Minidriver.c sign_pin and user_consent - PinCacheAlwaysPrompt

At least 5 card drivers set user_consent on a sign pin
The user_consent indicates a prompt for the pin should always
be done by minidriver. PKCS15 can also set user_consent and
PKCS11 sets key attribute CKA_ALWAYS_AUTHENTICATE when key has
user_consent, but windows need the PinCacheAlwaysPrompt
flag set on the pin.

pkcs15-piv.c now defines a sign pin which is used only
with the 9C key.

=======

 On branch minidriver-PinCacheAlwaysPrompt
 Changes to be committed:
	modified:   libopensc/pkcs15-piv.c
	modified:   minidriver/minidriver.c

src/libopensc/pkcs15-piv.c

@@ -71,6 +71,7 @@ typedef struct pdata_st {
  int tries_left;
  const unsigned char pad_char;
  int obj_flags;
+ int cardmod; /* only use with cardmod minidriver */
 } pindata;
 
 typedef struct pubdata_st {
@@ -385,17 +386,30 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
  SC_PKCS15_PIN_FLAG_INITIALIZED |
  SC_PKCS15_PIN_FLAG_LOCAL,
  -1, 0xFF,
- SC_PKCS15_CO_FLAG_PRIVATE },
+ SC_PKCS15_CO_FLAG_PRIVATE, 0},
+
  { "02", "PIV PUK", "", 0x81,
  SC_PKCS15_PIN_TYPE_ASCII_NUMERIC,
  8, 4, 8,
  SC_PKCS15_PIN_FLAG_NEEDS_PADDING |
  SC_PKCS15_PIN_FLAG_INITIALIZED |
- SC_PKCS15_PIN_FLAG_LOCAL | SC_PKCS15_PIN_FLAG_SO_PIN |
+ SC_PKCS15_PIN_FLAG_SO_PIN |
  SC_PKCS15_PIN_FLAG_UNBLOCKING_PIN,
  -1, 0xFF,
- SC_PKCS15_CO_FLAG_PRIVATE },
- { NULL, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+ SC_PKCS15_CO_FLAG_PRIVATE, 0},
+
+ /* only used with minidriver */
+ { "03", "PIN", "", 0x80,
+ /* used in minidriver as the sign key and for 9C key */
+ /* label, flag and ref will change if using global pin */
+ SC_PKCS15_PIN_TYPE_ASCII_NUMERIC,
+ 8, 4, 8,
+ SC_PKCS15_PIN_FLAG_NEEDS_PADDING |
+ SC_PKCS15_PIN_FLAG_INITIALIZED |
+ SC_PKCS15_PIN_FLAG_LOCAL,
+ -1, 0xFF,
+ SC_PKCS15_CO_FLAG_PRIVATE, 1}, /* only use if cardmod */
+ { NULL, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
  };
  // clang-format on
 
@@ -540,7 +554,7 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
  SC_PKCS15_PRKEY_USAGE_NONREPUDIATION,
  /*EC*/SC_PKCS15_PRKEY_USAGE_SIGN |
  SC_PKCS15_PRKEY_USAGE_NONREPUDIATION,
- "", 0x9C, "01", SC_PKCS15_CO_FLAG_PRIVATE, 1},
+ "", 0x9C, "01", SC_PKCS15_CO_FLAG_PRIVATE, 1}, /* use sign pin and user_consent */
  { "03", "KEY MAN key",
  /*RSA*/SC_PKCS15_PRKEY_USAGE_DECRYPT | SC_PKCS15_PRKEY_USAGE_UNWRAP,
  /*EC*/SC_PKCS15_PRKEY_USAGE_DERIVE,
@@ -952,6 +966,10 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
  const char * label;
  int pin_ref;
 
+ /* the SignPIN is only used with minidriver */
+ if (pins[i].cardmod && (strcmp(card->ctx->app_name, "cardmod") != 0))
+ continue;
+
  memset(&pin_info, 0, sizeof(pin_info));
  memset(&pin_obj, 0, sizeof(pin_obj));
 
@@ -968,17 +986,17 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
  sc_format_path(pins[i].path, &pin_info.path);
 
  label = pins[i].label;
- if (i == 0 &&
+ if ((i == 0 || pins[i].cardmod) &&
  sc_card_ctl(card, SC_CARDCTL_PIV_PIN_PREFERENCE,
  &pin_ref) == 0 &&
  pin_ref == 0x00) { /* must be 80 for PIV pin, or 00 for Global PIN */
  pin_info.attrs.pin.reference = pin_ref;
- pin_info.attrs.pin.flags &= ~SC_PKCS15_PIN_FLAG_LOCAL;
  label = "Global PIN";
  }
+
  strncpy(pin_obj.label, label, SC_PKCS15_MAX_LABEL_SIZE - 1);
  pin_obj.flags = pins[i].obj_flags;
- if (i == 0 && pin_info.attrs.pin.reference == 0x80) {
+ if ((i == 0 || pins[i].cardmod)) {
  /*
  * according to description of "RESET RETRY COUNTER"
  * command in specs PUK can only unblock PIV PIN
@@ -1016,7 +1034,6 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
 
  pubkey_obj.flags = pubkeys[i].obj_flags;
 
