Various CardOS 5.3 Fixes #1987

dengert · 2020-03-21T17:47:42Z

Treat CardOS V5.3 differently then other versions.

(Compiles but not tested with any CardOS card. )
Fixes: #1916

Assume card can do SC_ALGORITHM_RSA_RAW and SC_ALGORITHM_RSA_PAD_PKCS1

Reported failures of using RSA_RSA may be caused by older readers.
Older CardOS versions appear to support RAW_RSA.

Base max_send_size and max_recv_size on minimum of what reader provides
or "data_field_length" from card. This will allow it to work
with older readers.

CT_181026_LPM_CardOS_V5-3_Multifunctionality_FS_en3_web.pdf
says it supports: "“Command chaining” in accordance with ISO/IEC 7816-4"
Take advantage of this with older readers.

If caller provides a bigger buffer for decipher, left justify results to modlen.
before doing any software stripping of padding.
(This is based on mod from https://github.com/fbezdeka)

On branch cardos-5.3
Changes to be committed:
modified: card-cardos.c
modified: cards.h
modified: pkcs15-sec.c

[x ] PKCS#11 module is tested but using non-CardOS card.

loblik · 2020-03-21T19:01:01Z

I've run pkcs11-tool --login --test and the only problem seems to be RSA-PKCS. I got.

    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 58 90 01 05 a4 93 fe 9d 7e
    Decrypted: 00 02 47 ee c0 29 73 fe 49 9d fb d4 a9 c8 05 b3 9e 29 60 8f fd 86 df c5 72 f2 f1 96 1a 63 54 b6 22 34 5c f1 6b 01 c4 9f 68 c0 bd 86 ab 1c d0 b2 72 37 98 11 f7 93 e8 7d da e8 fb 98 f1 82 a8 7f eb b6 41 83 28 17 66 56 6d d6 a4 a5 eb df 36 fc ce c0 9d a2 17 d2 8f ed 03 72 05 a5 b7 c3 47 af 41 97 f5 b6 f6 f1 05 c2 e0 24 a0 34 b5 9a 10 2a b3 f0 95 ed 2e 95 bb 32 d9 bc 47 70 c3 5c e8 22 2c e2 73 ba f1 c3 af f3 52 7f 8d 12 83 7b 21 13 92 16 11 10 b8 d5 7f 36 58 6b b6 52 cf f2 46 e6 c2 50 fc e2 73 6b ca 6b 58 74 5c ae 85 f6 f1 b8 a2 6c 54 76 e3 4c 25 4b fa 35 1f 51 0d 83 14 b1 3b 9e bc 33 ce f4 e8 9e d4 8a 17 f9 f0 4f 38 0e ba fc 37 c2 1f ad 66 80 d2 b1 8e 68 80 37 bd 34 a4 64 b5 2e 03 b5 3e 9b 21 1e f9 31 50 2c 32 fb f6 da 71 f3 27 00 00 58 90 01 05 a4 93 fe 9d 7e

There seems to be some extra padding in the beginning of APDU. However I'm not sure how relevant this is. pkcs11-tool --test also reported some errors in OpenSC 0.19 although I was not experiencing any issues during daily use of the card.

Tested with reader
0 No Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00

dengert · 2020-03-21T19:15:18Z

The returned data is with padding. 00 02 says it is pkcs1 bt-02 as expected. The padding ends with the 00 byte followed by the expected data. The result should have been striped. Will look at this later.

…

On Sat, Mar 21, 2020, 2:01 PM Pavel Löbl ***@***.***> wrote: I've run pkcs11-tool --login --test and the only problem seems to be RSA-PKCS. I got. RSA-PKCS: resulting cleartext doesn't match input Original: 00 58 90 01 05 a4 93 fe 9d 7e Decrypted: 00 02 47 ee c0 29 73 fe 49 9d fb d4 a9 c8 05 b3 9e 29 60 8f fd 86 df c5 72 f2 f1 96 1a 63 54 b6 22 34 5c f1 6b 01 c4 9f 68 c0 bd 86 ab 1c d0 b2 72 37 98 11 f7 93 e8 7d da e8 fb 98 f1 82 a8 7f eb b6 41 83 28 17 66 56 6d d6 a4 a5 eb df 36 fc ce c0 9d a2 17 d2 8f ed 03 72 05 a5 b7 c3 47 af 41 97 f5 b6 f6 f1 05 c2 e0 24 a0 34 b5 9a 10 2a b3 f0 95 ed 2e 95 bb 32 d9 bc 47 70 c3 5c e8 22 2c e2 73 ba f1 c3 af f3 52 7f 8d 12 83 7b 21 13 92 16 11 10 b8 d5 7f 36 58 6b b6 52 cf f2 46 e6 c2 50 fc e2 73 6b ca 6b 58 74 5c ae 85 f6 f1 b8 a2 6c 54 76 e3 4c 25 4b fa 35 1f 51 0d 83 14 b1 3b 9e bc 33 ce f4 e8 9e d4 8a 17 f9 f0 4f 38 0e ba fc 37 c2 1f ad 66 80 d2 b1 8e 68 80 37 bd 34 a4 64 b5 2e 03 b5 3e 9b 21 1e f9 31 50 2c 32 fb f6 da 71 f3 27 00 00 58 90 01 05 a4 93 fe 9d 7e There seems to be some extra padding in the beginning of APDU. However I'm not sure how relevant this is. pkcs11-tool --test also reported some errors in OpenSC 0.19 although I was not experiencing any issues during daily use of the card. Tested with reader 0 No Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00 — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1987 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGTIMOMMYP3FTPGT2BFKELRIUFHXANCNFSM4LQ7U6JQ> .

dengert · 2020-03-21T20:31:01Z

Using a card that does support RSA-PKCS1 with decryption, it looks like I should not have added the code in pkcs15-sec.c. because the problem I think this code tried to addressed for the CardOS is
needs to be handled in the driver like other drivers do. i.e. a leading 00 or two might be dropped.

@fbezdeka can you explain why you needed to add the code in #1916 (comment) That was where the pkcs15-sec.c code came from.

Did you see your card dropping a leading zero or two in the results for decrypt?
Or was the code added to handle the application providing a larger out buffer?

pkcs11-tool passins in a 512 byte out buller, but only needs 256, with RAW_RSA the results would be 256. but with RSA-PKCS1 after a strip, it would be 16 bytes.
My NitroKey is returning 10 as expected, and the pkcs15-sec.c is setting the result to 256.

@loblik results look similar to mine. Can you try removing the code from pkcs15-sec.c, rebuild and try pkcs11-tool again?

loblik · 2020-03-22T12:54:37Z

After you reverted pkcs15 changes I have problem for both decryption types

    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d f0 00 10 8b 67 cf 99
    Decrypted: e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d f0 00 10 8b 67 cf 99
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 d4 c4 4c 24 95 c8 97 b5 12
    Decrypted: 02 e5 ff 36 a5 20 43 02 80 e0 e4 af e3 37 53 7c f9 42 9c e8 2b f0 45 af 55 05 5f dd df 29 fd 4c 8a 12 d4 37 9d 51 15 0b e2 1d 12 f4 26 5c 66 8d 45 b9 11 4d 26 dc 1d 40 2c a6 f1 7c 47 26 95 89 01 a0 84 d8 8d 5e c6 86 08 90 79 c5 ea ae 9d 4c 28 0d 42 33 b5 f8 1e c3 4b 29 c4 77 7e 47 d9 17 c9 0f ee 20 85 82 37 ae 29 35 43 9c 41 1f 2e 32 83 f7 e5 65 d6 8d a3 2c 9d a5 58 1a 0e 46 42 99 8f 16 cb 4d 42 e8 fb ed ee 1d 1a 04 7f 5f f0 bf 54 e1 5e 43 c7 3e 08 2c d6 67 dc ab a1 2f a2 61 68 c7 6e 41 23 da fa 54 aa e7 7a 0c b0 cc 5b ca 70 ff 80 2d b5 0d 07 ec b1 b2 88 d1 18 9e 72 1d 24 f2 ce d3 83 de de 96 64 6f dd 58 81 7a 39 07 c4 f9 54 93 65 b2 94 47 19 31 40 bb 82 3d ea 94 ac 69 91 43 ea 39 16 a6 34 ff dc 7b 7a 4f a0 5b d7 8d 6e 95 00 00 d4 c4 4c 24 95 c8 97 b5 12

By the way I believe I have the same card as @fbezdeka .

dengert · 2020-03-22T14:14:28Z

Good info. We are close and can fix this is software...

