Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CKR_GENERAL_ERROR when try to authentcate website #1118

Closed
vosskaem opened this issue Aug 2, 2017 · 27 comments · Fixed by #1212
Closed

CKR_GENERAL_ERROR when try to authentcate website #1118

vosskaem opened this issue Aug 2, 2017 · 27 comments · Fixed by #1212
Labels

Comments

@vosskaem
Copy link

vosskaem commented Aug 2, 2017

Problem Description

Trying to login into a website and authenticate with corporate id card which works under Windows with cardos.

Using OpenSC-0.16.0-321-g3d187d9, rev: 3d187d9, commit-time: 2017-08-02 11:23:43 +0200
$ opensc-tool -n
Using reader with a card: OMNIKEY AG CardMan 3121 00 00
CardOS M4

Steps to reproduce

pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so -t -l

Logs

(...)
0x7fa965a12700 14:49:07.724 [opensc-pkcs11] reader-pcsc.c:662:pcsc_unlock: called
0x7fa965a12700 14:49:07.733 [opensc-pkcs11] framework-pkcs15.c:1472:pkcs15_release_token: pkcs15_release_token() not implemented
0x7fa965a12700 14:49:07.733 [opensc-pkcs11] slot.c:474:slot_token_removed: slot_token_removed(0x1)
0x7fa965a12700 14:49:07.733 [opensc-pkcs11] pkcs11-session.c:140:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x1) 0
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] slot.c:474:slot_token_removed: slot_token_removed(0x2)
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] pkcs11-session.c:140:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x2) 0
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] slot.c:474:slot_token_removed: slot_token_removed(0x3)
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] pkcs11-session.c:140:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x3) 0
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] pkcs15.c:1273:sc_pkcs15_unbind: called
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] pkcs15-pin.c:826:sc_pkcs15_pincache_clear: called
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] misc.c:61:sc_to_cryptoki_error_common: libopensc return value: 0 (Success)
0x7fa965a12700 14:49:07.734 [opensc-pkcs11] card.c:346:sc_disconnect_card: called
0x7fa965a12700 14:49:07.758 [opensc-pkcs11] reader-pcsc.c:597:pcsc_disconnect: OMNIKEY AG CardMan 3121 00 00:SCardDisconnect returned: 0x00000000
0x7fa965a12700 14:49:07.758 [opensc-pkcs11] card.c:368:sc_disconnect_card: returning with: 0 (Success)
0x7fa965a12700 14:49:07.758 [opensc-pkcs11] ctx.c:870:sc_release_context: called
0x7fa965a12700 14:49:07.758 [opensc-pkcs11] reader-pcsc.c:896:pcsc_finish: called
error: PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

@frankmorgner
Copy link
Member

I don't see an error in your log. Did you forget to paste something?

Did that card work in a previous version of OpenSC or with a different PKCS#11 provider?

@vosskaem
Copy link
Author

vosskaem commented Aug 3, 2017

Did you get the bug description via email? It was initially commented out between the xml comment tags. I removed it afterwards, sorry.

error: PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

First I tried with Version: 0.15.0-1ubuntu1, got the error and then compiled from git master.

@frankmorgner
Copy link
Member

Yeah, I did see that. I was referring to the part that you skipped with (...); we need it. CKR_GENERAL_ERROR is a, uhm, very general error without further indication of what went wrong.

@vosskaem
Copy link
Author

vosskaem commented Aug 3, 2017

ok, here it is. I tried to remove any private information marked with <removed>

pkcs11-test.out.txt

@frankmorgner
Copy link
Member

Try setting the following in opensc.conf:

    reader_driver pcsc {                                                                                                          
        # Limit command and response sizes. Some Readers don't propagate their
        # transceive capabilities correctly. max_send_size and max_recv_size
        # allow setting the limits manually, for example to enable extended
        # length capabilities.
        # Default: max_send_size = 255, max_recv_size = 256;
        max_send_size = 65535;
        max_recv_size = 65536;
...

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

Is it a typo:
max_send_size = 65535;
max_recv_size = 65536;
do you mean
max_send_size = 65536;
max_recv_size = 65536;

I tried bothwith this reader:
Bus 001 Device 010: ID 076b:3021 OmniKey AG CardMan 3121

Does not work:

$ OPENSC_DEBUG=2 pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so -t -l
0x7ff20ae47700 13:33:21.536 [opensc-pkcs11] card.c:200:sc_connect_card: called
0x7ff20ae47700 13:33:21.559 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.575 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.584 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.609 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.677 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.735 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.841 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.870 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:21.954 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:22.215 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:22.471 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:22.690 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:22.904 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
Using slot 0 with a present token (0x0)
0x7ff20ae47700 13:33:22.964 [opensc-pkcs11] sec.c:216:sc_pin_cmd: returning with: -1408 (Not supported)
Logging in to "PIN (Siemens Corporate ID Card)".
Please enter User PIN: 
0x7ff20ae47700 13:33:26.704 [opensc-pkcs11] sec.c:216:sc_pin_cmd: returning with: 0 (Success)
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
0x7ff20ae47700 13:33:34.765 [opensc-pkcs11] sec.c:216:sc_pin_cmd: returning with: -1408 (Not supported)
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
0x7ff20ae47700 13:33:34.774 [opensc-pkcs11] sec.c:216:sc_pin_cmd: returning with: -1408 (Not supported)
Signatures (currently only for RSA)
  testing key 0 (Auth 07.04.17 09:28:56 - 07.04.18) 
0x7ff20ae47700 13:33:34.780 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:34.801 [opensc-pkcs11] sec.c:78:sc_set_security_env: returning with: 0 (Success)
0x7ff20ae47700 13:33:34.839 [opensc-pkcs11] sec.c:46:sc_decipher: returning with: -1200 (Card command failed)
0x7ff20ae47700 13:33:34.848 [opensc-pkcs11] card-cardos.c:484:cardos_select_file: called
0x7ff20ae47700 13:33:34.901 [opensc-pkcs11] ctx.c:870:sc_release_context: called
error: PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

I also tried another reader:
Bus 001 Device 009: ID 08e6:3437 Gemalto (was Gemplus) GemPC Twin SmartCard Reader

same result.

@dengert
Copy link
Member

dengert commented Aug 6, 2017 via email

@dengert
Copy link
Member

dengert commented Aug 6, 2017

looks like 08e6:3437 Gemalto (was Gemplus) GemPC Twin SmartCard Reader also does not support extended APDUs

@dengert
Copy link
Member

dengert commented Aug 6, 2017

In: https://github.com/OpenSC/OpenSC/files/1196827/pkcs11-test.out.txt

line 5189: 0x7fa965a12700 14:49:07.646 [opensc-pkcs11] apdu.c:378:sc_single_transmit: CLA:10, INS:2A, P1:80, P2:86, data(255) 0xde6d90

This looks like a short APDU with CLA:10 set to command chaining because the reader does not support extended APDU. The card may not support command chaining.

But you removed line 5193 making it harder to see what was actually sent.
but in line 5197 card returns status 68 84

'68XX' Functions in CLA not supported (further qualification in SW2, see table 16)

84 look like it does not accept Command Chaining, but I can't find the reference.

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

But the reader ist not marked with "Limitations: No extended APDU" :-o
https://pcsclite.alioth.debian.org/ccid/supported.html#0x08E60x3437
https://pcsclite.alioth.debian.org/ccid/readers/GemPCTwin.txt

But anyway, the CardMan 3121 works in Windows... So there must be a way...

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

If you need I will provide more log output, but not just all. I don't want to expose private data to public.

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

Here is that missing pice starting from line 5192

Outgoing APDU (260 bytes):
10 2A 80 86 FF 00 00 DC 19 0B 93 2D 58 58 44 DD .*.........-XXD.
69 67 BF 97 73 91 A8 AA F8 B4 C8 17 79 56 3F 39 ig..s.......yV?9
A7 B2 5A 86 6D E8 62 87 F4 F5 B4 4C 4E F8 29 B7 ..Z.m.b....LN.).
5F E8 4E D2 7A F7 7C 72 AB 44 8A 25 9A C9 5E 41 _.N.z.|r.D.%..^A
7B B8 C7 E9 A1 29 70 95 1F 24 E1 6D 1C 0A 24 7C {....)p..$.m..$|
F2 72 4E 6C 69 CB DF 15 0F 69 3A AA 32 98 EB AD .rNli....i:.2...
51 B3 96 F2 DC 06 87 FB 2A 68 68 47 72 8C C3 64 Q.......*hhGr..d
FF 11 D1 68 DC B0 7D EC 19 B7 96 4B 50 81 F8 A1 ...h..}....KP...
34 8F 93 11 95 1A 0C C0 82 75 07 F4 01 CA 58 00 4........u....X.
DB 29 69 B8 D9 E6 A4 F2 9E 3A 3D EE BB 36 8F F0 .)i......:=..6..
C5 22 01 5A 3C 0D 1A BE 82 21 B2 84 EB 0A 84 C7 .".Z<....!......
34 ED 7F 0D D4 23 00 72 5D 3D 60 18 73 EF 08 38 4....#.r]=`.s..8
11 09 93 4D 17 AD 0B 99 CF BD 1D BA C7 A2 81 FB ...M............
8F 00 09 63 23 09 D5 80 46 35 99 BA 24 A1 F2 35 ...c#...F5..$..5
AB 85 82 C2 33 8D 5B 02 4A 79 BC 12 1B 3E 0D AA ....3.[.Jy...>..
3E 16 0E 62 1F E3 E2 66 19 7B 20 3D 1D 12 73 C8 >..b...f.{ =..s.
98 F5 8A CB

@frankmorgner
Copy link
Member

@vosskaem have you tested CardMan 3121 on Windows with pkcs11-tool -l -t? If so, compare the output (debug = 3) in both cases.

No typo! It should be:

max_send_size = 65535;
max_recv_size = 65536;

Are you sure setting the configuration was successful? You should give the full debug log (without PINs).

If you're reader doesn't support extended length, then you can't use all algorithms, but some may work.