-
  if (pubkeys[i].auth_id)
  sc_pkcs15_format_id(pubkeys[i].auth_id, &pubkey_obj.auth_id);
 
@@ -1169,6 +1186,10 @@ static int sc_pkcs15emu_piv_init(sc_pkcs15_card_t *p15card)
  if (prkeys[i].auth_id)
  sc_pkcs15_format_id(prkeys[i].auth_id, &prkey_obj.auth_id);
 
+ /* If using minidriver, use Sign PIN for 9C key */
+ if (prkey_obj.user_consent && (strcmp(card->ctx->app_name, "cardmod") == 0))
+ sc_pkcs15_format_id("03", &prkey_obj.auth_id);
+
  /*
  * When no cert is present and a pubkey in a file was found,
  * means the caller is initializing a card. A sign operation

src/minidriver/minidriver.c

@@ -233,6 +233,9 @@ typedef struct _VENDOR_SPECIFIC
  struct md_dh_agreement* dh_agreements;
  BYTE allocatedAgreements;
 
+ /* if any key used with the MD_ROLE_USER_SIGN has user_consent set PinCacheAlwaysPrompt */
+ int need_pin_always;
+
  CRITICAL_SECTION hScard_lock;
 } VENDOR_SPECIFIC;
 
@@ -1888,6 +1891,12 @@ md_set_cmapfile(PCARD_DATA pCardData, struct md_file *file)
  cont->flags & CONTAINER_MAP_DEFAULT_CONTAINER ?
  " (default)" : "");
 
+ /* set flag that at least one key that uses the sign key needs PinCacheAlwaysPrompt */
+ logprintf(pCardData, 7, "key_obj->user_consent: %d\n", (int) key_obj->user_consent);
+ if (key_obj->user_consent)
+ vs->need_pin_always = 1;
+ logprintf(pCardData, 7, "vs->need_pin_always %d\n", (int) vs->need_pin_always);
+
  if (pin_mode < pin_mode_n) {
  pin_mode = pin_mode_n;
  pin_cont_idx = ii;
@@ -5999,6 +6008,16 @@ DWORD WINAPI CardAuthenticateEx(__in PCARD_DATA pCardData,
  if (pcbSessionPin) *pcbSessionPin = 0;
  if (ppbSessionPin) *ppbSessionPin = NULL;
  logprintf(pCardData, 2, "standard pin verification");
+ /*
+ * TODO the use of auth_method being overridden to do session pin 
+ * conflicts with framework-pkcs15.c use of auth_method SC_AC_CONTEXT_SPECIFIC
+ * for a different purpose. But needs to be reviewed 
+ */
+ if (PinId == MD_ROLE_USER_SIGN && vs->need_pin_always) {
+ logprintf(pCardData, 7, "Setting SC_AC_CONTEXT_SPECIFIC cbPinData: %lu old auth_method: %0x auth_id:%x \n",
+ (unsigned long) cbPinData, (unsigned int) auth_info->auth_method, (unsigned char) auth_info->auth_id.value[0]);
+ auth_info->auth_method = SC_AC_CONTEXT_SPECIFIC;
+ }
  r = md_dialog_perform_pin_operation(pCardData, SC_PIN_CMD_VERIFY, vs->p15card, pin_obj, (const u8 *) pbPinData, cbPinData, NULL, NULL, DisplayPinpadUI, PinId);
  }
 
@@ -6475,16 +6494,28 @@ DWORD WINAPI CardGetProperty(__in PCARD_DATA pCardData,
  "returning info on normal PIN [%lu]\n",
  (unsigned long)dwFlags);
 
- if (dwFlags == ROLE_USER)
+ if (dwFlags == ROLE_USER) {
+ p->PinCachePolicy.PinCachePolicyType = PinCacheNormal;
  p->PinPurpose = PrimaryCardPin;
- else if (dwFlags == MD_ROLE_USER_SIGN)
+ }
+ else if (dwFlags == MD_ROLE_USER_SIGN) {
+ logprintf(pCardData, 7, "vs->need_pin_always %d\n", (int) vs->need_pin_always);
+ if (vs->need_pin_always) {
+ p->PinCachePolicy.PinCachePolicyType = PinCacheAlwaysPrompt;
+ logprintf(pCardData, 7, "Setting PinCacheAlwaysPrompt\n");
+ }
+ else
+ p->PinCachePolicy.PinCachePolicyType = PinCacheNormal;
+
  p->PinPurpose = DigitalSignaturePin;
- else
+ }
+ else {
  p->PinPurpose = AuthenticationPin;
+ p->PinCachePolicy.PinCachePolicyType = PinCacheNormal;
+ }
 
  p->PinCachePolicy.dwVersion = PIN_CACHE_POLICY_CURRENT_VERSION;
  p->PinCachePolicy.dwPinCachePolicyInfo = 0;
- p->PinCachePolicy.PinCachePolicyType = PinCacheNormal;
  p->dwChangePermission = CREATE_PIN_SET(dwFlags);
  p->dwUnblockPermission = CREATE_PIN_SET(ROLE_ADMIN);
  break;