Note that the leading 00 byte is missing on both.
With RSA-X-509 which should always be 00 anyway, we can add it back in.

With RSA-PKCS it looks like it also dropped a leading 00 and returned the pkcs1 BT-2 type padding.
which RFC 8017 says should look like: 00 | 02 | PS | 00 | M
where PS is at least 8 bytes of non zero random bytes. and M is the message.
In this case padding + messages is:
is 00(missing) | 02 | e5 ff 36 a5 ... d7 8d 6e 95 | 00 | 00 d4 c4 4c 24 95 c8 97 b5 12

So for v5_3 at all we need to do in the cardos_decipher is to insert a zero byte.

Can you look at opensc debug log and find the APDU input where these two blocks are returned?
If need be run pkcs11-tool again. The results may be different but follow the missing leading zero.

I will look at a simple mode to fix this and the card is reported to support PSS padding too.
Give me a half hour...

fbezdeka · 2020-03-22T15:44:28Z

First of all: Thanks for all the help!

@dengert, The reason for the modification of sc_pkcs15_decipher was that my card added a NULL byte infront of the padding/message. The test results mentioned in #1916 show that as well as the failure reported by @loblik above.

I guess if possible it should be moved to the CardOS specific parts.
(Just to be complete: sc_pkcs15_compute_signature does the same NULL byte removal: See #1319)

I'm now going to test your implementation and will report back.

loblik · 2020-03-22T15:49:39Z

Ok. Now I realized I've forgot to run make clean after I switched to your branch. It seems OpenSC build system will not recompile all the changes when switching branches. So the thing is that everything fails for me on this branch. Sorry for the confusion.

Signatures (currently only for RSA)
  testing key 0 () 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: ERR: verification failed
    RSA-PKCS: ERR: verification failed
    SHA1-RSA-PKCS: ERR: verification failed
    MD5-RSA-PKCS: ERR: verification failed
    RIPEMD160-RSA-PKCS: ERR: verification failed
    SHA256-RSA-PKCS: ERR: verification failed
  testing key 1 (Encr ) with 1 mechanism
    RSA-X-509: ERR: verification failed
  testing key 2 (Encr ) with 1 mechanism
    RSA-X-509: ERR: verification failed
  testing key 3 (Encr ) with 1 mechanism
    RSA-X-509: ERR: verification failed
  testing key 4 (Encr ) with 1 mechanism
    RSA-X-509: ERR: verification failed
Verify (currently only for RSA)
  testing key 0 (Auth )
    RSA-X-509:   ERR: verification failed  ERR: C_Verify() returned CKR_SIGNATURE_INVALID (0xc0)
  testing key 1 (Encr ) with 1 mechanism
    RSA-X-509:   ERR: verification failed  ERR: C_Verify() returned CKR_SIGNATURE_INVALID (0xc0)
  testing key 2 (Encr ) with 1 mechanism
    RSA-X-509:   ERR: verification failed  ERR: C_Verify() returned CKR_SIGNATURE_INVALID (0xc0)
  testing key 3 (Encr ) with 1 mechanism
    RSA-X-509:   ERR: verification failed  ERR: C_Verify() returned CKR_SIGNATURE_INVALID (0xc0)
  testing key 4 (Encr ) with 1 mechanism
    RSA-X-509:   ERR: verification failed  ERR: C_Verify() returned CKR_SIGNATURE_INVALID (0xc0)

And also the decryption as noted above (#1987 (comment)) .

To your RSA-PKCS decrypt question. This is part of the pkcs11-tool output .

    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 52 b6 57 02 d4 c4 4c 24 95
    Decrypted: 00 02 dd 17 f5 a0 04 6c 75 02 cc 85 56 3d bb 7d 0f 3b 11 b3 cf c2 6b 09 29 ec da 64 59 59 24 59 f3 3f bf cc 3a c6 ac 5f bb 0e dc 22 cf 54 d0 27 2b a4 14 64 d9 b4 65 d5 bc 1d b7 37 a9 4a a0 7a 2c e1 a9 1f 3d c3 3d ac f1 8c 93 66 15 8a 61 03 df 38 d7 69 f6 52 e8 05 62 7f b1 88 ea 8d e8 8e bc 9b 90 bb fc 68 0b 84 5a be 4d 6a ae 2d 1a 32 ed d3 38 ce 19 3d e7 65 e6 98 04 18 0e da e6 5c 92 9d 44 c6 9b bc 01 96 b3 61 f5 14 e7 dd 0c 57 57 0f d3 fa 6b ca a5 9d cf 2f 67 e3 ee 7d 60 d3 5f 81 93 bf a9 3e 43 21 05 18 5c b9 33 c5 ba 49 52 58 f0 41 1a 03 29 f6 ac 03 82 75 c5 b7 b1 e6 07 d6 a4 06 64 9d 3f b4 49 97 5f 8e 88 16 cd b9 8d 09 1b 8c 40 3e 76 02 c4 0d 07 75 55 f6 77 15 2d d4 3a 8b 44 ac 06 20 a2 a8 e7 6e d2 4d ff 01 5e 58 d4 58 84 00 00 52 b6 57 02 d4 c4 4c 24

And this seems to be corespoding APDU.

Incoming APDU (257 bytes):
02 DD 17 F5 A0 04 6C 75 02 CC 85 56 3D BB 7D 0F ......lu...V=.}.
3B 11 B3 CF C2 6B 09 29 EC DA 64 59 59 24 59 F3 ;....k.)..dYY$Y.
3F BF CC 3A C6 AC 5F BB 0E DC 22 CF 54 D0 27 2B ?..:.._...".T.'+
A4 14 64 D9 B4 65 D5 BC 1D B7 37 A9 4A A0 7A 2C ..d..e....7.J.z,
E1 A9 1F 3D C3 3D AC F1 8C 93 66 15 8A 61 03 DF ...=.=....f..a..
38 D7 69 F6 52 E8 05 62 7F B1 88 EA 8D E8 8E BC 8.i.R..b........
9B 90 BB FC 68 0B 84 5A BE 4D 6A AE 2D 1A 32 ED ....h..Z.Mj.-.2.
D3 38 CE 19 3D E7 65 E6 98 04 18 0E DA E6 5C 92 .8..=.e.......\.
9D 44 C6 9B BC 01 96 B3 61 F5 14 E7 DD 0C 57 57 .D......a.....WW
0F D3 FA 6B CA A5 9D CF 2F 67 E3 EE 7D 60 D3 5F ...k..../g..}`._
81 93 BF A9 3E 43 21 05 18 5C B9 33 C5 BA 49 52 ....>C!..\.3..IR
58 F0 41 1A 03 29 F6 AC 03 82 75 C5 B7 B1 E6 07 X.A..)....u.....
D6 A4 06 64 9D 3F B4 49 97 5F 8E 88 16 CD B9 8D ...d.?.I._......
09 1B 8C 40 3E 76 02 C4 0D 07 75 55 F6 77 15 2D ...@>v....uU.w.-
D4 3A 8B 44 AC 06 20 A2 A8 E7 6E D2 4D FF 01 5E .:.D.. ...n.M..^
58 D4 58 84 00 00 52 B6 57 02 D4 C4 4C 24 95 90 X.X...R.W...L$..
00

dengert · 2020-03-22T16:04:49Z

@fbezdeka It looks like the card drops the leading byte. It does not inserts a NULL byte.

