2007-11-12 10:18:54 +00:00
|
|
|
/*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
* License along with this library; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/* Initially written by David Mattes (david.mattes@boeing.com) */
|
2009-10-03 14:41:14 +00:00
|
|
|
/* Portuguese eID card support by Joao Poupino (joao.poupino@ist.utl.pt) */
|
2007-11-13 07:52:43 +00:00
|
|
|
|
2015-04-22 21:55:33 +00:00
|
|
|
#if HAVE_CONFIG_H
|
2010-03-04 08:14:36 +00:00
|
|
|
#include "config.h"
|
2015-04-22 21:55:33 +00:00
|
|
|
#endif
|
2010-03-04 08:14:36 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
|
2010-03-04 08:14:36 +00:00
|
|
|
#include "internal.h"
|
|
|
|
|
#include "asn1.h"
|
|
|
|
|
#include "cardctl.h"
|
|
|
|
|
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
#define GEMSAFEV1_ALG_REF_FREEFORM 0x12
|
|
|
|
|
#define GEMSAFEV3_ALG_REF_FREEFORM 0x02
|
|
|
|
|
#define GEMSAFEV3_ALG_REF_SHA1 0x12
|
|
|
|
|
#define GEMSAFEV3_ALG_REF_SHA256 0x42
|
2019-11-26 18:04:23 +00:00
|
|
|
#define MAX_RESP_BUFFER_SIZE 2048
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
static struct sc_card_operations gemsafe_ops;
|
|
|
|
|
static struct sc_card_operations *iso_ops = NULL;
|
|
|
|
|
|
|
|
|
|
static struct sc_card_driver gemsafe_drv = {
|
2016-06-21 11:48:29 +00:00
|
|
|
"Gemalto GemSafe V1 applet",
|
2007-11-12 10:18:54 +00:00
|
|
|
"gemsafeV1",
|
|
|
|
|
&gemsafe_ops,
|
|
|
|
|
NULL, 0, NULL
|
|
|
|
|
};
|
|
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
/* Known ATRs */
|
2018-08-22 15:01:51 +00:00
|
|
|
static const struct sc_atr_table gemsafe_atrs[] = {
|
2009-10-03 14:41:14 +00:00
|
|
|
/* standard version */
|
|
|
|
|
{"3B:7B:94:00:00:80:65:B0:83:01:01:74:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
|
|
|
|
{"3B:6B:00:00:80:65:B0:83:01:01:74:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
2010-01-19 13:11:21 +00:00
|
|
|
/* GemSafeXpresso 32K */
|
|
|
|
|
{"3b:6d:00:00:80:31:80:65:b0:83:01:02:90:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
2009-10-03 14:41:14 +00:00
|
|
|
/* fips 140 version */
|
|
|
|
|
{"3B:6B:00:00:80:65:B0:83:01:03:74:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
|
|
|
|
/* Undefined */
|
|
|
|
|
{"3B:7A:94:00:00:80:65:A2:01:01:01:3D:72:D6:43", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
|
|
|
|
{"3B:7D:94:00:00:80:31:80:65:B0:83:01:01:90:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
2012-11-20 17:03:45 +00:00
|
|
|
{"3B:7D:96:00:00:80:31:80:65:B0:83:11:48:C8:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_GENERIC, 0, NULL},
|
2009-10-03 14:41:14 +00:00
|
|
|
/* Portuguese eID cards */
|
|
|
|
|
{"3B:7D:95:00:00:80:31:80:65:B0:83:11:C0:A9:83:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
|
|
|
|
{"3B:7D:95:00:00:80:31:80:65:B0:83:11:C0:A9:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
2010-10-05 16:10:35 +00:00
|
|
|
{"3B:7D:95:00:00:80:31:80:65:B0:83:11:00:C8:83:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
|
|
|
|
{"3B:7D:95:00:00:80:31:80:65:B0:83:11:00:C8:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
2019-05-24 12:57:23 +00:00
|
|
|
{"3B:FF:96:00:00:81:31:80:43:80:31:80:65:B0:85:03:00:EF:12:0F:FF:82:90:00:67", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
|
|
|
|
{"3B:FF:96:00:00:81:31:FE:43:80:31:80:65:B0:85:04:01:20:12:0F:FF:82:90:00:D0", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_PTEID, 0, NULL},
|
2013-12-02 11:50:51 +00:00
|
|
|
/* Swedish eID card */
|
|
|
