S. Wefel wrote:
Hello,
Moin Sandro,
I found a few issues regarding the openpgp card implementation (tested with opensc-0.10.1). 1.) The openpgp card (http://www.g10code.de/p-card.html) stores 3 pairs of RSA-Keys on a card but no certs. OpenSSH needs a cert on the card (only to get the public-key), it ignores crls, valid time settings and other informations stored in a cert. I wrote a patch for OpenSSH (tested with openssh-4.2p1 and openssh-4.3p2) which works in combination with opensc for openpgp and maybe other cards. After applying this patch openssh tests for the insertion of an openpgp card. If such a card is found then openssh searchs for information about all stored private keys. Only those private keys are valid which have an according public key and all these key pairs are used for openssh. It works well in openssh for authentication purposes. The ssh-agent works too. 2.) In the opensc-0.10.1 (maybe 0.11 too, not checked yet) implementation of card-openpgp.c seems to be a problem in pgp_compute_signature. The line "apdu.le = 256" allows a response of 256 Bytes. But if the buffer "out" given to pgp_compute_signature has an "outlen" less then 256 Bytes (openssh only uses a smaller size) then sc_check_apdu called by sc_transmit_apdu fails because ... case SC_APDU_CASE_4_SHORT: if (apdu->resplen < apdu->le) { sc_error(ctx, "Le > response buffer size\n"); ... The second patch modifies card-openpgp.c to set apdu.le=outlen. I don't know if this cause problems somewhere else. Tests with openssh shows that it works well.
this shouldn't cause a problem => I've applied a change to card-openpgp.c
3.) A problem for which I cannot provide a fix until now in openssh is the storage of the pin in the ssh-agent. Public keys are readable without verification. If somebody calls "ssh-add -s XXX" he is asked for the pin, but the pin isn't verified because the public-keys, which the agent stores to offer them to a remote ssh-server, are readable without the correct pin. If the user connects to a remote server and the agent has a valid key, then the remote server sends the challenge which has to be signed by the card. The agent sends the request to the card and uses the stored pin. In case of a false pin, this request fails instead of the ssh-add command. This is currently under investigation.
concerning openssh: I'm not sure if we should really spent to much effort on the opensc specifc openssh support and instead focus on a more general pkcs11 support ... Thanks for the bug report. Cheers, Nils _______________________________________________ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www.opensc-project.org/mailman/listinfo/opensc-devel