@Lobik Yes, the APDU shows card returned one less byte then expected. Was output in #1987 (comment) with or without 573193d ?

fbezdeka · 2020-03-22T16:10:08Z

@dengert yes, you are right. It was the other way around. The card removed the NULL byte.

loblik · 2020-03-22T16:22:49Z

@Lobik Yes, the APDU shows card returned one less byte then expected. Was output in #1987 (comment) with or without 573193d ?

That was with that change already included.

dengert · 2020-03-22T16:32:39Z

That leading 00 is a real byte it is the leading 00 of padding and needed to be added back. But not in pkcs15-sec.c which is used by every card. 573193d that last commit I pushed does it in the cardos_decipher routine.

I am very interested in seeing the ADPUs sent in decipher especially from someone who has an old reader that can not do extended APDUs. I want to see if chaining works.

With this patch by setting the max_send_size and max_recv_size using the MIN of card and reader values, if these turn out to be <= 255 and <=256 lower levels of OpenSC will use chaining to split the data sent over 2 or more APDUs.
Without chaining the single decipher APDU would look like 00 2A 80 86 xx ... and may fail if too big.
With chaining the first APDUs would look like 10 2A 80 86 xx ... with last 00 2A 80 86 xx ...

fbezdeka · 2020-03-22T16:35:18Z

I had to remove all "flags" but SC_ALGORITHM_RSA_RAW to get it "running". My first results were identical to the results of @loblik

The remaining problem is now that we are missing the last byte.

--- src/libopensc/card-cardos.c	(revision 45e29056ccde422e70ed3585084a7f150c632515)
+++ src/libopensc/card-cardos.c	(date 1584894619908)
@@ -174,6 +174,8 @@
 	flags = 0;
 	if (card->type == SC_CARD_TYPE_CARDOS_V5_0) {
 		flags |= SC_ALGORITHM_RSA_PAD_PKCS1;
+	} else if(card->type == SC_CARD_TYPE_CARDOS_V5_3) {
+		flags |= SC_ALGORITHM_RSA_RAW;
 	} else {
 		flags |= SC_ALGORITHM_RSA_RAW
 			| SC_ALGORITHM_RSA_HASH_NONE

Using slot 0 with a present token (0x0)
Logging in to "Siemens Corporate ID Card (V5)".
Please enter User PIN: 
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20) 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13) with 1 mechanism
    RSA-X-509: OK
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01) with 1 mechanism
    RSA-X-509: OK
Verify (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13) with 1 mechanism
    RSA-X-509: OK
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01) with 1 mechanism
    RSA-X-509: OK
Decryption (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 54 d8 35 e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d f0 00 10 8b
    Decrypted: 00 54 d8 35 e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d f0 00 10
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 b6 57 02 d4 c4 4c 24 95 c8
    Decrypted: 00 b6 57 02 d4 c4 4c 24 95
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 fe 6b 65 79 5a 90 3c 68 a1 d3 30 c4 39 60 98 1b 1b 87 18 31 6e f4 8b db 7d ff e2 13 b0 4d 52 ae b9 b7 27 13 47 64 7b e9 37 ab ad 70 0b 46 8b 27 cd a3 58 3b 97 e3 16 14 e2 f8 28 92 46 7a 40 ff 32 67 12 79 cb 8e 62 02 39 10 72 45 56 fd 6c 23 a0 c4 5e 38 a7 75 4c 89 6d 74 1b b3 ef 5b b2 21 c2 c5 9a 8e 53 fd 90 8c 0d 03 d1 63 00 3d 86 a1 01 e4 d9 a8 59 25 31 c7 9a 4c 7a 89 a7 2d aa 6a f2 44 f8 45 41 88 d1 4e 8b a3 b1 8c e0 37 2d e2 1c 06 8a 75 2b bc 3c c5 08 b7 4e b0 e4 f8 1a d6 3d 12 1b 7e 9a ec cd 26 8f 7e b2 70 b6 df 52 d2 e5 dc 47 10 98 84 d6 a1 3b 24 51 1f 1d 6b f5 5a 7d 10 d8 17 fc a5 3d 8c 24 ef fc da ce 4e ac b3 2a f3 c4 c3 77 9a 64 b2 be b5 d1 db 20 c6 35 9d d6 0e b4 d3 b3 f2 5f d7 e1 5b b1 b0 a9 5d 63 d3 51 27 96 c8 c1 fa 7b 80 af 4c 5b cf 13 91 6c
    Decrypted: 00 fe 6b 65 79 5a 90 3c 68 a1 d3 30 c4 39 60 98 1b 1b 87 18 31 6e f4 8b db 7d ff e2 13 b0 4d 52 ae b9 b7 27 13 47 64 7b e9 37 ab ad 70 0b 46 8b 27 cd a3 58 3b 97 e3 16 14 e2 f8 28 92 46 7a 40 ff 32 67 12 79 cb 8e 62 02 39 10 72 45 56 fd 6c 23 a0 c4 5e 38 a7 75 4c 89 6d 74 1b b3 ef 5b b2 21 c2 c5 9a 8e 53 fd 90 8c 0d 03 d1 63 00 3d 86 a1 01 e4 d9 a8 59 25 31 c7 9a 4c 7a 89 a7 2d aa 6a f2 44 f8 45 41 88 d1 4e 8b a3 b1 8c e0 37 2d e2 1c 06 8a 75 2b bc 3c c5 08 b7 4e b0 e4 f8 1a d6 3d 12 1b 7e 9a ec cd 26 8f 7e b2 70 b6 df 52 d2 e5 dc 47 10 98 84 d6 a1 3b 24 51 1f 1d 6b f5 5a 7d 10 d8 17 fc a5 3d 8c 24 ef fc da ce 4e ac b3 2a f3 c4 c3 77 9a 64 b2 be b5 d1 db 20 c6 35 9d d6 0e b4 d3 b3 f2 5f d7 e1 5b b1 b0 a9 5d 63 d3 51 27 96 c8 c1 fa 7b 80 af 4c 5b cf 13 91
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 cc e2 ed 58 90 01 05 a4 93
    Decrypted: 00 cc e2 ed 58 90 01 05 a4
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 b1 0f e5 33 a0 cc e3 7f 50 57 1a 73 9e 70 52 88 73 20 31 02 61 11 1f bb d2 5e f6 2e a1 53 3b 52 62 21 85 03 ed 69 82 3e c0 9c b1 5e 0c 03 e6 7f 23 18 82 85 29 a1 40 fc ff 37 2a a0 8a 65 f3 ed 86 78 f0 74 e1 72 b2 a1 0e 63 00 1a 66 e6 9a 8a fe 1c 0f 28 bd 4f 24 bc 86 4e 5c 11 b3 4f fe 3a c8 ee ae a9 60 60 4b 6e c3 4b 88 29 31 22 b3 30 3e c2 58 fb 12 7c b7 98 ca 14 a9 7d 63 a7 b7 2b 95 65 d5 f5 c5 20 63 88 6b ec b2 9c 0e 65 cc 4d 28 24 48 3a a0 00 d2 6a 14 7c e8 77 23 9f a3 b9 05 78 ae ca 98 12 53 03 fe 05 9f 0c 6a 6c 59 92 90 a2 cc 31 a2 9f 9b b6 1b 83 2d 3e 23 d0 f7 28 48 a6 f2 e0 b8 45 e3 b6 4a 83 c2 b5 ef 1c 47 7f be 14 b0 60 b3 4c 16 ce cf 43 0c f2 14 04 1a 5c aa 0d 3d 62 52 20 18 9d a3 da 52 92 f6 99 12 b4 ad c2 14 60 0e 2a 2e de 6e 3b d0 82 3f eb de
    Decrypted: 00 b1 0f e5 33 a0 cc e3 7f 50 57 1a 73 9e 70 52 88 73 20 31 02 61 11 1f bb d2 5e f6 2e a1 53 3b 52 62 21 85 03 ed 69 82 3e c0 9c b1 5e 0c 03 e6 7f 23 18 82 85 29 a1 40 fc ff 37 2a a0 8a 65 f3 ed 86 78 f0 74 e1 72 b2 a1 0e 63 00 1a 66 e6 9a 8a fe 1c 0f 28 bd 4f 24 bc 86 4e 5c 11 b3 4f fe 3a c8 ee ae a9 60 60 4b 6e c3 4b 88 29 31 22 b3 30 3e c2 58 fb 12 7c b7 98 ca 14 a9 7d 63 a7 b7 2b 95 65 d5 f5 c5 20 63 88 6b ec b2 9c 0e 65 cc 4d 28 24 48 3a a0 00 d2 6a 14 7c e8 77 23 9f a3 b9 05 78 ae ca 98 12 53 03 fe 05 9f 0c 6a 6c 59 92 90 a2 cc 31 a2 9f 9b b6 1b 83 2d 3e 23 d0 f7 28 48 a6 f2 e0 b8 45 e3 b6 4a 83 c2 b5 ef 1c 47 7f be 14 b0 60 b3 4c 16 ce cf 43 0c f2 14 04 1a 5c aa 0d 3d 62 52 20 18 9d a3 da 52 92 f6 99 12 b4 ad c2 14 60 0e 2a 2e de 6e 3b d0 82 3f eb
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 f2 0c 93 94 e9 0b 01 0c fb
    Decrypted: 00 f2 0c 93 94 e9 0b 01 0c
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 df ad 74 4b 70 3c dd 77 ff 45 ee 1a 5c 84 82 32 56 18 fd 7b 17 ef 39 08 15 1d 38 b5 ad 37 bb 8c e4 2f d7 55 6c b5 cc 6b fa ba 86 56 3f 08 89 95 20 86 11 37 75 4a 3f 8a 67 77 40 14 af fb a0 93 2b 77 e8 97 2c b4 02 27 6f 88 7d ae 90 06 43 b1 8c 54 e8 01 9e 28 8c 05 9f cc 19 4e c7 b9 e2 f2 31 ca 89 5d 7f 8c 84 ee 14 02 9c a5 08 df 56 95 34 3e 96 d2 66 22 d8 06 ee f1 54 b6 ab 36 a8 dc 01 32 39 80 be be 6e d2 c0 0a 77 c8 e9 cd 5d 1d 0c f4 f0 72 16 c8 78 05 b9 cd bb 64 03 63 40 04 95 7a 84 53 38 f2 26 f8 fc 9d c0 e6 6b 1e 03 77 12 f3 e9 28 bb 62 2d 75 2f e8 d9 32 4c 1a 37 e1 94 bb 35 cc ae 5b c4 aa f8 84 90 63 a2 94 da b4 87 c4 dd 43 26 0a b8 55 f3 91 87 3f ab be 20 3f 7a 55 0b 28 b0 cf d2 a9 54 63 0c f6 f7 e7 ab 7e ab 88 c1 d1 92 79 26 85 0b ad c4 b6 6c e5 f6
    Decrypted: 00 df ad 74 4b 70 3c dd 77 ff 45 ee 1a 5c 84 82 32 56 18 fd 7b 17 ef 39 08 15 1d 38 b5 ad 37 bb 8c e4 2f d7 55 6c b5 cc 6b fa ba 86 56 3f 08 89 95 20 86 11 37 75 4a 3f 8a 67 77 40 14 af fb a0 93 2b 77 e8 97 2c b4 02 27 6f 88 7d ae 90 06 43 b1 8c 54 e8 01 9e 28 8c 05 9f cc 19 4e c7 b9 e2 f2 31 ca 89 5d 7f 8c 84 ee 14 02 9c a5 08 df 56 95 34 3e 96 d2 66 22 d8 06 ee f1 54 b6 ab 36 a8 dc 01 32 39 80 be be 6e d2 c0 0a 77 c8 e9 cd 5d 1d 0c f4 f0 72 16 c8 78 05 b9 cd bb 64 03 63 40 04 95 7a 84 53 38 f2 26 f8 fc 9d c0 e6 6b 1e 03 77 12 f3 e9 28 bb 62 2d 75 2f e8 d9 32 4c 1a 37 e1 94 bb 35 cc ae 5b c4 aa f8 84 90 63 a2 94 da b4 87 c4 dd 43 26 0a b8 55 f3 91 87 3f ab be 20 3f 7a 55 0b 28 b0 cf d2 a9 54 63 0c f6 f7 e7 ab 7e ab 88 c1 d1 92 79 26 85 0b ad c4 b6 6c e5
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 bd cc 95 e9 8e 8c 29 34 17
    Decrypted: 00 bd cc 95 e9 8e 8c 29 34
8 errors

