two lines that are never executed are removed for the code.
The LOG_TEST_GOTO_ERR before these lines will goto err.
On branch PIV-improved-parsing
Changes to be committed:
modified: src/libopensc/card-piv.c
Based on Fuzz testing, many of the calls to sc_asn1_find_tag were replaced
with sc_asn1_read_tag. The input is also tested that the
expected tag is the first byte. Additional tests are also add.
sc_asn1_find_tag will skip 0X00 or 0Xff if found. NIST sp800-73-x specs
do not allow these extra bytes.
On branch PIV-improved-parsing
Changes to be committed:
modified: card-piv.c
Cleanup trailing whitespaces and protect hand formated structures
in card-piv.c and pkcs15-piv.c
On branch PIV-whitespace
Changes to be committed:
modified: card-piv.c
modified: pkcs15-piv.c
Fixes#2141
NIST 800-73-3 based cards only had 2 bits set in first pin policy byte.
NIST 800-73-4 defines additions bits in first pin policy byte.
When one of these bit is set, and the policy prefers the Global pin,
it is not recognized and the local pin is used.
On branch PIV-global-pin-bug
Changes to be committed:
modified: src/libopensc/card-piv.c
Update the ATR table for PIV/CAC matrix to 2019 -10-18 version:
https://www.cac.mil/Portals/53/Documents/DoD%20Token%20utilziation%20and%20variation%20matrix%20v2_06_17October2019.docx?ver=2019-10-18-102519-120
Also update table for several PivKey cards, and added ATR for IDEMIA PIV 2.4.1.
But did not update for use of SM or VCI.
Yubico changed the ATR historical data for Yubikey 5 NFC. Code was added to recognize
it, when used with USB or NFC.
Note: Yubikey 5 NFC when used with NFC cant use touch policy. NFC reader may not provide
enough power to power the LED on button.
On branch PIV-update-DOD-Yubikey
Changes to be committed:
modified: card-piv.c
Fix various spelling errors, mostly in comments but also in texts displayed.
Errors found & interactively fixed using 'codespell', with additional manual
checks after the fixes.
In piv_general_mutual_authenticate sc_asn1_put_tag is not used correctly.
On branch piv-sc_asn1_put_tag-error
Changes to be committed:
modified: card-piv.c
Random data from PIV card is obtained using GENERAL AUTHENTICATE command
for a request of a Challenge from the card. "00 87 00 9B 04 7C 02 81 00"
Usually 8 bytes are returned.
NIST 800-73-3_PART2, "A.1 Authentication of the PIV Card Application Administrator"
"Table 11. Authentication of PIV Card Application Administrator" shows an example of
how to do this.
Some cards (one I have: 3b:7d:96:00:00:80:31:80:65:b0:83:11:17:d6:83:00:90:00)
will not allow 2 of these commands in a row. (Maybe assuming command is only
used as in Table 11 and is expecting the second command.)
Code was added to card-piv.c so if "6A 80" is returned, try the command one more time.
For any other GENERAL AUTHENTICATE failure, SC_ERROR_NOT_SUPPORTED is returned.
piv_get_challenge may be called within a loop from sc_get_challenge if more random
data is needed thus causing the the 2 commands to sent in a row.
On branch piv-improved-matching
Changes to be committed:
modified: card-piv.c
Not all PIV applets are the same. Different versions of NIST 800-73 and improperly implemented
or not implemented required features of NIST 800-73 cases problems. Have a look at the card_issues
listed in card-piv.c. The PIV driver has tried to detect the differences based on clues found in
the ATR historical bytes and vendor version numbers for some cards.
At the same time it has tried to support the possibility there are multiple applets
on a card that the user may want to use at the same time from different applications.
This has lead to some detection problems with Dual CAC/PIV cards. The same cards
sold by the vendor may have only a PIV applet that may not be the same PIV applet that
is on the Dual PIV/CAC cards.
http://www.cac.mil/Portals/53/Documents/CAC-utilziation-and-variation-matrix-v2.03-20May2016.doc
defines a number of official CAC cards in active service. A table of the ATRs for these is now used
to detect these cards. The PIV version of the CCC is also read to see if any CAC PKI objects
are defined in the CCC, indicating it is a Dual CAC/PIV, even if the ATR is not listed.
A more conservative approach to try and handle multiple applets on a card is used. Based
on issues with the implementation of the PIV applet this may not be possible to do.
So for many cards no additional detection will be done at the start of every transaction,
and the login state can not be detected correctly.
ATRs for PIVKEY are also in the match table, as these cards have a log of issues.
Other PIV cards in the future or not yet tested may not be covered properly by this patch.
Extra debugging was added with "PIV_MATCH" to help with these other cards.
With "debug = 7;", `grep PIV_MATCH opensc-debug.log` can be used to see how a card
type and card_issues are derived.
On branch piv-improved-matching
Changes to be committed:
modified: card-piv.c
modified: cards.h
card-piv.c
make sure the string is null terminated before passing it
to hex_to_bin routine, which expects it
pkcs15-cac.c
free cn_name on failure
pkcs11-tool.c
make sure the string is null terminated before passing it to
parse_certificate(), which expects it
Sc_asn1_read_tag can return SC_ERROR_ASN1_END_OF_CONTENTS
which indicates the tag and length are OK, but any value
is not completely contained in the buffer supplied. card-piv.c
can use this when reading just the beginning of a object to
determine the size of a buffer needed to hold the object.
Remove aid_file and aidfile variables in card-piv.c. These are not needed
as piv_select_aid parses the returned data from a SELECT AID command.
In response to e-mail from X41 group on 6/11/2018.