|
|
{"3B:7D:96:00:00:80:31:80:65:B0:83:11:00:C8:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_SEEID, 0, NULL},
|
2015-10-01 14:27:00 +00:00
|
|
|
/* European Patent Office epoline card*/
|
|
|
|
|
{"3b:7d:96:00:00:80:31:80:65:b0:83:02:01:f3:83:00:90:00", NULL, NULL, SC_CARD_TYPE_GEMSAFEV1_SEEID, 0, NULL},
|
2009-10-03 14:41:14 +00:00
|
|
|
{NULL, NULL, NULL, 0, 0, NULL}
|
2007-11-12 10:18:54 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static const u8 gemsafe_def_aid[] = {0xA0, 0x00, 0x00, 0x00, 0x18, 0x0A,
|
|
|
|
|
0x00, 0x00, 0x01, 0x63, 0x42, 0x00};
|
2009-10-03 14:41:14 +00:00
|
|
|
|
|
|
|
|
static const u8 gemsafe_pteid_aid[] = {0x60, 0x46, 0x32, 0xFF, 0x00, 0x00, 0x02};
|
|
|
|
|
|
2013-12-02 11:50:51 +00:00
|
|
|
static const u8 gemsafe_seeid_aid[] = {0xA0, 0x00, 0x00, 0x00, 0x18, 0x0C,
|
|
|
|
|
0x00, 0x00, 0x01, 0x63, 0x42, 0x00};
|
|
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
/*
|
|
|
|
|
static const u8 gemsafe_def_aid[] = {0xA0, 0x00, 0x00, 0x00, 0x63, 0x50,
|
|
|
|
|
0x4B, 0x43, 0x53, 0x2D, 0x31, 0x35};
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
typedef struct gemsafe_exdata_st {
|
|
|
|
|
u8 aid[16];
|
|
|
|
|
size_t aid_len;
|
|
|
|
|
} gemsafe_exdata;
|
|
|
|
|
|
|
|
|
|
static int get_conf_aid(sc_card_t *card, u8 *aid, size_t *len)
|
|
|
|
|
{
|
|
|
|
|
sc_context_t *ctx = card->ctx;
|
|
|
|
|
scconf_block *conf_block, **blocks;
|
|
|
|
|
int i;
|
|
|
|
|
const char *str_aid;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
conf_block = NULL;
|
|
|
|
|
for (i = 0; ctx->conf_blocks[i] != NULL; i++) {
|
|
|
|
|
blocks = scconf_find_blocks(ctx->conf, ctx->conf_blocks[i],
|
|
|
|
|
"card", "gemsafeV1");
|
2017-04-20 19:08:49 +00:00
|
|
|
if (blocks != NULL && blocks[0] != NULL)
|
2007-11-12 10:18:54 +00:00
|
|
|
conf_block = blocks[0];
|
|
|
|
|
free(blocks);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!conf_block) {
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "no card specific options configured, trying default AID\n");
|
2007-11-12 10:18:54 +00:00
|
|
|
return SC_ERROR_INTERNAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
str_aid = scconf_get_str(conf_block, "aid", NULL);
|
|
|
|
|
if (!str_aid) {
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "no aid configured, trying default AID\n");
|
2007-11-12 10:18:54 +00:00
|
|
|
return SC_ERROR_INTERNAL;
|
|
|
|
|
}
|
|
|
|
|
return sc_hex_to_bin(str_aid, aid, len);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gp_select_applet(sc_card_t *card, const u8 *aid, size_t aid_len)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
2019-11-26 18:04:23 +00:00
|
|
|
u8 buf[MAX_RESP_BUFFER_SIZE];
|
2007-11-12 10:18:54 +00:00
|
|
|
struct sc_context *ctx = card->ctx;
|
|
|
|
|
struct sc_apdu apdu;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, 0xa4, 0x04, 0x00);
|
|
|
|
|
apdu.lc = aid_len;
|
|
|
|
|
apdu.data = aid;
|
|
|
|
|
apdu.datalen = aid_len;
|
|
|
|
|
apdu.resp = buf;
|
|
|
|
|
apdu.le = 256;
|
|
|
|
|
apdu.resplen = sizeof(buf);
|
|
|
|
|
|
|
|
|
|
r = sc_transmit_apdu(card, &apdu);
|
2018-11-23 20:54:14 +00:00
|
|
|
LOG_TEST_RET(ctx, r, "APDU transmit failed");
|
2007-11-12 10:18:54 +00:00
|
|
|
r = sc_check_sw(card, apdu.sw1, apdu.sw2);
|
|
|
|
|
if (r)
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, r);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
return SC_SUCCESS;
|
|
|
|
|
}
|
|
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