fbezdeka · 2020-03-22T16:48:16Z

Playing around with the flags it turns out that SC_ALGORITHM_NEED_USAGE is the bad one in my case.

	} else if(card->type == SC_CARD_TYPE_CARDOS_V5_3) {
		flags |= SC_ALGORITHM_RSA_RAW
			| SC_ALGORITHM_RSA_PAD_PKCS1
                  	| SC_ALGORITHM_RSA_HASH_NONE 
                        | SC_ALGORITHM_ONBOARD_KEY_GEN; 
       }

This produces the same results as above.

dengert · 2020-03-22T16:59:05Z

Just pushed fix for last byte;
r++;

The SC_ALGORITHM_NEED_USAGE can cause pkcs15-sec.clinre 609 sc_pkcs15_compute_signature to try and use decipher to do a sign.
So with missing last byte, signatures would also fail.

@loblik all the verify failure look strange but could be caused by missing last byte.
If the r++ does not work can I ask both of you to send me a full opensc-debug.log with everything in it.You can remove PIN
and even certificates if you want.)

Things like what is being used for the max_send_size and max_recv_size are now based on the reader and card parameters, what is the data_field_length from the card, is chaining being used or not, what path is signatures and decrypt using for RAW vs PKCS1 is much easier if I could see all of that and others things as well.

Also note that when building the code yourself, unless you specify where the opensc-pkcs11.so will reside, you may have to use the pkcs11-tool --module

fbezdeka · 2020-03-22T17:02:45Z

With 1318fac included (and SC_ALGORITHM_NEED_USAGE removed) I get the following:

Summary: RSA-PKCS: ERR: verification failed, some padding infront? and invalid last byte.

