giomba
/
opensc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
opensc/src/libopensc/pkcs15-syn.h

69 lines
3.0 KiB
C
Raw Normal View History

pkcs15: 'aid' argument for emulator init Allows to PKCS#15 emulator to bind more then one application
2016-04-05 17:44:37 +00:00
/*
* pkcs15-syn.c: PKCS #15 emulation of non-pkcs15 cards
*
* Copyright (C) 2003 Olaf Kirch <okir@suse.de>
* 2004 Nils Larsch <nlarsch@betrusted.com>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#ifndef PKCS15_SYN_H
#define PKCS15_SYN_H
#ifdef __cplusplus
extern "C" {
#endif
#include <libopensc/types.h>
#include <libopensc/pkcs15.h>
Remove unused sc_pkcs15emu_opt_t structure Only usage was removed SC_PKCS15EMU_FLAGS_NO_CHECK flag Signed-off-by: Raul Metsma <raul@metsma.ee>
2019-03-26 14:14:25 +00:00
int sc_pkcs15emu_westcos_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_openpgp_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_starcert_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_tcos_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_esteid_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
EstEID 2018+ driver This adds support for a minimalistic, small and fast card profile based on IAS-ECC. Based on information from https://installer.id.ee/media/id2019/TD-ID1-Chip-App.pdf and proprietary driver snoops. Thanks to @metsma and @frankmorgner. Change-Id: I2e4b4914d8a3b991d9a639728695abf4a2362ca0
2019-03-07 18:47:50 +00:00
int sc_pkcs15emu_esteid2018_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
Remove unused sc_pkcs15emu_opt_t structure Only usage was removed SC_PKCS15EMU_FLAGS_NO_CHECK flag Signed-off-by: Raul Metsma <raul@metsma.ee>
2019-03-26 14:14:25 +00:00
int sc_pkcs15emu_piv_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_cac_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_gemsafeGPK_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_gemsafeV1_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_actalis_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_atrust_acos_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_tccardos_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_entersafe_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_pteid_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_oberthur_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_itacns_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_sc_hsm_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_dnie_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_gids_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_iasecc_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_jpki_init_ex(sc_pkcs15_card_t *, struct sc_aid *);
int sc_pkcs15emu_coolkey_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
int sc_pkcs15emu_din_66291_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
Implement new Gemalto IDPrime driver The card is largely ISO 7816 compliant, but does not provide any simple way of listing the content which is supported by current PKCS#15 implementation therefore the PKCS#15 emulator had to be used. The certificates are compressed in a similar way as in DNIE cards which complicates reading from the card and which I think could be moved to the shared ISO (or some other file since I saw that code already many times). The card supports wide range of algorithms including RSA-PSS and RSA-OAEP padding schemes in-card. On the other hand, it does not allow raw RSA and SHA1 hashes on card anymore. The card is manufactured by Gemalto so it has strict ATR which can be used for detection.
2019-08-12 13:26:18 +00:00
int sc_pkcs15emu_idprime_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
Various CardOS V5_* improvements Treat CardOS V5_0 and V5_3 cards differently then older versions: Use card->dvr_data as a pointer to cardos_data_t to store private driver data to pass internally, especially between set security environment and the crypto operations. Sc_get_encoding_flags sets sec_flags from algo_info->flags in pkcs15-sec.c and it passed to decipher. Some cards when doing a decipher may drop leading 00 byte when returning data from RSA_RAW decipher. Add leading byte(s) as needed. Get Cryptographic Mechanism Reference from Key Reference: Key reference byte appears to be a 4 bit Cryptographic Mechanism Reference and a 4 bit key reference. This is only done if key reference & 0xF0 != 0 i.e. default Cryptographic mechanism reference is 0. which appears to be the case for RSA RAW. PKCS1 