David,
I have gotten further with the code Ludovic committed to the SVN yesterday
using the Gemplus GemXpresso Pro R3 E32 PK card. This is not the card you
have but an older version. I can read the cert, use the pin, set the security
environment.
What I am trying to do is use it with MIT Kerberos PKINIT. One of the
operations done by PKINIT via PKCS#11 is to request the card to sign
a challenge. This requires the card to pad then sign the challenge.
But it does not need to be hashed first.
Attached is spy output and a debug trace showing the operations sent
to the card, and the diff of the changes I refer to below.
Also attached are changes I had to make to get this far:
Remove info->stored_length /= 2; as this was sending only 4 bytes
for the pin rather then 8.
Remove the _sc_card_add_rsa_alg( card, 1024, SC_ALGORITHM_RSA_PAD_PKCS1, 0);
as this was already being done in the card-gemsafeV1.c
Add flags |= SC_ALGORITHM_RSA_HASH_NONE; as without this,
code in pkcs15-sec.c would return SC_ERROR_INVALID_DATA.
just after the second sc_debug I added.
But now the challenge is being sent to the card, but the the card
is returning 6f 00. I assume that the set_security_env
is not being set correctly to tell the card to use RSA PKCS1 but no hash.
So any idea on how to set the sec_env to do CKM_RSA_PKCS?
Can the card do RAW RSA? i.e. CKM_RSA_X_509. If so the libopensc could
do the padding.
Ludovic Rousseau wrote:
2007/11/12, Ludovic Rousseau <[EMAIL PROTECTED]>:
2007/11/9, Mattes, David <[EMAIL PROTECTED]>:
I wrote the driver back when opensc-0.9.6 was the latest release and I
have not kept up with porting it. One reason is that the Linux distro
I'm using (SuSE Linux Desktop 10 SP1) still ships a backported
opensc-0.9.6 release. Nevertheless it would be great if the opensc team
could review the driver and make optimizations and/or corrections as
necessary, bring it up to the latest opensc release, and make it part of
the opensc distribution.
I tried to intergrate it in the subversion version of OpenSC. Some comments:
- I need to rename the functions sc_get_gemsafe_driver in
sc_get_gemsafeV1_driver to avoid a name collision with the GPK version
of GemSafe
- the functions sc_pkcs15emu_add_cert(), sc_pkcs15emu_add_prkey() and
sc_pkcs15emu_add_pin were present in ./src/libopensc/pkcs15-syn.c in
OpenSC 0.9.6 but pkcs15-syn.c has been removed
Some work is still needed. Any help is welcome.
Code integrated in revision 3296.
It is a preliminary version. Tests are needed.
For example I could not select the certificate from Thunderbird.
Thunderbird says: "Certificate Manager can't locale a valid
certificate that can be used to digitally sign your messages". Any
ideas.
I can see the certificate using "View certificates" but something must
be missing like an attribute.
David, can you test your cards with the SVN version of OpenSC and
report if it works for you? Maybe the code need more changes to work
with OpenSC >= 0.11.4
Regards,
--
Douglas E. Engert <[EMAIL PROTECTED]>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
Index: pkcs15-sec.c
===================================================================
--- pkcs15-sec.c (revision 3296)
+++ pkcs15-sec.c (working copy)
@@ -203,11 +203,13 @@
/* If the card doesn't support the requested algorithm, see if we
* can strip the input so a more restrictive algo can be used */
+sc_debug(ctx,"DEE flags=%08.8x %08.8x",flags,alg_info->flags);
if ((flags == (SC_ALGORITHM_RSA_PAD_PKCS1 |
SC_ALGORITHM_RSA_HASH_NONE)) &&
!(alg_info->flags & (SC_ALGORITHM_RSA_RAW |
SC_ALGORITHM_RSA_HASH_NONE))) {
unsigned int algo;
size_t tmplen = sizeof(buf);
r = sc_pkcs1_strip_digest_info_prefix(&algo, tmp, inlen, tmp,
&tmplen);
+sc_debug(ctx,"DEE r=%d algo=%d",r,algo);
if (r != SC_SUCCESS || algo == SC_ALGORITHM_RSA_HASH_NONE) {
sc_mem_clear(buf, sizeof(buf));
return SC_ERROR_INVALID_DATA;
Index: pkcs15-gemsafeV1.c
===================================================================
--- pkcs15-gemsafeV1.c (revision 3296)