Using slot 0 with a present token (0x0)
Logging in to "Siemens Corporate ID Card (V5)".
Please enter User PIN: 
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20) 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: ERR: verification failed
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13) with 1 mechanism
    RSA-X-509: OK
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01) with 1 mechanism
    RSA-X-509: OK
Verify (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509: OK
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13) with 1 mechanism
    RSA-X-509: OK
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01) with 1 mechanism
    RSA-X-509: OK
Decryption (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 d0 85 fa 54 d8 35 e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d f0
    Decrypted: 00 d0 85 fa 54 d8 35 e8 d4 66 82 64 98 d9 a8 87 75 65 70 5a 8a 3f 62 80 29 44 de 7c a5 89 4e 57 59 d3 51 ad ac 86 95 80 ec 17 e4 85 f1 8c 0c 66 f1 7c c0 7c bb 22 fc e4 66 da 61 0b 63 af 62 bc 83 b4 69 2f 3a ff af 27 16 93 ac 07 1f b8 6d 11 34 2d 8d ef 4f 89 d4 b6 63 35 c1 c7 e4 24 83 67 d8 ed 96 12 ec 45 39 02 d8 e5 0a f8 9d 77 09 d1 a5 96 c1 f4 1f 95 aa 82 ca 6c 49 ae 90 cd 16 68 ba ac 7a a6 f2 b4 a8 ca 99 b2 c2 37 2a cb 08 cf 61 c9 c3 80 5e 6e 03 28 da 4c d7 6a 19 ed d2 d3 99 4c 79 8b 00 22 56 9a d4 18 d1 fe e4 d9 cd 45 a3 91 c6 01 ff c9 2a d9 15 01 43 2f ee 15 02 87 61 7c 13 62 9e 69 fc 72 81 cd 71 65 a6 3e ab 49 cf 71 4b ce 3a 75 a7 4f 76 ea 7e 64 ff 81 eb 61 fd fe c3 9b 67 bf 0d e9 8c 7e 4e 32 bd f9 7c 8c 6a c7 5b a4 3c 02 f4 b2 ed 72 16 ec f3 01 4d 00
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 de 3d 52 b6 57 02 d4 c4 4c
    Decrypted: 00 02 26 04 46 1e ab 18 5e a1 56 87 9b 6f e3 80 c9 63 da da be c8 42 b9 e1 dc 90 a9 15 83 0a 02 a4 41 95 78 8c 29 f3 da c7 8d ee e6 2b 0b 6e aa 9f fd 04 ba be 7e ad ed d8 52 0f d6 82 35 4a 43 ca cd 46 6f f1 f4 23 d2 7e e6 24 8e 46 2d 77 9b 0a 59 d9 72 54 07 23 f8 e7 b5 a4 7c 76 87 46 80 13 e6 f6 d3 d4 1f 83 b2 62 47 91 85 7a 31 89 b7 3d 46 80 c4 54 f9 d9 d7 50 23 1b 7f e9 0e d2 c5 ca 79 ba 56 af b2 e2 95 40 eb 9d 26 7f cf 9d e9 11 ab cb 52 7d a1 d0 4d 6b 7f 4e 2f e3 51 9f 7c 8b 0c c5 9c 21 26 ec 24 16 54 c5 75 a0 b3 9e eb 99 ec 47 0f 9f 6a 23 81 58 b8 bd ff 12 de c2 c9 e9 c5 8c 91 8d db f3 5c f1 4d e3 df df 1c cd 52 f0 86 74 7b c0 6a 4f 2c 4e c5 af cf 46 76 8b 09 4a ff fe f6 06 e6 d8 2a 31 cb e8 cb 21 f0 60 ae c6 de 01 e0 2f 00 00 de 3d 52 b6 57 02 d4 c4 00
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 b1 6b 3f fe 6b 65 79 5a 90 3c 68 a1 d3 30 c4 39 60 98 1b 1b 87 18 31 6e f4 8b db 7d ff e2 13 b0 4d 52 ae b9 b7 27 13 47 64 7b e9 37 ab ad 70 0b 46 8b 27 cd a3 58 3b 97 e3 16 14 e2 f8 28 92 46 7a 40 ff 32 67 12 79 cb 8e 62 02 39 10 72 45 56 fd 6c 23 a0 c4 5e 38 a7 75 4c 89 6d 74 1b b3 ef 5b b2 21 c2 c5 9a 8e 53 fd 90 8c 0d 03 d1 63 00 3d 86 a1 01 e4 d9 a8 59 25 31 c7 9a 4c 7a 89 a7 2d aa 6a f2 44 f8 45 41 88 d1 4e 8b a3 b1 8c e0 37 2d e2 1c 06 8a 75 2b bc 3c c5 08 b7 4e b0 e4 f8 1a d6 3d 12 1b 7e 9a ec cd 26 8f 7e b2 70 b6 df 52 d2 e5 dc 47 10 98 84 d6 a1 3b 24 51 1f 1d 6b f5 5a 7d 10 d8 17 fc a5 3d 8c 24 ef fc da ce 4e ac b3 2a f3 c4 c3 77 9a 64 b2 be b5 d1 db 20 c6 35 9d d6 0e b4 d3 b3 f2 5f d7 e1 5b b1 b0 a9 5d 63 d3 51 27 96 c8 c1 fa 7b 80 af 4c 5b cf
    Decrypted: 00 b1 6b 3f fe 6b 65 79 5a 90 3c 68 a1 d3 30 c4 39 60 98 1b 1b 87 18 31 6e f4 8b db 7d ff e2 13 b0 4d 52 ae b9 b7 27 13 47 64 7b e9 37 ab ad 70 0b 46 8b 27 cd a3 58 3b 97 e3 16 14 e2 f8 28 92 46 7a 40 ff 32 67 12 79 cb 8e 62 02 39 10 72 45 56 fd 6c 23 a0 c4 5e 38 a7 75 4c 89 6d 74 1b b3 ef 5b b2 21 c2 c5 9a 8e 53 fd 90 8c 0d 03 d1 63 00 3d 86 a1 01 e4 d9 a8 59 25 31 c7 9a 4c 7a 89 a7 2d aa 6a f2 44 f8 45 41 88 d1 4e 8b a3 b1 8c e0 37 2d e2 1c 06 8a 75 2b bc 3c c5 08 b7 4e b0 e4 f8 1a d6 3d 12 1b 7e 9a ec cd 26 8f 7e b2 70 b6 df 52 d2 e5 dc 47 10 98 84 d6 a1 3b 24 51 1f 1d 6b f5 5a 7d 10 d8 17 fc a5 3d 8c 24 ef fc da ce 4e ac b3 2a f3 c4 c3 77 9a 64 b2 be b5 d1 db 20 c6 35 9d d6 0e b4 d3 b3 f2 5f d7 e1 5b b1 b0 a9 5d 63 d3 51 27 96 c8 c1 fa 7b 80 af 4c 5b 00
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 c6 60 b8 cc e2 ed 58 90 01
    Decrypted: 00 02 60 4b 59 3a 03 34 bc 08 b8 4f 33 b7 f2 f9 24 bb fc 69 21 ba f9 91 0a ac ed 97 76 66 3c 21 60 01 42 ec 2e 38 55 7d df 11 c8 34 18 8a c4 83 ac 3f ca 10 58 24 91 e4 35 ee c6 bd e1 0d dc b7 4f c7 5b 42 64 e0 cd ba 14 6d a9 f0 49 ec 79 56 c0 91 b5 d2 38 e3 a7 14 be 09 68 86 96 87 58 72 a5 4a e1 0b 9c be 94 94 f2 47 6e d7 30 be df 06 5a 83 01 43 76 28 29 64 77 36 3d 14 d0 a9 a3 d2 78 26 96 d9 d4 43 87 9e 6f fc 0b b1 94 07 3a 18 22 35 77 f2 c6 4c c0 bc 6c d5 8a 69 b1 ee 72 18 2b de 3a 35 8f b8 40 8f bb 5e 60 3f 27 19 35 e6 8e 2b e7 57 e1 59 e9 17 85 31 95 5c 2f 54 87 0d 88 f5 63 88 54 da 02 63 92 b2 e8 7c ac 0e 35 4a a3 a8 d2 d6 58 a9 7c a1 5e 26 dd 62 d7 d3 99 aa a3 55 8d da 5e c5 d3 68 97 7e 57 80 8a a3 51 ed 1b 20 2e 07 e5 00 00 c6 60 b8 cc e2 ed 58 90 00