appears to be 0x10 and ECDSA 0x30 See iso 7816-4 table 55 for DST: 84 Reference of a private key 95 Usage qualifier byte - Table 57 - 40 looks OK 80 Cryptographic mechanism reference and referes to section 9.2 The 4 bit key reference limits card to 16 keys. In future this may not work, but we can derive a Cryptographic Mechanism Reference from what OpenSC thinks the card needs to do. Only know RSA RAW, PKCS1 and ECDSA. ECDSA code has not been tested, but expected to work. Allow setting CardOS type and flags from opensc.conf using card_atr stanza This is a fallback if newer cards are added or older cards have problems giving us time to make need changes in next release. It will help in identifying what flags are needed for each card. As user can report what combination of flags work for them. They do this by adding to opensc.conf with something like this. (Change the ATR to your card's ATR): card_atr 3b:d2:18:00:81:31:fe:58:c9:03:16 { driver = "cardos"; # type is decimal from cards.h: # SC_CARD_TYPE_CARDOS_V5_0 is 1009 # SC_CARD_TYPE_CARDOS_V5_3 is 1010 type = 1010; # flags is hex from opensc.h: #define SC_ALGORITHM_ONBOARD_KEY_GEN 0x80000000 #define SC_ALGORITHM_NEED_USAGE 0x40000000 #define SC_ALGORITHM_RSA_RAW 0x00000001 /* RSA_RAW is PAD_NONE */ #define SC_ALGORITHM_RSA_PAD_NONE 0x00000001 #define SC_ALGORITHM_RSA_PAD_PKCS1 0x00000002 /* PKCS#1 v1.5 padding */ #define SC_ALGORITHM_RSA_PAD_ANSI 0x00000004 #define SC_ALGORITHM_RSA_PAD_ISO9796 0x00000008 #define SC_ALGORITHM_RSA_PAD_PSS 0x00000010 /* PKCS#1 v2.0 PSS */ #define SC_ALGORITHM_RSA_PAD_OAEP 0x00000020 /* PKCS#1 v2.0 OAEP */ #define SC_ALGORITHM_RSA_HASH_NONE 0x00000100 /* only applies to PKCS1 padding */ # example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_HASH_NONE | SC_ALGORITHM_RSA_RAW flags = 80000101; #example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_PAD_PKCS1 flags = 80000002; } For V5_0 and v5_3 cards, use sc_get_max_send_size and sc_get_max_recv_size which takes care or reader sizes even on Windows where SCardControl can not get PART_10 sizes. (commit eddea6f3c2d3dafc2c09eba6695c745a61b5186f on Windows forces reader sizes to 255, 256 in reader-pcsc.c if not already set. It should not do this, but leave that up to card drivers.) pkcs15-cardos.c added: New file, pkcs15-cardos.c, added as emulation only for CardOS V5_0 and V5_3 cards. sc_pkcs15_bind_internal is called to get tokenInfo as CardOS cards are substantially PKCS15 cards. But some V5_* cards have errors in the tokenInfo, Which are corrected. For older CardOS cards, card-cardos.c will create all the card->algorithms. Pkcs15-cardos.c will check for card->algorithms and if there are none, it will do the following: SC_CARDCTL_CARDOS_PASS_ALGO_FLAGS is called twice. First to get the flags as set by user via opensc.conf card_atr or default flags set by the card driver. Then after determining from the tokenInfo what algorithms the card can support, the new flags are passed to card_cardos.c to create card->algorithms. https://atos.net/wp-content/uploads/2018/11/CT_181026_LPM_CardOS_V5-3_Multifunctionality_FS_en3_web.pdf says card supports: "“Command chaining” in accordance with ISO/IEC 7816-4" To take advantage of this with older readers, max_send_size and max_recv_size is now based on minimum of reader limits and "data_field_length" from card. This should allow card to work in older readers not capable of extended APDU. So far current cards we have seen do no appear to support “Command chaining”. Changes to be committed: modified: src/libopensc/Makefile.am modified: src/libopensc/Makefile.mak modified: src/libopensc/card-cardos.c modified: src/libopensc/cardctl.h modified: src/libopensc/cards.h new file: src/libopensc/pkcs15-cardos.c modified: src/libopensc/pkcs15-syn.c modified: src/libopensc/pkcs15-syn.h
2020-04-17 16:36:48 +00:00
int sc_pkcs15emu_cardos_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *);
pkcs15: 'aid' argument for emulator init Allows to PKCS#15 emulator to bind more then one application
2016-04-05 17:44:37 +00:00
struct sc_pkcs15_emulator_handler {
const char *name;
Remove unused sc_pkcs15emu_opt_t structure Only usage was removed SC_PKCS15EMU_FLAGS_NO_CHECK flag Signed-off-by: Raul Metsma <raul@metsma.ee>
2019-03-26 14:14:25 +00:00
int (*handler)(sc_pkcs15_card_t *, struct sc_aid *);
pkcs15: 'aid' argument for emulator init Allows to PKCS#15 emulator to bind more then one application
2016-04-05 17:44:37 +00:00
};
#ifdef __cplusplus
}
#endif
#endif