Skip to content

Commit

Permalink
card-epass2003.c - get pass failure in get_external_key_retries
Browse files Browse the repository at this point in the history 
get_external_key_retries  APDU usei SC_APDU_CASE_1, 0x82, 0x01, 0x80 | kid
which is trapped and calls construct_mac_tlv_ which calls
aes128_encrypt_cmac_ft. This is a version of CMAC  which called
used  EVP_CIPHER *alg = sc_evp_cipher(card->ctx, "AES-128-ECB");
for creating the subkes k1 and k2 keys and for doing the final
encrypt to produce the MAC.

See NIST SP 800-38B 6.2 MAC Generation
CMAC should use AES-128-CBC for both subkey and final encryption.

It looks like this is a fix for some cards. but only in FIPS.

Changes to be committed:
	modified:   libopensc/card-epass2003.c
  • Loading branch information
@dengert
dengert committed Mar 8, 2024
1 parent ce76ee9 commit 84ce488
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions src/libopensc/card-epass2003.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -404,6 +404,8 @@ aes128_encrypt_cmac_ft(struct sc_card *card, const unsigned char *key, int keysi
for (int i=0;i<16;i++){
data2[i]=data2[i]^k2Bin[offset + i];
}
sc_evp_cipher_free(alg);
alg = sc_evp_cipher(card->ctx, "AES-128-CBC");
r = openssl_enc(alg, key, iv, data2, 16, output);
sc_evp_cipher_free(alg);
return r;
Expand Down

2 comments on commit 84ce488

@haijie-ftsafe
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a fix for some cards which are in fips，and only these cards will run this code

@dengert
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know. That was the first problem I fixed. where

./pkcs15-init -C -T --profile pkcs15+onepin --pin 123456 --puk 12345678 --label "ePass2003-X"
Using reader with a card: Feitian ePass2003 00 00
Connecting to card in reader Feitian ePass2003 00 00...
Using card driver epass2003.
Failed to create PKCS #15 meta structure: Card command failed

with this APDU:

Outgoing APDU (16 bytes):
0C 82 01 81 0A 8E 08 39 83 90 DD 4C 64 FC 5A 00 .......9...Ld.Z.
Incoming APDU (2 bytes):
69 88

If I git cherry-pick 84ce488355a58b2e86775a2022d71cd41497992b github master at: 993e6469bd1861a0c24d1b013d05a8518eda8af0
and re initialize the card, the command above works.

./pkcs15-init --generate-key rsa/2048 --auth-id 01 --key-usage sign --id 01 --label "Key01"
works
but this does not:

./pkcs11-tool --sign --id 01 -m SHA256-RSA-PKCS --input /tmp/data.txt --output-file /tmp/signature.rsa
Using slot 0 with a present token (0x0)
Logging in to "ePass2003-X (User PIN)".
Please enter User PIN: 
Using signature algorithm SHA256-RSA-PKCS
error: PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

It fails on the RSA signature operation:

Outgoing APDU (299 bytes):
0C 2A 80 86 00 01 22 87 82 01 11 01 95 E3 25 E2 .*....".......%.
84 69 1E 8E F4 92 1D 41 9B F3 D2 E1 A6 A7 26 40 .i.....A......&@
34 22 F8 DF D8 C1 5D 5B 94 DB 91 EC E1 50 99 11 4"....][.....P..
4F 13 EC CF DB 95 7C 5F 24 36 FD 2C DE 22 6C BB O.....|_$6.,."l.
24 3E 34 67 85 E8 4D D0 CD F4 9B 8C 88 DC E1 AE $>4g..M.........
D3 F4 64 00 FA 21 74 DA F3 62 39 E6 34 5D 4C B8 ..d..!t..b9.4]L.
34 FE D8 22 C7 BE 42 8E 65 0E E5 ED 48 9F F9 AD 4.."..B.e...H...
6D A4 A5 3D DD FB 6E 43 46 9A 48 47 A7 1F 38 B9 m..=..nCF.HG..8.
1E 92 FD 8F 12 83 BC 81 5F 35 7F E5 86 9B 87 68 ........_5.....h
9B 62 D1 C3 41 12 DC C3 AB B1 D3 09 6E 04 39 B0 .b..A.......n.9.
7A 87 DC BE 2D 6B 92 53 81 F9 82 76 DF B1 B7 B4 z...-k.S...v....
9F F4 15 01 B5 4F 04 E2 48 C6 0B 01 FA 44 32 F2 .....O..H....D2.
C6 36 9D 27 05 A3 4A DA BC FB AB 3B F7 B3 ED 37 .6.'..J....;...7
E4 F8 EA 36 9F 72 78 59 10 C8 78 B0 6B C7 42 03 ...6.rxY..x.k.B.
30 79 D7 65 59 1F AF BA 93 01 B5 8B 94 AE 17 EF 0y.eY...........
A7 77 09 A2 FA 4A 03 C4 58 A5 00 61 B8 66 0E CE .w...J..X..a.f..
FE 4C 9B F7 B0 B2 A4 98 7D 5F 50 DB 52 E2 5B 38 .L......}_P.R.[8
41 BA 01 21 17 56 88 1C 8E B0 00 3E 97 01 00 8E A..!.V.....>....
08 CE D5 ED FD 90 86 3D 8C 00 00   

Incoming APDU (16 bytes):
99 02 6F 83 8E 08 27 0F 24 50 F4 84 68 D3 6F 83

ISO 7816-4 does not define 6F 83. What does 6F 83 mean from the epass2003"

What version of OpenSC are you using? Do you have a token that matches
The token I purchased 2 weeks ago: "EPass2003FIPS" "FEITIN ePass2003PKI USB_A TOKEN FIPS 140-2"

RSA-2048 does not work, ECDSA works.

Please sign in to comment.