+++ pkcs15-gemsafeV1.c (working copy)
@@ -246,10 +246,6 @@
return SC_ERROR_INTERNAL;
strcpy(p15card->manufacturer_id, MANU_ID);
- /* Add RSA algorithm */
- card->algorithm_count = 0;
- _sc_card_add_rsa_alg( card, 1024, SC_ALGORITHM_RSA_PAD_PKCS1, 0);
-
/* set certs */
fprintf(stderr, "%s: Setting certificate\n", fn_name);
for (i = 0; gemsafe_cert[i].label; i++) {
@@ -420,8 +416,6 @@
if (path)
info->path = *path;
- if (type == SC_PKCS15_PIN_TYPE_BCD)
- info->stored_length /= 2;
return sc_pkcs15emu_add_object(p15card,
SC_PKCS15_TYPE_AUTH_PIN,
Index: card-gemsafeV1.c
===================================================================
--- card-gemsafeV1.c (revision 3296)
+++ card-gemsafeV1.c (working copy)
@@ -180,6 +180,7 @@
flags = SC_ALGORITHM_RSA_PAD_PKCS1;
flags |= SC_ALGORITHM_RSA_PAD_ISO9796;
flags |= SC_ALGORITHM_ONBOARD_KEY_GEN;
+ flags |= SC_ALGORITHM_RSA_HASH_NONE;
_sc_card_add_rsa_alg(card, 512, flags, 0);
_sc_card_add_rsa_alg(card, 768, flags, 0);
[opensc-pkcs11]
../../../src/src/pkcs11/framework-pkcs15.c:2093:pkcs15_prkey_sign: Selected
flags 12. Now computing signature for 33 bytes. 1000 bytes reserved.
[opensc-pkcs11]
../../../src/src/libopensc/pkcs15-sec.c:150:sc_pkcs15_compute_signature: called
[opensc-pkcs11]
../../../src/src/libopensc/pkcs15-sec.c:206:sc_pkcs15_compute_signature: DEE
flags=00000012 8000001a
[opensc-pkcs11] ../../../src/src/libopensc/card.c:285:sc_lock: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:532:sc_select_file: called;
type=2, path=3f0016000004
[opensc-pkcs11]
../../../src/src/libopensc/card-gemsafeV1.c:209:gemsafe_select_file: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:516:sc_transmit_apdu: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:285:sc_lock: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Outgoing APDU data [ 9 bytes] =====================================
00 A4 08 00 04 16 00 00 04 .........
======================================================================
[opensc-pkcs11]
../../../src/src/libopensc/reader-pcsc.c:175:pcsc_internal_transmit: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Incoming APDU data [ 2 bytes] =====================================
61 14 a.
======================================================================
[opensc-pkcs11] ../../../src/src/libopensc/card.c:312:sc_unlock: called
[opensc-pkcs11] ../../../src/src/libopensc/iso7816.c:459:iso7816_select_file:
returning with: 0
[opensc-pkcs11] ../../../src/src/libopensc/card.c:554:sc_select_file: returning
with: 0
[opensc-pkcs11] ../../../src/src/libopensc/sec.c:63:sc_set_security_env: called
[opensc-pkcs11]
../../../src/src/libopensc/card-gemsafeV1.c:388:gemsafe_set_security_env: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:516:sc_transmit_apdu: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:285:sc_lock: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Outgoing APDU data [ 11 bytes] =====================================
00 22 41 B6 06 80 01 12 84 01 03 ."A........
======================================================================
[opensc-pkcs11]
../../../src/src/libopensc/reader-pcsc.c:175:pcsc_internal_transmit: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Incoming APDU data [ 2 bytes] =====================================
90 00 ..
======================================================================
[opensc-pkcs11] ../../../src/src/libopensc/card.c:312:sc_unlock: called
[opensc-pkcs11] ../../../src/src/libopensc/sec.c:67:sc_set_security_env:
returning with: 0
[opensc-pkcs11] ../../../src/src/libopensc/sec.c:49:sc_compute_signature: called
[opensc-pkcs11]
../../../src/src/libopensc/card-gemsafeV1.c:448:gemsafe_compute_signature:
called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:516:sc_transmit_apdu: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:285:sc_lock: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Outgoing APDU data [ 40 bytes] =====================================
80 2A 9E AC 23 90 21 30 1F 30 07 06 05 2B 0E 03 .*..#.!0.0...+..