static int gemsafe_match_card(sc_card_t *card)
|
2007-11-12 10:18:54 +00:00
|
|
|
{
|
2009-10-03 14:41:14 +00:00
|
|
|
int i;
|
2007-11-12 10:18:54 +00:00
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
i = _sc_match_atr(card, gemsafe_atrs, &card->type);
|
|
|
|
|
if (i < 0)
|
2007-11-12 10:18:54 +00:00
|
|
|
return 0;
|
2007-11-13 07:52:43 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_init(struct sc_card *card)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
gemsafe_exdata *exdata = NULL;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
card->name = "GemSAFE V1";
|
|
|
|
|
card->cla = 0x00;
|
|
|
|
|
|
|
|
|
|
exdata = (gemsafe_exdata *)calloc(1, sizeof(gemsafe_exdata));
|
|
|
|
|
if (!exdata)
|
|
|
|
|
return SC_ERROR_OUT_OF_MEMORY;
|
|
|
|
|
exdata->aid_len = sizeof(exdata->aid);
|
2009-10-03 14:41:14 +00:00
|
|
|
if(card->type == SC_CARD_TYPE_GEMSAFEV1_GENERIC) {
|
|
|
|
|
/* try to get a AID from the config file */
|
|
|
|
|
r = get_conf_aid(card, exdata->aid, &exdata->aid_len);
|
|
|
|
|
if (r < 0) {
|
|
|
|
|
/* failed, use default value */
|
|
|
|
|
memcpy(exdata->aid, gemsafe_def_aid, sizeof(gemsafe_def_aid));
|
|
|
|
|
exdata->aid_len = sizeof(gemsafe_def_aid);
|
|
|
|
|
}
|
|
|
|
|
} else if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID) {
|
|
|
|
|
memcpy(exdata->aid, gemsafe_pteid_aid, sizeof(gemsafe_pteid_aid));
|
|
|
|
|
exdata->aid_len = sizeof(gemsafe_pteid_aid);
|
2013-12-02 11:50:51 +00:00
|
|
|
} else if (card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
|
2018-05-18 21:49:29 +00:00
|
|
|
memcpy(exdata->aid, gemsafe_seeid_aid, sizeof(gemsafe_seeid_aid));
|
|
|
|
|
exdata->aid_len = sizeof(gemsafe_seeid_aid);
|
|
|
|
|
}
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
/* increase lock_count here to prevent sc_unlock to select
|
|
|
|
|
* applet twice in gp_select_applet */
|
|
|
|
|
card->lock_count++;
|
|
|
|
|
/* SELECT applet */
|
|
|
|
|
r = gp_select_applet(card, exdata->aid, exdata->aid_len);
|
|
|
|
|
if (r < 0) {
|
|
|
|
|
free(exdata);
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(card->ctx, "applet selection failed\n");
|
2018-05-18 21:49:29 +00:00
|
|
|
return SC_ERROR_INVALID_CARD;
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
card->lock_count--;
|
|
|
|
|
|
|
|
|
|
/* set the supported algorithm */
|
2019-05-25 09:50:33 +00:00
|
|
|
unsigned long flags;
|
|
|
|
|
|
|
|
|
|
flags = SC_ALGORITHM_RSA_PAD_PKCS1;
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_PAD_ISO9796;
|
|
|
|
|
flags |= SC_ALGORITHM_ONBOARD_KEY_GEN;
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_HASH_NONE;
|
|
|
|
|
|
|
|
|
|
/* GemSAFE V3 cards support SHA256 */
|
|
|
|
|
if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
|
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID)
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_HASH_SHA256;
|
|
|
|
|
|
|
|
|
|
_sc_card_add_rsa_alg(card, 512, flags, 0);
|
|
|
|
|
_sc_card_add_rsa_alg(card, 768, flags, 0);
|
|
|
|
|
_sc_card_add_rsa_alg(card, 1024, flags, 0);
|
|
|
|
|
_sc_card_add_rsa_alg(card, 2048, flags, 0);
|
2019-11-21 15:33:03 +00:00
|
|
|
_sc_card_add_rsa_alg(card, 3072, flags, 0);
|
|
|
|
|
_sc_card_add_rsa_alg(card, 4096, flags, 0);
|
2019-05-25 09:50:33 +00:00
|
|
|
|
|
|
|
|
/* fake algorithm to persuade register_mechanisms()
|
|
|
|
|
* to register these hashes */
|
|
|
|
|
if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
|
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
|
|
|
|
|