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 43 5d 0d b1 0f e5 33 a0 cc e3 7f 50 57 1a 73 9e 70 52 88 73 20 31 02 61 11 1f bb d2 5e f6 2e a1 53 3b 52 62 21 85 03 ed 69 82 3e c0 9c b1 5e 0c 03 e6 7f 23 18 82 85 29 a1 40 fc ff 37 2a a0 8a 65 f3 ed 86 78 f0 74 e1 72 b2 a1 0e 63 00 1a 66 e6 9a 8a fe 1c 0f 28 bd 4f 24 bc 86 4e 5c 11 b3 4f fe 3a c8 ee ae a9 60 60 4b 6e c3 4b 88 29 31 22 b3 30 3e c2 58 fb 12 7c b7 98 ca 14 a9 7d 63 a7 b7 2b 95 65 d5 f5 c5 20 63 88 6b ec b2 9c 0e 65 cc 4d 28 24 48 3a a0 00 d2 6a 14 7c e8 77 23 9f a3 b9 05 78 ae ca 98 12 53 03 fe 05 9f 0c 6a 6c 59 92 90 a2 cc 31 a2 9f 9b b6 1b 83 2d 3e 23 d0 f7 28 48 a6 f2 e0 b8 45 e3 b6 4a 83 c2 b5 ef 1c 47 7f be 14 b0 60 b3 4c 16 ce cf 43 0c f2 14 04 1a 5c aa 0d 3d 62 52 20 18 9d a3 da 52 92 f6 99 12 b4 ad c2 14 60 0e 2a 2e de 6e 3b d0 82
    Decrypted: 00 43 5d 0d b1 0f e5 33 a0 cc e3 7f 50 57 1a 73 9e 70 52 88 73 20 31 02 61 11 1f bb d2 5e f6 2e a1 53 3b 52 62 21 85 03 ed 69 82 3e c0 9c b1 5e 0c 03 e6 7f 23 18 82 85 29 a1 40 fc ff 37 2a a0 8a 65 f3 ed 86 78 f0 74 e1 72 b2 a1 0e 63 00 1a 66 e6 9a 8a fe 1c 0f 28 bd 4f 24 bc 86 4e 5c 11 b3 4f fe 3a c8 ee ae a9 60 60 4b 6e c3 4b 88 29 31 22 b3 30 3e c2 58 fb 12 7c b7 98 ca 14 a9 7d 63 a7 b7 2b 95 65 d5 f5 c5 20 63 88 6b ec b2 9c 0e 65 cc 4d 28 24 48 3a a0 00 d2 6a 14 7c e8 77 23 9f a3 b9 05 78 ae ca 98 12 53 03 fe 05 9f 0c 6a 6c 59 92 90 a2 cc 31 a2 9f 9b b6 1b 83 2d 3e 23 d0 f7 28 48 a6 f2 e0 b8 45 e3 b6 4a 83 c2 b5 ef 1c 47 7f be 14 b0 60 b3 4c 16 ce cf 43 0c f2 14 04 1a 5c aa 0d 3d 62 52 20 18 9d a3 da 52 92 f6 99 12 b4 ad c2 14 60 0e 2a 2e de 6e 3b d0 00
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 0f 0d 53 f2 0c 93 94 e9 0b
    Decrypted: 00 02 16 c5 4e de 5e 99 47 27 58 25 45 60 5e 69 35 e0 74 da 33 6b 61 49 4c 98 cf d0 71 b9 39 78 40 92 60 42 ec ed 24 fc 39 83 07 f9 a0 04 be 40 db 66 e7 98 50 73 8a 6c a0 a5 a8 1f c4 0e a5 7a fa a2 56 05 3d 1f 64 5b 5b 14 d7 c1 ee 64 85 ef cf 63 58 34 f8 df a4 c9 3d 5f 92 81 0b 2e 8a fe 95 43 05 fd 2b 35 bf b1 32 8e a4 39 70 f1 c8 88 2e c3 3d 56 da 98 c0 ef f6 da 2a f7 61 fa a5 ea 67 4a 72 6a 7c 3e c2 21 fb 1a 74 33 b4 79 33 06 ed ea 9a da cf 05 1c 70 ac ca 28 0c 14 af 93 c5 d8 c0 77 26 b4 7f 7e d1 a1 7e 05 b2 d4 17 82 5b 0b 1b 33 d3 3c 8f 98 3c 34 ae 89 1e 5b ca 95 38 97 b7 1f 47 d2 eb 05 53 27 4e 67 1e c0 8a c3 ab 21 ad 4c 49 49 08 6a 47 7b 73 a3 2a e2 9a a6 d4 f6 92 04 2a 59 ac 49 ce de eb 57 7d 46 3d 1c 1a 97 ed 5a 04 d2 00 00 0f 0d 53 f2 0c 93 94 e9 00
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 90 ff 06 df ad 74 4b 70 3c dd 77 ff 45 ee 1a 5c 84 82 32 56 18 fd 7b 17 ef 39 08 15 1d 38 b5 ad 37 bb 8c e4 2f d7 55 6c b5 cc 6b fa ba 86 56 3f 08 89 95 20 86 11 37 75 4a 3f 8a 67 77 40 14 af fb a0 93 2b 77 e8 97 2c b4 02 27 6f 88 7d ae 90 06 43 b1 8c 54 e8 01 9e 28 8c 05 9f cc 19 4e c7 b9 e2 f2 31 ca 89 5d 7f 8c 84 ee 14 02 9c a5 08 df 56 95 34 3e 96 d2 66 22 d8 06 ee f1 54 b6 ab 36 a8 dc 01 32 39 80 be be 6e d2 c0 0a 77 c8 e9 cd 5d 1d 0c f4 f0 72 16 c8 78 05 b9 cd bb 64 03 63 40 04 95 7a 84 53 38 f2 26 f8 fc 9d c0 e6 6b 1e 03 77 12 f3 e9 28 bb 62 2d 75 2f e8 d9 32 4c 1a 37 e1 94 bb 35 cc ae 5b c4 aa f8 84 90 63 a2 94 da b4 87 c4 dd 43 26 0a b8 55 f3 91 87 3f ab be 20 3f 7a 55 0b 28 b0 cf d2 a9 54 63 0c f6 f7 e7 ab 7e ab 88 c1 d1 92 79 26 85 0b ad c4 b6
    Decrypted: 00 90 ff 06 df ad 74 4b 70 3c dd 77 ff 45 ee 1a 5c 84 82 32 56 18 fd 7b 17 ef 39 08 15 1d 38 b5 ad 37 bb 8c e4 2f d7 55 6c b5 cc 6b fa ba 86 56 3f 08 89 95 20 86 11 37 75 4a 3f 8a 67 77 40 14 af fb a0 93 2b 77 e8 97 2c b4 02 27 6f 88 7d ae 90 06 43 b1 8c 54 e8 01 9e 28 8c 05 9f cc 19 4e c7 b9 e2 f2 31 ca 89 5d 7f 8c 84 ee 14 02 9c a5 08 df 56 95 34 3e 96 d2 66 22 d8 06 ee f1 54 b6 ab 36 a8 dc 01 32 39 80 be be 6e d2 c0 0a 77 c8 e9 cd 5d 1d 0c f4 f0 72 16 c8 78 05 b9 cd bb 64 03 63 40 04 95 7a 84 53 38 f2 26 f8 fc 9d c0 e6 6b 1e 03 77 12 f3 e9 28 bb 62 2d 75 2f e8 d9 32 4c 1a 37 e1 94 bb 35 cc ae 5b c4 aa f8 84 90 63 a2 94 da b4 87 c4 dd 43 26 0a b8 55 f3 91 87 3f ab be 20 3f 7a 55 0b 28 b0 cf d2 a9 54 63 0c f6 f7 e7 ab 7e ab 88 c1 d1 92 79 26 85 0b ad c4 00
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 2b 81 91 bd cc 95 e9 8e 8c
    Decrypted: 00 02 d3 bf f2 23 ee f7 a0 63 97 20 31 48 cb 3a 4f 71 14 cd ed 10 c7 87 a3 fc c0 76 80 76 2c f8 5a 15 28 53 3f 3a cb 40 e4 d5 fb 62 46 8a f0 b4 f9 03 e8 bb 3b ca 7f af 8e 9a 81 3b e9 4d af 12 a7 47 f1 79 8d f2 99 09 c5 0e 2b 9d f3 8f da 53 93 28 b8 06 53 fa 68 4f cb 22 a4 81 76 fb 7f 1e 36 24 c1 3d e2 8d 1f 1d 79 a6 b2 5e 05 45 89 96 b5 fe 27 0c 91 5b 08 0c c6 dc 83 0e d9 0d 47 7b b5 ac 61 d0 e9 c4 95 bc 47 d8 cd 0f d0 ed 44 6f 51 02 89 aa 3b 78 6a 79 46 67 54 97 43 ab 80 a7 06 a0 23 a2 b4 92 65 e5 da e5 79 c4 17 f0 4b 80 63 97 2a 57 9b 1b 71 cc 8a c0 05 b8 80 5c 1d bb f9 de f9 e2 d3 91 97 0c 54 b0 a2 a3 2b c5 79 ec 74 36 3a ce 04 86 78 a8 8e 59 6d a9 99 d6 e1 1a cd 40 72 ba 7f e9 02 56 77 60 15 69 3a c5 a6 ea 8f 25 e0 b1 a8 00 00 2b 81 91 bd cc 95 e9 8e 00
10 errors

