In order to satisfy some concerns over the use of <card>_match_card
and <card>_init, this modification will do that at the cost of additional
overhead of repeating some card commands.
Hopefully this commit will not be needed.
On branch piv-aid-discovery
Changes to be committed:
modified: card-piv.c
As requested and as the alternative solution see:
https://github.com/OpenSC/OpenSC/pull/1256#issuecomment-365319444
In order to not pass a card lock and the card->drv_data from piv_match_card
piv_match_card is split in 2 parts.
the piv_match_card_continued is called from piv_init. piv_init may
now return with SC_ERROR_INVALID_CARD to single to sc_connect_card to look
for additional drivers.
Cosmetic change to indicate neo_version is really a Yubico version.
Change wording on the comments when setting card_issues.
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c
Some CAC card return '6A80` Incorrect parameters in APDU when trying to
read the Discovery object. If it fails other then not found, then we can
not use the Discovery object to test for the active AID.
The test is done in piv_match_card just after doing a SELECT AID for the PIV.
and set CI_DISCOVERY_USELESS if needed. piv_card_reader_lock_obtained will
then not use the Discovery object.
Some older PIV cards, prior to the introduction of the PIV
Discovery and History objects, may get errors trying to read them.
Ignore these errors too.
Remove comment and remove code to check verify Lc=0 as requested in:
https://github.com/OpenSC/OpenSC/pull/1256#pullrequestreview-96124443
They can easily be added back in.
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c
Framework-pkcs15.c will now set pin_info->auth_method to SC_AC_CONTEXT_SPECIFIC
iso7816.c iso7816_build_pin_apdu treats this the same as SC_AC_CHV
card-piv.c piv_pin_cmd sets priv->xcontext_specific=1 and calls sc_lock before
the verify command. If the verify fails sc_unlock is called.
Later after the next card command returns, if priv->context_specific==1 piv_check_sw
will call sc_unlock as the application may not have requested the crypto but
some other command.
Some additional calls to sc_lock and sc_unlock have been added to make sure
PIV internal command sequences including the crypto command ('87') and any get
responses are always protected by a lock.
This guarantees the card is locked for verify and the next command
which should be the crypto operation. The PIV card also inforces this restriction
on the card.
This is based on suggestions in:
://github.com/OpenSC/OpenSC/pull/1256#issuecomment-361975751
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c
modified: src/libopensc/iso7816.c
modified: src/libopensc/types.h
modified: src/pkcs11/framework-pkcs15.c
Many OpenSC drivers try and detect during match if the card supports
their AID by doing a SELECT FILE for the AID.
But this can cause problems with cards such as Yubico that do not ignore
SELECT AID commands for applications they do not support. Other cards may
have the same problems. Selecting the wrong AID can also lose the security
state.
The card-piv.c will now uses the GET DATA to read the PIV Discovery Object '7E'
which is a ISO standard template that will contain the AID of the currently
active application. The driver will then double check that the template is
for the PIV application.
If the template contains the PIV AID, then no SELECT AID is done.
PIV standards say there can only be one PIV application on a card.
PIV standards also say PIV must be the the default application,
but Yubico does not follow this.
The command fails only then will a SELECT AID be done.
Thus this can avoid the Yubico problem.
This logic is used in both "match" and in the piv_card_reader_lock_obtained
routine.
Additional logic was in piv_card_reader_lock_obtained was added to handle
when the card reset was received by some other program. Multiple programs
may be trying to use the PIV application on the card, and thus multiple
programs will all receive that the card was reset. The first program to receive
the card was reset will do all of the above logic, and may leave the card in
a state will cause other programs to not have to do much at all.
The intent of all of this is to avoid sending extra commands to the card
including SELECT AID that could change the card state when not needed.
On branch piv-aid-discovery
Changes to be committed:
modified: card-piv.c
Also add PIV card types to sc_pkcs15_is_emulation_only
On branch piv-aid-discovery
Changes to be committed:
modified: src/libopensc/card-piv.c
modified: src/libopensc/pkcs15-syn.c
Use names that are specific to EAC, not the German ID card (nPA),
because Protocol and Commands are defined by BSI TR-03110 and ICAO.
Functions that are nPA specific are moved to card-npa.h.
RutokenS returns data with little endian byte order, due to this
fact token wouldn't work with standard function. So function for
parsing fcp from little endian data was inplemented.
The maximum length for sending and receiving data can now be found in DO
7F66. For now, we just use the default values for short/extended length
capabiliites.
PKI-Applets may not be active if the card has been reset or unpowered.
The SELECT command used to activate the applet, is identical to the one
used during card matching or initialization.
This allows us to generate templates also for arguments expecting
files (input, output) or PKCS#11 modules. The general ideal was
already implemented, but never completed.
Some "unfriendly" cards return SW 90 00 to any instruction including
the ACA file selection and therefore they are identified as CAC card.
To avoid this, we will try to read the assumed ACA file and we will
mark the card as matched only if we will read something from that file.
We do not parse the content yet.
To avoid infinite loop on "unfriendly" cards, we assume that
read data instruction always returns some data. It it does not,
we can safely assume the file is not there or it is not the card
we are looking for.
Windows/macOS (minidriver/tokend) handle the authentication status and
perform an explicit logout on shutdown. PKCS#11 standard requires a
session for logging into the card; when closing the session we perform
an explicit logout. Hence, the authentication status should be reset
even if not performing a reset on disconnect.
partially implements https://github.com/OpenSC/OpenSC/issues/1215
Refactored OpenPGP code so that future versions of the card will be
accessed using the logic for OpenPGP V2. We hope that backward
compatibility of the standard will keep the new versions functional.
Frank Morgner
Doug Engert
Mardalemer
Jakub Jelen
edgarholleis
Jakub Jelen