flags = SC_ALGORITHM_RSA_HASH_SHA1;
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_HASH_MD5;
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_HASH_MD5_SHA1;
|
|
|
|
|
flags |= SC_ALGORITHM_RSA_HASH_RIPEMD160;
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
_sc_card_add_rsa_alg(card, 512, flags, 0);
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-21 11:49:06 +00:00
|
|
|
card->caps |= SC_CARD_CAP_ISO7816_PIN_INFO;
|
2007-11-12 10:18:54 +00:00
|
|
|
card->drv_data = exdata;
|
|
|
|
|
|
2018-05-18 21:49:29 +00:00
|
|
|
return SC_SUCCESS;
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_finish(sc_card_t *card)
|
|
|
|
|
{
|
|
|
|
|
gemsafe_exdata *exdata = (gemsafe_exdata *)card->drv_data;
|
|
|
|
|
|
|
|
|
|
if (exdata)
|
|
|
|
|
free(exdata);
|
|
|
|
|
return SC_SUCCESS;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_select_file(struct sc_card *card, const struct sc_path *path,
|
|
|
|
|
struct sc_file **file_out)
|
|
|
|
|
{
|
|
|
|
|
/* so far just call the iso select file (but this will change) */
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
return iso_ops->select_file(card, path, file_out);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_sc2acl(sc_file_t *file, unsigned ops, u8 sc_byte)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
unsigned int meth = 0;
|
|
|
|
|
|
|
|
|
|
if (sc_byte == 0xff) {
|
|
|
|
|
r = sc_file_add_acl_entry(file, ops, SC_AC_NEVER, 0);
|
|
|
|
|
return r;
|
|
|
|
|
}
|
|
|
|
|
if (sc_byte == 0x00) {
|
|
|
|
|
r = sc_file_add_acl_entry(file, ops, SC_AC_NONE, 0);
|
|
|
|
|
return r;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* XXX: OR combination of access rights are currently not supported
|
|
|
|
|
* hence ignored */
|
|
|
|
|
if (sc_byte & 0x40)
|
|
|
|
|
meth |= SC_AC_PRO;
|
|
|
|
|
if (sc_byte & 0x20)
|
|
|
|
|
meth |= SC_AC_AUT | SC_AC_TERM;
|
|
|
|
|
if (sc_byte & 0x10)
|
|
|
|
|
meth |= SC_AC_CHV;
|
2007-11-13 07:52:43 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
return sc_file_add_acl_entry(file, ops, meth, sc_byte & 0x0f);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_setacl(sc_card_t *card, sc_file_t *file, const u8 *data,
|
|
|
|
|
int is_df)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
u8 cond;
|
|
|
|
|
const u8 *p = data + 1;
|
|
|
|
|
struct sc_context *ctx = card->ctx;
|
|
|
|
|
|
|
|
|
|
if (is_df) {
|
|
|
|
|
if (*data & 0x04) /* CREATE DF */
|
|
|
|
|
cond = *p++;
|
|
|
|
|
else
|
|
|
|
|
cond = 0xff;
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2010-03-15 12:17:13 +00:00
|
|
|
"DF security byte CREATE DF: %02x\n", cond);
|
2007-11-12 10:18:54 +00:00
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_CREATE, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
if (*data & 0x02) /* CREATE EF */
|
|
|
|
|
cond = *p;
|
|
|
|
|
else
|
|
|
|
|
cond = 0xff;
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2010-03-15 12:17:13 +00:00
|
|
|
"DF security byte CREATE EF: %02x\n", cond);
|
2007-11-12 10:18:54 +00:00
|
|
|
/* XXX: opensc doesn't currently separate access conditions for
|
|
|
|
|
* CREATE EF and CREATE DF, this should be changed */
|
|
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_CREATE, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
} else {
|
|
|
|
|
/* XXX: ACTIVATE FILE and DEACTIVATE FILE ac are currently not
|
|
|
|
|
* supported => ignore them */
|
|
|
|
|
if (*data & 0x02) /* UPDATE BINARY, ERASE BINARY */
|
|
|
|
|
cond = *p++;
|
|
|
|
|
else
|