loblik · 2020-03-22T17:07:54Z

With 1318fac included (and SC_ALGORITHM_NEED_USAGE removed) I get the following:

I can confirm this. Exactly the same behavior here.

dengert · 2020-03-22T17:25:50Z

Please send a full opensc-debug.log.

loblik · 2020-03-22T18:11:16Z

Tested before 78d5623. debug_cardos5.3.log

fbezdeka · 2020-03-22T18:15:06Z

78d5623 seems to break everything.

...
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01) with 1 mechanism
  ERR: wrong signature length: 258 instead of 256
...
Verify (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
...
Decryption (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
error: PKCS11 function C_Decrypt failed: rv = CKR_BUFFER_TOO_SMALL (0x150)
Aborting.

Edit: Is the order of the memcpy and the sc_mem_clear call really right?

Edit 2: And where is out_tmp cleaned up / freed?

dengert · 2020-03-22T18:21:13Z

r++ in wrong place, fails to copy last byte. See last commit. Sounds like that failed.

Where is the opensc-debug.log

F-CardOS_DI_V5-3_Enterprise_en1-web.pdf states:

Asymmetric algorithms:

RSA based on CRT with and without a specified public exponent with key length up to 4096 bit,
PKCS#1-BT1 or PKCS#1-BT2 padding,
PSS Padding according to PKCS#1 V2.1,
Elliptic Curve Cryptography based on GF(p) with key length up to 521 bit.
Calculation of cryptographic hash values with SHA-1, SHA-224, SHA-256, SHA-384, SHA512,

The way I read this and what we have seen so far, is the card does not support SC_ALGORITHM_RSA_RAW which is the same as SC_ALGORITHM_RSA_HASH_NONE both = 0x01
But does support SC_ALGORITHM_RSA_PAD_PKCS1 (and according to the above, it supports SC_ALGORITHM_RSA_PAD_PSS) but that would be another PR if we can get this working.

Itis not clear if the stripping of the padding is being done on the card or is OpenSC. I think it is in software. A RSA RAW operation is the first decryption.

But only an opensc-debug.log wouldshow it this is true or not.

loblik · 2020-03-22T18:47:25Z

But only an opensc-debug.log wouldshow it this is true or not.

I've posted one in #1987 (comment) . Or is that not the right one?

dengert · 2020-03-22T18:57:46Z

Yes was done before 78d5623

I am going to make one more change, and that is to turn off SC_ALGORITHM_RSA_RAW.

loblik · 2020-03-22T19:50:52Z

Tested with latest changes. Everything fails now. Log: debug_cardos5.3.log

fbezdeka · 2020-03-22T19:56:07Z

Same here, so I added SC_ALGORITHM_RSA_RAW again.

<ALL OK>
...
Decryption (currently only for RSA)
  testing key 0 (Encr 10.05.17 09:32:43 - 10.05.20)
    RSA-X-509: OK
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 b6 57 02 d4 c4 4c 24 95 c8
    Decrypted: 00 02 10 a6 2d 0b d4 f8 58 2f 8a c1 93 e1 3d 63 c1 f4 95 fc 17 dc 9b ab 4d 88 0b f5 43 b0 46 99 7e c7 53 b3 06 52 6f 06 7f e2 6c 27 4a bd 38 b5 48 02 7e 97 97 a5 42 1b 67 de 0f 71 3a 1e ac 3f 19 e9 0a 0f 77 b1 78 2e 9b 65 9d 20 47 fb 7c 20 a6 83 a6 4d b9 cc b3 f3 44 a2 9d ec 13 74 fa 9f 3a 2e 54 fc 98 ef 6f cb b2 01 83 46 27 89 24 88 43 9a 20 1d a0 ce 52 14 ef df 86 ae 56 95 2a ad ce 62 8d 82 cc 0a da b5 50 59 85 23 33 8d cb 5c bf 36 a6 fe 2d df b6 2d 3c ec df 65 e9 3c 91 ca 6b 5b ac 45 75 59 23 79 96 d2 6d b4 1b df 4c 83 dd e3 38 d6 48 ca 8c 68 35 e8 20 5f 17 61 8d de 0a 40 9a 2e ee f1 32 e0 19 69 4e 47 9f 47 05 82 04 9a 01 9b 0b 4a a8 c9 fe 06 1d d1 02 b1 9d af f7 21 ec a5 db 0f e0 a7 da 3b 79 c6 d9 fb 4b 94 7a f2 7a 8e be 00 00 b6 57 02 d4 c4 4c 24 95 c8
  testing key 1 (Encr 09.01.13 11:25:12 - 09.01.14)
    RSA-X-509: OK
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 cc e2 ed 58 90 01 05 a4 93
    Decrypted: 00 02 6e ff 09 ae c9 0f 30 7f df 7d 09 8d 46 bf cf ec c0 19 cf fa 1c 08 f6 1c ab c4 3c f0 e1 29 a4 3b 03 d2 c3 7a 65 79 2c 77 ca 9e 9d b8 89 4c b1 fc 69 5e 82 2e 6d c8 47 72 a5 9e 2e 71 ad 6f c3 11 20 3b 42 89 97 df b4 64 aa b1 b5 7a 0a eb 3c 7c c0 a5 64 62 43 3f 46 8d 09 29 a9 f2 65 c8 b5 ff fa c3 82 51 94 ea 61 70 95 c4 64 34 18 a4 7d fe c6 4f 54 e9 6d 4b a9 93 d1 64 aa 79 42 7b 31 0d 80 2a f6 27 c7 5a ff 71 f1 1a 5a 6b 4b 90 8e f1 ec 45 78 79 76 90 94 a3 a4 77 ca a3 78 98 f4 bd cc d6 cc 3d f8 0e e8 77 cd 2b ff 67 4d 1b 09 17 be 6e 56 73 02 0a 8b 5e f5 c5 3d d8 92 46 f2 d5 2f b1 bd d6 7a 30 0e b1 15 0e 0c 87 6a 35 75 1b 95 82 f7 75 fb 35 41 ae 53 5d b3 95 ef 52 3d 0d b2 a0 b7 f3 50 4b 8c df 3b e1 b7 69 b2 e8 f7 51 54 83 1f 00 00 cc e2 ed 58 90 01 05 a4 93
  testing key 2 (Encr 13.02.12 11:20:05 - 13.02.13)
    RSA-X-509: OK
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 f2 0c 93 94 e9 0b 01 0c fb
    Decrypted: 00 02 e1 4c f0 72 e9 1d 37 a8 41 15 a6 b6 9f 42 ba 6a 63 b6 93 b4 ee 5f be d2 e1 09 88 d8 c8 06 bc 8f b3 3e c1 c6 84 42 79 d6 51 5b 47 eb 2a cb 01 36 9b 1b 8d b8 3d 93 22 7a da 01 c9 83 4d 40 cb 1d ed cd 4b 34 77 29 03 3d af 91 d5 9e 49 d3 6b 60 89 2a 58 1d 54 f6 a0 f6 13 f4 9c 4d 92 c8 c0 67 55 e4 b0 9d 2b a1 54 6c df 71 2a 92 c2 b3 9d fc 27 45 b8 25 92 1b 95 bb 9f 51 98 c2 d5 a5 9c 99 5c 5f 6a 78 f8 39 01 33 11 a7 58 56 10 11 84 14 64 2c 80 4a e5 02 e8 21 5d 43 f9 52 fc 4f a7 9f 92 cb c5 23 77 8f db b9 3a a3 cb 4b 72 af f4 ea fe 01 c8 76 56 77 ca 96 b1 e1 51 ed 28 b0 f4 cf 83 59 43 fe a6 91 4e 05 82 37 ea f0 d6 a8 ff 50 7c 79 30 c4 6e 5b 55 27 20 55 9d 4e 0a d7 10 99 2a 55 ef cc 65 dc 12 7f 5c 4e e1 9c cf 3d 5e d0 34 31 46 00 00 f2 0c 93 94 e9 0b 01 0c fb
  testing key 3 (Auth 27.08.17 20:34:39 - 01.01.01)
    RSA-X-509: OK
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 bd cc 95 e9 8e 8c 29 34 17
    Decrypted: 00 02 7b 0b a6 0e 47 8d 37 9e 1f de c6 ca 59 3c f7 5f 6d 4f 06 96 38 47 5c 12 6a 4a c5 e8 63 25 26 74 1a 72 ec 3b c0 ba 6a 13 91 f9 85 1a 3d 2c e5 87 58 20 a8 aa 8a 1e 4b 7e b1 0f de 10 ff b8 ba f0 bc e3 cd f0 7e 98 39 30 3f 7a 23 a6 24 e6 c6 d3 15 ba 67 96 0a 78 c3 7b 7f 77 b5 61 e5 de 9b c1 77 1e 27 97 3a 19 ad 34 3e ba 91 0b a6 fe 7c 67 06 46 8d 2b c1 a5 b2 48 43 d8 0d c5 1d 3e 47 f4 01 95 ed 3d b2 0c b0 ca 93 47 7a 82 b1 d1 ae e1 87 9a 93 9e 27 63 d4 5a b8 c9 9f aa fa 6e ed 2b c4 f1 19 7b 1e 5b 9f de 42 71 04 f6 b5 0f ea a0 70 f2 90 ea ab 05 6d 42 80 e7 4a 34 a5 7f 6f 5b 6f 62 29 47 98 e8 6c c4 e1 6b fa fc e0 22 32 68 52 23 8f 6f 02 6b 6c 91 c3 55 b0 99 77 34 5d 3b 46 15 3c 68 0e 0c c2 4d 98 f6 b7 d8 dd 46 f7 4c c5 e0 59 00 00 bd cc 95 e9 8e 8c 29 34 17
4 errors

