] pkcs11-global.c:365:C_Finalize: C_Finalize()
> 
> I've tried reinserting the card but no dice.  As I mentioned, the old card was working fine and the new one works on Windows.  It would be quite a coincidence if the card reader died at the same time 
> I got a new card(?).
> 
> Please LMK if you need more.
> 
> Thanks again!
> 
> ~ray
> 
> 
>>
>>
>> On 3/25/2020 6:53 PM, Ray Lambert wrote:
>>> Hi,
>>>
>>> I'm trying to get a new PIV card to work and hoping someone can help.
>>>
>>> The old card was working perfectly for some time with openconnect vpn, pcsc, and p11-kit on Manjaro (fully updated).
>>>
>>> The new card is recognized and the ATR is accessible but the card is not otherwise visible (no tokens).
>>>
>>> I recently installed opensc to try to get it work but the results are the same.  I was advised (on the OC mailing list) that a different pkcs#11 driver may be needed.
>>>
>>> The card type (according to ActivClient on Windows) is "ID-One Cosmo v8.0 128K with PIV 2.3.5" (Oberthur).
>>>
>>> opensc results are:
>>>
>>> ####
>>>
>>> $ opensc-tool -l
>>> # Detected readers (pcsc)
>>> Nr.  Card  Features  Name
>>> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard] (0123456789ABCD) 00 00
>>>
>>> $ opensc-tool -a
>>>
>>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] (0123456789ABCD) 00 00
>>> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
>>>
>>> $ opensc-tool -n
>>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] (0123456789ABCD) 00 00
>>> Failed to connect to card: Unresponsive card (correctly inserted?)
>>>
>>> ####
>>>
>>> pcsc_scan returns the same ATR (different format) and identifies it (via smartcard_list.txt) as: "NASA Personal Identity Verification (PIV) card (eID)".  (Note: this is a USG-issued card but not 
>>> from NASA.)
>>>
>>> I would greatly appreciate any insight or advice anyone can offer!
>>>
>>> Thanks,
>>>
>>> ~ray
>>
> 
> 
> .

-- 

  Douglas E. Engert  <DEE...@gm...>

Re: [Opensc-devel] help with piv card

[Ray L. <cod...@in...>]

Hi,

On 3/26/20 9:10 AM, Ludovic Rousseau wrote:
> Le jeu. 26 mars 2020 à 01:31, Ray Lambert <cod...@in...> a écrit :
>> Hi,
> Hello,
>
>> I'm trying to get a new PIV card to work and hoping someone can help.
>>
>> The old card was working perfectly for some time with openconnect vpn, pcsc,
>> and p11-kit on Manjaro (fully updated).
>>
>> The new card is recognized and the ATR is accessible but the card is not
>> otherwise visible (no tokens).
>>
>> I recently installed opensc to try to get it work but the results are the
>> same.  I was advised (on the OC mailing list) that a different pkcs#11 driver
>> may be needed.
>>
>> The card type (according to ActivClient on Windows) is "ID-One Cosmo v8.0
>> 128K with PIV 2.3.5" (Oberthur).
>>
>> opensc results are:
>>
>> ####
>>
>> $ opensc-tool -l
>> # Detected readers (pcsc)
>> Nr.  Card  Features  Name
>> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard]
>> (0123456789ABCD) 00 00
>>
>> $ opensc-tool -a
>>
>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard]
>> (0123456789ABCD) 00 00
>> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
>>
>> $ opensc-tool -n
>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard]
>> (0123456789ABCD) 00 00
>> Failed to connect to card: Unresponsive card (correctly inserted?)
> I don't know which "Broadcom Corp 5880"' reader you use. Broadcom has
> a lot of different readers all called 5880.
> See https://ccid.apdu.fr/select_readers/?any~5880
>
> Some of them are in the "Unsupported" list because they have issues.
>
> As Jelen wrote, an OpenSC debug log would help.
>
> BYe
>
The reader is built-in to a Dell E6500 laptop, so not sure.  But, as I 
mentioned, it worked perfectly for years with my old card.

Thanks,

~ray

Re: [Opensc-devel] help with piv card

[Ray L. <cod...@in...>]

On 3/26/20 8:05 AM, Douglas E Engert wrote:
> What does `OPENSC_DEBUG=3 pkcs11-tool -O`
>
> Note PIV driver caches and parses the certificates early in the process
> and would show if the card is dead, or if certificates can not be parsed.
>
Hi Douglas,

Thanks for the response.  Not sure if I should post the whole output to this 
list (it's ~20k, 147 lines)?

pcsc functions appear to be returning "-1113 (Unresponsive card (correctly 
inserted?))" consistently and the final error appears to be "CKR_DEVICE_ERROR 
(0x30)":

P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
pkcs11-global.c:596:C_GetSlotInfo: C_GetSlotInfo() card detect rv 0x30
P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
pkcs11-global.c:613:C_GetSlotInfo: C_GetSlotInfo() flags 0x20
P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
pkcs11-global.c:614:C_GetSlotInfo: C_GetSlotInfo(0x0) = CKR_DEVICE_ERROR
P:31787; T:0x140133000816448 16:53:07.536 [opensc-pkcs11] 
pkcs11-global.c:365:C_Finalize: C_Finalize()

I've tried reinserting the card but no dice.  As I mentioned, the old card 
was working fine and the new one works on Windows.  It would be quite a 
coincidence if the card reader died at the same time I got a new card(?).