|
|
|
|
cond = 0xff;
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2010-03-15 12:17:13 +00:00
|
|
|
"EF security byte UPDATE/ERASE BINARY: %02x\n", cond);
|
2007-11-12 10:18:54 +00:00
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_UPDATE, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_WRITE, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_ERASE, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
if (*data & 0x01) /* READ BINARY */
|
|
|
|
|
cond = *p;
|
|
|
|
|
else
|
|
|
|
|
cond = 0xff;
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2010-03-15 12:17:13 +00:00
|
|
|
"EF security byte READ BINARY: %02x\n", cond);
|
2007-11-12 10:18:54 +00:00
|
|
|
r = gemsafe_sc2acl(file, SC_AC_OP_READ, cond);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return SC_SUCCESS;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_process_fci(struct sc_card *card, struct sc_file *file,
|
|
|
|
|
const u8 *buf, size_t len)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
size_t tlen;
|
|
|
|
|
const u8 *tag = NULL, *p = buf;
|
|
|
|
|
const char *type;
|
|
|
|
|
struct sc_context *ctx = card->ctx;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
r = iso_ops->process_fci(card, file, buf, len);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
return r;
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2010-03-15 12:17:13 +00:00
|
|
|
"processing GemSAFE V1 specific FCI information\n");
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
tag = sc_asn1_find_tag(ctx, p, len, 0x82, &tlen);
|
|
|
|
|
if (!tag) {
|
|
|
|
|
/* no FDB => we have a DF */
|
|
|
|
|
type = "DF";
|
|
|
|
|
file->type = SC_FILE_TYPE_DF;
|
|
|
|
|
} else {
|
|
|
|
|
type = "EF";
|
|
|
|
|
file->type = SC_FILE_TYPE_WORKING_EF;
|
|
|
|
|
}
|
|
|
|
|
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "file type: %s\n", type);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
tag = sc_asn1_find_tag(ctx, p, len, 0x8C, &tlen);
|
|
|
|
|
if (tag) {
|
2008-09-10 12:44:40 +00:00
|
|
|
r = gemsafe_setacl(card, file, tag, strcmp(type, "DF") ? 0 : 1);
|
2007-11-12 10:18:54 +00:00
|
|
|
if (r < 0) {
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "unable to set ACL\n");
|
2007-11-12 10:18:54 +00:00
|
|
|
return SC_ERROR_INTERNAL;
|
|
|
|
|
}
|
|
|
|
|
} else
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "error: AM and SC bytes missing\n");
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
return SC_SUCCESS;
|
|
|
|
|
}
|
|
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
static u8 gemsafe_flags2algref(struct sc_card *card, const struct sc_security_env *env)
|
2007-11-12 10:18:54 +00:00
|
|
|
{
|
|
|
|
|
u8 ret = 0;
|
|
|
|
|
|
|
|
|
|
if (env->operation == SC_SEC_OPERATION_SIGN) {
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
if (env->algorithm_flags & SC_ALGORITHM_RSA_HASH_SHA256)
|
|
|
|
|
ret = GEMSAFEV3_ALG_REF_SHA256;
|
|
|
|
|
else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
|
2013-12-02 11:50:51 +00:00
|
|
|
ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ?
|
|
|
|
|
GEMSAFEV3_ALG_REF_FREEFORM :
|
|
|
|
|
GEMSAFEV1_ALG_REF_FREEFORM;
|
2007-11-12 10:18:54 +00:00
|
|
|
else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_ISO9796)
|
|
|
|
|
ret = 0x11;
|
|
|
|
|
} else if (env->operation == SC_SEC_OPERATION_DECIPHER) {
|
|
|
|
|
if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
|
2013-12-02 11:50:51 +00:00
|
|
|
ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ?