02 1A 04 14 94 6B 96 9C 45 DE 42 D3 84 28 5E 3F .....k..E.B..(^?
A6 E3 33 1E C9 90 B6 44 ..3....D
======================================================================
[opensc-pkcs11]
../../../src/src/libopensc/reader-pcsc.c:175:pcsc_internal_transmit: called
[opensc-pkcs11] ../../../src/src/libopensc/apdu.c:184:sc_apdu_log:
Incoming APDU data [ 2 bytes] =====================================
6F 00 o.
======================================================================
[opensc-pkcs11] ../../../src/src/libopensc/card.c:312:sc_unlock: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:312:sc_unlock: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:312:sc_unlock: called
[opensc-pkcs11] ../../../src/src/libopensc/reader-pcsc.c:670:pcsc_unlock: called
[opensc-pkcs11]
../../../src/src/pkcs11/framework-pkcs15.c:2113:pkcs15_prkey_sign: Sign
complete. Result -1200.
[opensc-pkcs11] ../../../src/src/pkcs11/misc.c:80:sc_to_cryptoki_error: opensc
error: Card command failed (-1200)
[opensc-pkcs11] ../../../src/src/pkcs11/pkcs11-object.c:554:C_Sign: Signing
result was 5
[opensc-pkcs11] ../../../src/src/pkcs11/pkcs11-session.c:131:C_CloseSession:
C_CloseSession(1)
[opensc-pkcs11] ../../../src/src/pkcs11/pkcs11-global.c:231:C_Finalize:
Shutting down Cryptoki
[opensc-pkcs11] ../../../src/src/pkcs11/slot.c:185:card_removed: 0: smart card
removed
[opensc-pkcs11]
../../../src/src/pkcs11/pkcs11-session.c:115:sc_pkcs11_close_all_sessions:
C_CloseAllSessions(slot 0).
[opensc-pkcs11]
../../../src/src/pkcs11/pkcs11-session.c:115:sc_pkcs11_close_all_sessions:
C_CloseAllSessions(slot 1).
[opensc-pkcs11]
../../../src/src/pkcs11/pkcs11-session.c:115:sc_pkcs11_close_all_sessions:
C_CloseAllSessions(slot 2).
[opensc-pkcs11]
../../../src/src/pkcs11/pkcs11-session.c:115:sc_pkcs11_close_all_sessions:
C_CloseAllSessions(slot 3).
[opensc-pkcs11] ../../../src/src/libopensc/pkcs15.c:781:sc_pkcs15_unbind: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:236:sc_disconnect_card: called
[opensc-pkcs11] ../../../src/src/libopensc/card.c:251:sc_disconnect_card:
returning with: 0
[opensc-pkcs11] ../../../src/src/libopensc/ctx.c:740:sc_release_context: called
[opensc-pkcs11] ../../../src/src/libopensc/log.c:167:sc_debug_time_stamp:
107/10/12 15:56:41
11: C_FindObjects
[in] hSession = 0x1
[in] ulMaxObjectCount = 0x1
[out] ulObjectCount = 0x0
Returned: 0 CKR_OK
12: C_FindObjectsFinal
[in] hSession = 0x1
Returned: 0 CKR_OK
13: C_FindObjectsInit
[in] hSession = 0x1
[in] pTemplate[3]:
CKA_CLASS CKO_PRIVATE_KEY
CKA_KEY_TYPE CKK_RSA
CKA_ID [size : 0x1 (1)]
45
Returned: 0 CKR_OK
14: C_FindObjects
[in] hSession = 0x1
[in] ulMaxObjectCount = 0x1
[out] ulObjectCount = 0x1
Object 1 Matches
Returned: 0 CKR_OK
15: C_FindObjectsFinal
[in] hSession = 0x1
Returned: 0 CKR_OK
16: C_SignInit
[in] hSession = 0x1
pMechanism->type=CKM_RSA_PKCS
[in] hKey = 0x1
Returned: 0 CKR_OK
17: C_Sign
[in] hSession = 0x1
[in] pData[ulDataLen] [size : 0x21 (33)]
301F3007 06052B0E 03021A04 14946B96 9C45DE42 D384285E 3FA6E333 1EC990B6
44
Returned: 5 CKR_GENERAL_ERROR
_______________________________________________
opensc-devel mailing list
[email protected]
http://www.opensc-project.org/mailman/listinfo/opensc-devel