Please LMK if you need more.

Thanks again!

~ray


>
>
> On 3/25/2020 6:53 PM, Ray Lambert wrote:
>> Hi,
>>
>> I'm trying to get a new PIV card to work and hoping someone can help.
>>
>> The old card was working perfectly for some time with openconnect vpn, 
>> pcsc, and p11-kit on Manjaro (fully updated).
>>
>> The new card is recognized and the ATR is accessible but the card is not 
>> otherwise visible (no tokens).
>>
>> I recently installed opensc to try to get it work but the results are the 
>> same.  I was advised (on the OC mailing list) that a different pkcs#11 
>> driver may be needed.
>>
>> The card type (according to ActivClient on Windows) is "ID-One Cosmo v8.0 
>> 128K with PIV 2.3.5" (Oberthur).
>>
>> opensc results are:
>>
>> ####
>>
>> $ opensc-tool -l
>> # Detected readers (pcsc)
>> Nr.  Card  Features  Name
>> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard] 
>> (0123456789ABCD) 00 00
>>
>> $ opensc-tool -a
>>
>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
>> (0123456789ABCD) 00 00
>> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
>>
>> $ opensc-tool -n
>> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
>> (0123456789ABCD) 00 00
>> Failed to connect to card: Unresponsive card (correctly inserted?)
>>
>> ####
>>
>> pcsc_scan returns the same ATR (different format) and identifies it (via 
>> smartcard_list.txt) as: "NASA Personal Identity Verification (PIV) card 
>> (eID)".  (Note: this is a USG-issued card but not from NASA.)
>>
>> I would greatly appreciate any insight or advice anyone can offer!
>>
>> Thanks,
>>
>> ~ray
>

Re: [Opensc-devel] help with piv card

[Ludovic R. <lud...@gm...>]

Le jeu. 26 mars 2020 à 01:31, Ray Lambert <cod...@in...> a écrit :
>
> Hi,

Hello,

> I'm trying to get a new PIV card to work and hoping someone can help.
>
> The old card was working perfectly for some time with openconnect vpn, pcsc,
> and p11-kit on Manjaro (fully updated).
>
> The new card is recognized and the ATR is accessible but the card is not
> otherwise visible (no tokens).
>
> I recently installed opensc to try to get it work but the results are the
> same.  I was advised (on the OC mailing list) that a different pkcs#11 driver
> may be needed.
>
> The card type (according to ActivClient on Windows) is "ID-One Cosmo v8.0
> 128K with PIV 2.3.5" (Oberthur).
>
> opensc results are:
>
> ####
>
> $ opensc-tool -l
> # Detected readers (pcsc)
> Nr.  Card  Features  Name
> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard]
> (0123456789ABCD) 00 00
>
> $ opensc-tool -a
>
> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard]
> (0123456789ABCD) 00 00
> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
>
> $ opensc-tool -n
> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard]
> (0123456789ABCD) 00 00
> Failed to connect to card: Unresponsive card (correctly inserted?)

I don't know which "Broadcom Corp 5880"' reader you use. Broadcom has
a lot of different readers all called 5880.
See https://ccid.apdu.fr/select_readers/?any~5880

Some of them are in the "Unsupported" list because they have issues.

As Jelen wrote, an OpenSC debug log would help.

BYe

-- 
 Dr. Ludovic Rousseau

Re: [Opensc-devel] help with piv card

[Jakub J. <jj...@re...>]

On Wed, 2020-03-25 at 19:53 -0400, Ray Lambert wrote:
> Hi,
> 
> I'm trying to get a new PIV card to work and hoping someone can help.
> 
> The old card was working perfectly for some time with openconnect
> vpn, pcsc, 
> and p11-kit on Manjaro (fully updated).
> 
> The new card is recognized and the ATR is accessible but the card is
> not 
> otherwise visible (no tokens).
> 
> I recently installed opensc to try to get it work but the results are
> the 
> same.  I was advised (on the OC mailing list) that a different
> pkcs#11 driver 
> may be needed.
> 
> The card type (according to ActivClient on Windows) is "ID-One Cosmo
> v8.0 
> 128K with PIV 2.3.5" (Oberthur).
> 
> opensc results are:
> 
> ####
> 
> $ opensc-tool -l
> # Detected readers (pcsc)
> Nr.  Card  Features  Name
> 0    Yes             Broadcom Corp 5880 [Contacted SmartCard] 
> (0123456789ABCD) 00 00
> 
> $ opensc-tool -a
> 
> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
> (0123456789ABCD) 00 00
> 3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9
> 
> $ opensc-tool -n
> Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
> (0123456789ABCD) 00 00
> Failed to connect to card: Unresponsive card (correctly inserted?)