|
|
|
|
|
GEMSAFEV3_ALG_REF_FREEFORM :
|
|
|
|
|
GEMSAFEV1_ALG_REF_FREEFORM;
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_restore_security_env(struct sc_card *card, int se_num)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
struct sc_apdu apdu;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_1, 0x22, 0x73, (u8) se_num);
|
|
|
|
|
|
|
|
|
|
r = sc_transmit_apdu(card, &apdu);
|
2018-11-23 20:54:14 +00:00
|
|
|
LOG_TEST_RET(card->ctx, r, "APDU transmit failed");
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
return sc_check_sw(card, apdu.sw1, apdu.sw2);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static int gemsafe_set_security_env(struct sc_card *card,
|
|
|
|
|
const struct sc_security_env *env,
|
|
|
|
|
int se_num)
|
|
|
|
|
{
|
2009-06-28 07:25:47 +00:00
|
|
|
u8 alg_ref;
|
|
|
|
|
struct sc_security_env se_env = *env;
|
2007-11-12 10:18:54 +00:00
|
|
|
struct sc_context *ctx = card->ctx;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
2009-06-28 07:25:47 +00:00
|
|
|
if (!(se_env.flags & SC_SEC_ENV_ALG_REF_PRESENT)) {
|
|
|
|
|
/* set the algorithm reference */
|
2009-10-03 14:41:14 +00:00
|
|
|
alg_ref = gemsafe_flags2algref(card, &se_env);
|
2009-06-28 07:25:47 +00:00
|
|
|
if (alg_ref) {
|
|
|
|
|
se_env.algorithm_ref = alg_ref;
|
|
|
|
|
se_env.flags |= SC_SEC_ENV_ALG_REF_PRESENT;
|
|
|
|
|
}
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
2009-06-28 07:25:47 +00:00
|
|
|
if (!(se_env.flags & SC_SEC_ENV_ALG_REF_PRESENT))
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx, "unknown algorithm flags '%x'\n", se_env.algorithm_flags);
|
2007-11-13 07:52:43 +00:00
|
|
|
|
2009-06-28 07:25:47 +00:00
|
|
|
se_env.flags &= ~SC_SEC_ENV_FILE_REF_PRESENT;
|
|
|
|
|
return iso_ops->set_security_env(card, &se_env, se_num);
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_compute_signature(struct sc_card *card, const u8 * data,
|
|
|
|
|
size_t data_len, u8 * out, size_t outlen)
|
|
|
|
|
{
|
2009-11-16 20:35:15 +00:00
|
|
|
int r, len;
|
2007-11-12 10:18:54 +00:00
|
|
|
struct sc_apdu apdu;
|
2019-11-26 18:04:23 +00:00
|
|
|
u8 rbuf[MAX_RESP_BUFFER_SIZE];
|
|
|
|
|
u8 sbuf[MAX_RESP_BUFFER_SIZE];
|
2007-11-12 10:18:54 +00:00
|
|
|
sc_context_t *ctx = card->ctx;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
card-gemsafeV1: Support signing SHA256
GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.
GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.
This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.
Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.
However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:
if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
rsa_flags |= SC_ALGORITHM_RSA_HASHES;
}
We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.
We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.