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

Under Windows it works with the CardOS Driver from Atos (Company standard)

# cat /etc/opensc/opensc.conf | grep -A 10 "reader_driver pcsc"
	reader_driver pcsc {
		# Limit command and response sizes.
		# Default: n/a
		# max_send_size = 255;
		# max_recv_size = 256;
		max_send_size = 65535;
	        max_recv_size = 65536;
		#
		# Connect to reader in exclusive mode?
		# Default: false
		# connect_exclusive = true;

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

How to locate the PIN data?

@vosskaem
Copy link
Author

vosskaem commented Aug 6, 2017

I found my name and company name in clear text in the log. I don't want to post my certificate data here.

@Jakuje
Copy link
Member

Jakuje commented Aug 7, 2017

The CardMan 3121 does not support standard extended APDU, but only using a nonstandard "hack", that was dropped from upstream some time ago (in 2014). In Fedora/RHEL we reverted this change, because this reader is still very popular.

https://bugzilla.redhat.com/show_bug.cgi?id=1420024

@vosskaem
Copy link
Author

vosskaem commented Aug 7, 2017

Can you please revert that in upstream too?
How can I get that running quick?

@Jakuje
Copy link
Member

Jakuje commented Aug 7, 2017

I am not upstream of CCID. @LudovicRousseau removed that intentionally since it is old, not CCID compliant and needs hacks to work with long APDUs. Fastest way is probably to install Fedora. Or rebuild and install locally ccid [1] with the following patch [2] (whatever other distro you have).

[1] http:https://pcsclite.alioth.debian.org/ccid.html
[2] https://paste.fedoraproject.org/paste/2YpY13flc5xJ23yRvPSw0Q

@LudovicRousseau
Copy link
Member

The reader GemPC Twin reader https://pcsclite.alioth.debian.org/ccid/supported.html#0x08E60x3437 DOES support extended APDU.
I suggest you to use this reader to avoid extended APDU issues.

When the current problem is fixed you can try again with the CardMan 3121.

@vosskaem
Copy link
Author

vosskaem commented Aug 7, 2017

Thanks a lot, but it all does not help.

  1. I cloned git:https://anonscm.debian.org/pcsclite/CCID.git, applied the mentioned patch and compiled successfully and installed (sudo make install) and did a reboot.
    The original is replaced:
$ ll /usr/lib/pcsc/drivers/ifd-ccid.bundle/Contents/Linux
insgesamt 476
drwxr-xr-x 2 root root   4096 Aug  7 19:35 ./
drwxr-xr-x 3 root root   4096 Jul 25 13:11 ../
-rwxr-xr-x 1 root root 368176 Aug  7 19:47 libccid.so*
-rw-r--r-- 1 root root 109160 Mai 18  2016 libccid.so.orig

It still does not work.

  1. I tried the other mentioned reader:
$ lsusb | grep Gema
Bus 001 Device 009: ID 08e6:3437 Gemalto (was Gemplus) GemPC Twin SmartCard Reader

This also does not work!

@vosskaem
Copy link
Author

vosskaem commented Aug 7, 2017

Using Ubuntu 16.04 with Linux 4.11.0-13-generic (linux-image-generic-hwe-16.04-edge from backports)

@vosskaem
Copy link
Author

vosskaem commented Aug 7, 2017

in fact the Gemalto Reader seems to be this one,
http:https://pcsclite.alioth.debian.org/ccid/shouldwork.html#0x08E60x3437
which has the same USB Id as the one you mentioned above.
I bought this one:
https://www.amazon.de/gp/product/B00HEMJPYY/ref=oh_aui_detailpage_o00_s00

@vosskaem
Copy link
Author

vosskaem commented Aug 7, 2017

so, what to buy that finally work?
what about this one:
https://www.amazon.de/dp/B00IDBWWAE/ref=wl_it_dp_o_pC_S_ttl

@frankmorgner
Copy link
Member

Maybe you can go into a store and simply try some smart card readers and buy which ever works.

The issue seems solved (need reader with extended length).

@vosskaem
Copy link
Author

I bought a SCR uTrust SCR3500 A SmartFold contact reader which works perfectly.

http:https://www.scm-pc-card.de/index.php?page=product&function=show_product&lang=de&category_id=46&p=SCR uTrust SCR3500 A SmartFold contact reader&c=SmartCard (SCR)&product_id=922

The vendor provided driver is NOT necessary. The only thing to get it running is the change in
/etc/opensc.conf

#(...)
    # The following section shows definitions for PC/SC readers.
    reader_driver pcsc {
        # Limit command and response sizes.
        # Default: max_send_size = 255, max_recv_size = 256;
        # max_send_size = 0;
        # max_recv_size = 0;
        max_send_size = 65535;
        max_recv_size = 65536;
#(...)

You can add it to the list of supported devices.

Thanks for your help.

@solfas
Copy link

solfas commented Sep 24, 2021

Try installing an older driver for your card reader. With my HID Omnikey 3021 I had the same error. I installed a driver of 2012 and it started working.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

6 participants