We would probably have to see debug log from OpenSC, but unresponsive
card errors sound like issue of the reader or reader driver in pcsc, if
I remember well.

Regards,
-- 
Jakub Jelen
Senior Software Engineer
Security Technologies
Red Hat, Inc.

[Opensc-devel] help with piv card

[Ray L. <cod...@in...>]

Hi,

I'm trying to get a new PIV card to work and hoping someone can help.

The old card was working perfectly for some time with openconnect vpn, pcsc, 
and p11-kit on Manjaro (fully updated).

The new card is recognized and the ATR is accessible but the card is not 
otherwise visible (no tokens).

I recently installed opensc to try to get it work but the results are the 
same.  I was advised (on the OC mailing list) that a different pkcs#11 driver 
may be needed.

The card type (according to ActivClient on Windows) is "ID-One Cosmo v8.0 
128K with PIV 2.3.5" (Oberthur).

opensc results are:

####

$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Broadcom Corp 5880 [Contacted SmartCard] 
(0123456789ABCD) 00 00

$ opensc-tool -a

Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
(0123456789ABCD) 00 00
3b:d6:97:00:81:b1:fe:45:1f:07:80:31:c1:52:11:18:f9

$ opensc-tool -n
Using reader with a card: Broadcom Corp 5880 [Contacted SmartCard] 
(0123456789ABCD) 00 00
Failed to connect to card: Unresponsive card (correctly inserted?)

####

pcsc_scan returns the same ATR (different format) and identifies it (via 
smartcard_list.txt) as: "NASA Personal Identity Verification (PIV) card 
(eID)".  (Note: this is a USG-issued card but not from NASA.)

I would greatly appreciate any insight or advice anyone can offer!

Thanks,

~ray

Re: [Opensc-devel] Typical smartcard response times

[<md...@bt...>]

On Mon, 10 Feb 2020 21:36:18 +0100, Ludovic Rousseau wrote
> Have you tried what Peter wrote in a previous email:
> 1. using OPENSC_DEBUG=255 -> exact timing of APDUs
> 
> Compare a log generated on macOS with a log generated on Linux for the
> same command, like "pkcs11-tool -login -O"
> 
> It would be nice to known what parts are slower on macOS than on Linux.
> Maybe it is the APDU processing, maybe not.

Quick look shows APDU processing seems to be OK - also starting from 6 msec:

P:4574; T:0x140736015000448 08:01:24.955 [opensc-pkcs11] reader-pcsc.c:298:pcsc_transmit: 
Outgoing APDU (5 bytes):
00 B0 00 00 19 .....
P:4574; T:0x140736015000448 08:01:24.955 [opensc-pkcs11] reader-pcsc.c:216:pcsc_internal_transmit: called
P:4574; T:0x140736015000448 08:01:24.961 [opensc-pkcs11] reader-pcsc.c:307:pcsc_transmit: 
Incoming APDU (27 bytes):
A8 06 30 04 04 02 40 08 A0 06 30 04 04 02 40 00 ..0...@...0...@.
A4 06 30 04 04 02 40 04 00 90 00                ..0...@....
P:4574; T:0x140736015000448 08:01:24.962 [opensc-pkcs11] apdu.c:382:sc_single_transmit: returning with: 0 (Success)

Need to work on it further.

Thanks & kind regards,
MD

Re: [Opensc-devel] Typical smartcard response times

[Ludovic R. <lud...@gm...>]

Le lun. 10 févr. 2020 à 15:46, Marian Ďurkovič <md...@bt...> a écrit :
>
> Tested on Linux with the same HW and here it works much better:
>
> time pkcs11-tool -login -O
>
> real    0m6.766s
> user    0m0.064s
> sys    0m0.012s
>
> Time to complete PKCS#11 function only 72 msec (instead of 575 msec on MAC):
>
> 11: C_GetAttributeValue
> 2020-02-10 14:45:04.525
>
> 12: C_GetAttributeValue
> 2020-02-10 14:45:04.597
>
> APDU times starting from 6 msec
>
> OK, so it looks like MAC-specific problem...
> Any debugging possibilities on MAC?

Very interesting.

Have you tried what Peter wrote in a previous email:
1. using OPENSC_DEBUG=255 -> exact timing of APDUs

Compare a log generated on macOS with a log generated on Linux for the
same command, like "pkcs11-tool -login -O"

It would be nice to known what parts are slower on macOS than on Linux.
Maybe it is the APDU processing, maybe not.

Bye

-- 
 Dr. Ludovic Rousseau