The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:
num = card->algorithm_count;
while (num--) {
switch (alg_info->algorithm) {
case SC_ALGORITHM_RSA:
rsa_flags |= alg_info->flags;
break;
}
}
So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
2015-10-03 09:55:55 +00:00
|
|
|
/* the card can sign 36 bytes of free form data */
|
2007-11-12 10:18:54 +00:00
|
|
|
if (data_len > 36) {
|
2018-11-22 08:31:29 +00:00
|
|
|
sc_log(ctx,
|
2017-03-14 19:02:30 +00:00
|
|
|
"error: input data too long: %"SC_FORMAT_LEN_SIZE_T"u bytes\n",
|
|
|
|
|
data_len);
|
2007-11-12 10:18:54 +00:00
|
|
|
return SC_ERROR_INVALID_ARGUMENTS;
|
|
|
|
|
}
|
|
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
/* the Portuguese eID card requires a two-phase exchange */
|
2013-12-02 11:50:51 +00:00
|
|
|
/* and so does the Swedish one */
|
|
|
|
|
if(card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
|
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
|
2009-10-03 14:41:14 +00:00
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, 0x2A, 0x90, 0xA0);
|
|
|
|
|
} else {
|
|
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, 0x2A, 0x9E, 0xAC);
|
|
|
|
|
apdu.cla |= 0x80;
|
|
|
|
|
apdu.resp = rbuf;
|
|
|
|
|
apdu.resplen = sizeof(rbuf);
|
|
|
|
|
apdu.le = 256;
|
|
|
|
|
}
|
2007-11-12 10:18:54 +00:00
|
|
|
/* we sign a digestInfo object => tag 0x90 */
|
|
|
|
|
sbuf[0] = 0x90;
|
|
|
|
|
sbuf[1] = (u8)data_len;
|
|
|
|
|
memcpy(sbuf + 2, data, data_len);
|
|
|
|
|
apdu.data = sbuf;
|
|
|
|
|
apdu.lc = data_len + 2;
|
|
|
|
|
apdu.datalen = data_len + 2;
|
|
|
|
|
|
|
|
|
|
r = sc_transmit_apdu(card, &apdu);
|
2018-11-23 20:54:14 +00:00
|
|
|
LOG_TEST_RET(card->ctx, r, "APDU transmit failed");
|
2007-11-12 10:18:54 +00:00
|
|
|
if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) {
|
2013-12-02 11:50:51 +00:00
|
|
|
if(card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
|
|
|
|
|
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
|
2009-10-03 14:41:14 +00:00
|
|
|
/* finalize the exchange */
|
|
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, 0x2A, 0x9E, 0x9A);
|
|
|
|
|
apdu.le = 128; /* 1024 bit keys */
|
|
|
|
|
apdu.resp = rbuf;
|
|
|
|
|
apdu.resplen = sizeof(rbuf);
|
2013-12-02 11:50:51 +00:00
|
|
|
if(card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
|
|
|
|
|
/* cla 0x80 not supported */
|
|
|
|
|
apdu.cla = 0x00;
|
|
|
|
|
}
|
2009-10-03 14:41:14 +00:00
|
|
|
r = sc_transmit_apdu(card, &apdu);
|
2018-11-23 20:54:14 +00:00
|
|
|
LOG_TEST_RET(card->ctx, r, "APDU transmit failed");
|
2009-10-03 14:41:14 +00:00
|
|
|
if(apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, sc_check_sw(card, apdu.sw1, apdu.sw2));
|
2009-10-03 14:41:14 +00:00
|
|
|
}
|
2009-11-16 20:35:15 +00:00
|
|
|
len = apdu.resplen > outlen ? outlen : apdu.resplen;
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
memcpy(out, apdu.resp, len);
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, len);
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, sc_check_sw(card, apdu.sw1, apdu.sw2));
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int gemsafe_decipher(struct sc_card *card, const u8 * crgram,
|
|
|
|
|
size_t crgram_len, u8 *out, size_t outlen)
|
|
|
|
|
{
|
|
|
|
|
int r;
|
|
|
|
|
struct sc_apdu apdu;
|
2019-11-26 18:04:23 +00:00
|
|
|
u8 rbuf[MAX_RESP_BUFFER_SIZE];
|
2007-11-12 10:18:54 +00:00
|
|
|
sc_context_t *ctx = card->ctx;
|
|
|
|
|
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
|
2007-11-12 10:18:54 +00:00
|
|
|
if (crgram_len > 255)
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_ARGUMENTS);