On branch x41-piv-2
Changes to be committed:
modified: card-piv.c
This fixes a build failure with optimized ppc64el and new gcc builds
card-piv.c: In function ‘piv_validate_general_authentication.isra.3’:
card-piv.c:2390:9: error: ‘rbuflen’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
body = sc_asn1_find_tag(card->ctx, rbuf, rbuflen, 0x7c, &bodylen);
~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Let sc_get_challenge() do sc_lock() and loop through the card driver's
get_challenge() until enough bytes were collected. The card driver's
get_challenge() now returns the number of bytes collected (less or equal
than requested) or an error code.
- Allow more code re-use.
- PIV driver now uses ASN.1 parser for reading the random bytes
sc_pkcs15_verify_pin say:
/* if pin cache is disabled, we can get here with no PIN data.
* in this case, to avoid error or unnecessary pin prompting on pinpad,
* check if the PIN has been already verified and the access condition
* is still open on card.
*/
It then call sc_pkcs15_get_pin_info
A context specific login is used in PKCS#11 to force the user
to enter the PIN again and a verify command be sent to the card.
(Actually it could be a different value for the PINi depending on the card)
sc_pkcs15_get_pin_info will then call the card driver, but does not
say why it is testing the login status.sc_pkcs15_get_pin_info may return
SC_PIN_STATE_LOGGED_IN=1 and sc_pkcs15_verify_pin will then skip sending
the actual verify command to the card via _sc_pkcs15_verify_pin
To avoid this, sc_pkcs15_get_pin_info will set data.pin_type = pin_info->auth_method;
In the case of a context specific login, this is SC_AC_CONTEXT_SPECIFIC
and the card driver can take action and can return SC_PIN_STATE_LOGGED_IN=0
so the verify will be done.
The PIV driver card-piv.c does this. Other drivers could do something similar.
Date: MOn May 21 20:40:00 2018 -0500
On branch History-fixes
Changes to be committed:
modified: card-piv.c
modified: pkcs15-pin.c
If a PIV card does not have or support a Discovery Object and
is known to lose the login state when the PIV AID is selected,
nothing was done in piv_card_reader_lock_obtained.
If was_reset > 0 select the PIV AID to at least get the
PIV AID selected.
For other cards either reading the Discovery a object and/or
selecting the PIV AID will make sure the PIV AID is selected.
If multiple applications are using the card, this will allow
the first one to select the AID, and any others that handle
a reset will not cause interference wit the first.
On branch History-fixes
Changes to be committed:
modified: card-piv.c
&& is replaced by || in the test of valid key references
for retired keys found in the Historic object.
For retired keys, the user_consent flag was being set by default.
Thus a C_Login(CKU_CONTEXT_SPECIFIC) would be required.
NIST 800-73 only requires PIN_Always on the Sign Key.
To extend the usefullnes of "retired keys" on non government
issued PIV-like cards, code had already been added
to use the certificate keyUsage flags to override the NIST
defined key usage flags. The NONREPUDATION flag is now used
to set the user_consent flag.
So rather then always requiring C_Login(CKU_CONTEXT_SPECIFIC)
for any retured key, the code only requires it for non government
cards where teh certificate has NONREPUDATION.
Changes to be committed:
modified: card-piv.c
modified: pkcs15-piv.c
Some ActivIdentity CAC/PIV cards lose the login state when selecting
the PIV AID SC_CARD_TYPE_PIV_II_CAC and CI_PIV_AID_LOSE_STATE were added
so piv_card_reader_lock_obtained will try and do a SELECT PIV AID.
card->type is reset to its original value if piv_match_card_continued
fails to match a card as PIV.
pkcs15-piv.c now uses sc_card_ctl which checks card->ops->card_ctl for NULL.
closes https://github.com/OpenSC/OpenSC/pull/1307
fixes https://github.com/OpenSC/OpenSC/issues/1297
We can't check for `tag == SC_ASN1_TAG_EOC` directly, because this
would also be true for a tag of 0x80 (with `class ==
SC_ASN1_CLASS_CONSTRUCTED`). So what we do is we check for the output
buffer to be NULL!
fixes https://github.com/OpenSC/OpenSC/issues/1273
In order to satisfy some concerns over the use of <card>_match_card
and <card>_init, this modification will do that at the cost of additional
overhead of repeating some card commands.
Hopefully this commit will not be needed.
On branch piv-aid-discovery
Changes to be committed:
modified: card-piv.c
As requested and as the alternative solution see:
https://github.com/OpenSC/OpenSC/pull/1256#issuecomment-365319444
In order to not pass a card lock and the card->drv_data from piv_match_card
piv_match_card is split in 2 parts.
the piv_match_card_continued is called from piv_init. piv_init may
now return with SC_ERROR_INVALID_CARD to single to sc_connect_card to look
for additional drivers.
Cosmetic change to indicate neo_version is really a Yubico version.
Change wording on the comments when setting card_issues.
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c
Some CAC card return '6A80` Incorrect parameters in APDU when trying to
read the Discovery object. If it fails other then not found, then we can
not use the Discovery object to test for the active AID.
The test is done in piv_match_card just after doing a SELECT AID for the PIV.
and set CI_DISCOVERY_USELESS if needed. piv_card_reader_lock_obtained will
then not use the Discovery object.
Some older PIV cards, prior to the introduction of the PIV
Discovery and History objects, may get errors trying to read them.
Ignore these errors too.
Remove comment and remove code to check verify Lc=0 as requested in:
https://github.com/OpenSC/OpenSC/pull/1256#pullrequestreview-96124443
They can easily be added back in.
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c