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, 0x2A, 0x80, 0x84);
|
|
|
|
|
apdu.cla |= 0x80;
|
|
|
|
|
apdu.resp = rbuf;
|
|
|
|
|
apdu.resplen = sizeof(rbuf);
|
|
|
|
|
apdu.le = crgram_len;
|
2007-11-13 07:52:43 +00:00
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
apdu.data = crgram;
|
|
|
|
|
apdu.lc = crgram_len;
|
|
|
|
|
apdu.datalen = crgram_len;
|
|
|
|
|
r = sc_transmit_apdu(card, &apdu);
|
2018-11-23 20:54:14 +00:00
|
|
|
LOG_TEST_RET(card->ctx, r, "APDU transmit failed");
|
2007-11-12 10:18:54 +00:00
|
|
|
if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) {
|
|
|
|
|
int len = apdu.resplen > outlen ? outlen : apdu.resplen;
|
|
|
|
|
|
|
|
|
|
memcpy(out, apdu.resp, len);
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, len);
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
2010-03-15 12:17:13 +00:00
|
|
|
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, sc_check_sw(card, apdu.sw1, apdu.sw2));
|
2007-11-12 10:18:54 +00:00
|
|
|
}
|
|
|
|
|
|
2009-10-03 14:41:14 +00:00
|
|
|
static int gemsafe_get_challenge(sc_card_t *card, u8 *rnd, size_t len)
|
|
|
|
|
{
|
|
|
|
|
int prev_cla, r;
|
|
|
|
|
|
|
|
|
|
prev_cla = card->cla;
|
|
|
|
|
if(card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID) {
|
|
|
|
|
/* Warning: this depends on iso7816_get_challenge not
|
|
|
|
|
* changing the value of the card's CLA
|
|
|
|
|
*/
|
|
|
|
|
card->cla = 0x80;
|
|
|
|
|
}
|
|
|
|
|
r = iso_ops->get_challenge(card, rnd, len);
|
|
|
|
|
/* Restore the CLA value if needed */
|
|
|
|
|
if(card->cla != prev_cla)
|
|
|
|
|
card->cla = prev_cla;
|
|
|
|
|
|
|
|
|
|
return r;
|
|
|
|
|
}
|
|
|
|
|
|
2018-01-16 20:03:30 +00:00
|
|
|
static int gemsafe_card_reader_lock_obtained(sc_card_t *card, int was_reset)
|
|
|
|
|
{
|
|
|
|
|
int r = SC_SUCCESS;
|
|
|
|
|
gemsafe_exdata *exdata = (gemsafe_exdata *)card->drv_data;
|
|
|
|
|
|
|
|
|
|
SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
|
|
|
|
|
|
|
|
|
|
if (was_reset > 0 && exdata) {
|
|
|
|
|
r = gp_select_applet(card, exdata->aid, exdata->aid_len);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
LOG_FUNC_RETURN(card->ctx, r);
|
|
|
|
|
}
|
|
|
|
|
|
2007-11-12 10:18:54 +00:00
|
|
|
static struct sc_card_driver *sc_get_driver(void)
|
|
|
|
|
{
|
|
|
|
|
struct sc_card_driver *iso_drv = sc_get_iso7816_driver();
|
|
|
|
|
if (!iso_ops)
|
|
|
|
|
iso_ops = iso_drv->ops;
|
|
|
|
|
/* use the standard iso operations as default */
|
|
|
|
|
gemsafe_ops = *iso_drv->ops;
|
2009-10-03 14:41:14 +00:00
|
|
|
/* gemsafe specific functions */
|
2007-11-12 10:18:54 +00:00
|
|
|
gemsafe_ops.match_card = gemsafe_match_card;
|
|
|
|
|
gemsafe_ops.init = gemsafe_init;
|
|
|
|
|
gemsafe_ops.finish = gemsafe_finish;
|
|
|
|
|
gemsafe_ops.select_file = gemsafe_select_file;
|
|
|
|
|
gemsafe_ops.restore_security_env = gemsafe_restore_security_env;
|
|
|
|
|
gemsafe_ops.set_security_env = gemsafe_set_security_env;
|
|
|
|
|
gemsafe_ops.decipher = gemsafe_decipher;
|
|
|
|
|
gemsafe_ops.compute_signature = gemsafe_compute_signature;
|
2009-10-03 14:41:14 +00:00
|
|
|
gemsafe_ops.get_challenge = gemsafe_get_challenge;
|
2007-11-12 10:18:54 +00:00
|
|
|
gemsafe_ops.process_fci = gemsafe_process_fci;
|
2016-06-21 11:49:06 +00:00
|
|
|
gemsafe_ops.pin_cmd = iso_ops->pin_cmd;
|
2018-01-16 20:03:30 +00:00
|
|
|
gemsafe_ops.card_reader_lock_obtained = gemsafe_card_reader_lock_obtained;
|
2007-11-12 10:18:54 +00:00
|
|
|
|
|
|
|
|
return &gemsafe_drv;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
struct sc_card_driver *sc_get_gemsafeV1_driver(void)
|
|
|
|
|
{
|
|
|
|
|
return sc_get_driver();
|
|
|
|
|
}
|
|
|
|
|
|