Looks like some kind of padding, right?

fbezdeka · 2020-03-22T20:19:59Z

Sorry for the ugly style (end of time for today), but this one fixes all errors (with SC_ALGORITHM_RSA_RAW set):

...
    sc_mem_clear(out_tmp, outlen + 2);
    free(out_tmp);
    int old_r = r;
    size_t s = r;
    r = sc_pkcs1_strip_02_padding(card->ctx, out, s, out, &s);

    if (r < 0)
        r = old_r;
...

dengert · 2020-03-22T21:16:19Z

@loblik in #1987 (comment) you said everything failed. Can you also sent the pkcs11 output?

The cardos5.3.log all the "pkcs11-object.c:929:C_Decrypt: C_Decrypt()" say "= CKR_OK" They all look correct, and the ADPU.s look like good if we add the leading 00, and the patch corrected for leading zero, but only the output of pkcs11-tool would show if the patch is working as expected show what it sees.

@fbezdeka you said "Same here, so I added SC_ALGORITHM_RSA_RAW again.".
But you did not send the debug log or the output of pkcs11-tool with my changes.

I still have not seen if the APDUs are as expected. or padding is being removed.

I still contend the card does not actually do SC_ALGORITHM_RSA_RAW for a sign operation, but is using the tricks in OpenSC to call sc_pkcs15_decipher that ends up calling cardos_decipher.

From what I can read, they removed RAW in v5_0 and did not add it back in in 5_3.

You also said; "Looks like some kind of padding, right?". Yes it does, and it should have been stripped in pkcs15-sec.c here:

287         /* Strip any padding */
288         if (pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1) {
289                 size_t s = r;
290                 r = sc_pkcs1_strip_02_padding(ctx, out, s, out, &s);
291                 LOG_TEST_RET(ctx, r, "Invalid PKCS#1 padding");
292         }

The code to add the leading byte may still be wrong.

Look at these two line from your output:

 Original: 00 b6 57 02 d4 c4 4c 24 95 c8

 Decrypted: 00 02 10 a6 2d 0b d4 f8 58 2f 8a c1 93 e1 3d 63 c1 f4 95 fc 17 dc 9b ab 4d 88 0b f5 43 b0 46 99 7e c7 53 b3 06 52 6f 06 7f e2 6c 27 4a bd 38 b5 48 02 7e 97 97 a5 42 1b 67 de 0f 71 3a 1e ac 3f 19 e9 0a 0f 77 b1 78 2e 9b 65 9d 20 47 fb 7c 20 a6 83 a6 4d b9 cc b3 f3 44 a2 9d ec 13 74 fa 9f 3a 2e 54 fc 98 ef 6f cb b2 01 83 46 27 89 24 88 43 9a 20 1d a0 ce 52 14 ef df 86 ae 56 95 2a ad ce 62 8d 82 cc 0a da b5 50 59 85 23 33 8d cb 5c bf 36 a6 fe 2d df b6 2d 3c ec df 65 e9 3c 91 ca 6b 5b ac 45 75 59 23 79 96 d2 6d b4 1b df 4c 83 dd e3 38 d6 48 ca 8c 68 35 e8 20 5f 17 61 8d de 0a 40 9a 2e ee f1 32 e0 19 69 4e 47 9f 47 05 82 04 9a 01 9b 0b 4a a8 c9 fe 06 1d d1 02 b1 9d af f7 21 ec a5 db 0f e0 a7 da 3b 79 c6 d9 fb 4b 94 7a f2 7a 8e be 00 00 b6 57 02 d4 c4 4c 24 95 c8

and you will see the block should have been stripped by sc_pkcs1_strip_02_padding leaving the last 10 bytes which match the Original.

loblik · 2020-03-22T21:35:03Z

Here is new log: debug_cardos5.3.log

And corresponding pkcs11-tool output:

Logging in to "Siemens Corporate ID Card (V8)".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22)
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-PKCS: ERR: verification failed
    SHA1-RSA-PKCS: ERR: verification failed
    MD5-RSA-PKCS: ERR: verification failed
    RIPEMD160-RSA-PKCS: ERR: verification failed
    SHA256-RSA-PKCS: ERR: verification failed
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22) with 1 mechanism
    RSA-PKCS: ERR: verification failed
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21) with 1 mechanism
    RSA-PKCS: ERR: verification failed
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18) with 1 mechanism
    RSA-PKCS: ERR: verification failed
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18) with 1 mechanism
    RSA-PKCS: ERR: verification failed
Verify (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22)
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
Decryption (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 47 64 bd 1f 23 1e a8 1c 7b
    Decrypted: 00 02 7d 45 89 d9 5d ee 30 72 a6 2b 8f 3f 67 ae 70 e8 50 28 2a 97 a4 39 7d 8b a7 b8 d8 9a 07 03 f3 cb f6 79 97 a9 d6 49 54 b5 ae 3d 29 5c 19 19 a6 17 89 0d 0b 06 44 8e a6 ad d1 dd de ff 3a 41 7c 7d 36 6f 5f eb f5 4d c5 f2 ed e2 05 be 0d c0 ff 4b c2 5e 72 5b b1 7f 01 f0 ca 1a 3a b9 96 08 f6 43 fc 0e 45 0c 76 2f 98 f9 86 49 c2 55 26 77 5d 21 c7 f3 ea c2 cd 4c 9f 96 82 06 ad 40 d4 31 5e ff 1c 0f ba 55 a0 7f 2a e8 f1 ec 58 cf 67 be 4c 52 35 1d 20 d2 46 45 0f 03 e0 10 cf c1 7b 15 ab 1a 7b 6c c7 6f 77 de 1a 8d 92 ca e2 ef 37 06 10 df d8 39 91 78 1a 7a 61 73 7f d9 f7 af 48 9e f6 3a 58 cd af 95 1d 11 cb 55 63 89 3c 37 5e 74 8f 1b bc 7e 57 d2 53 e0 71 c4 c7 ec 59 28 26 73 69 51 a6 d0 4f fe 67 23 8f 28 45 f3 2e 4e d5 eb 74 36 ec c6 0e 00 00 47 64 bd 1f 23 1e a8 1c 7b
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 67 cf 99 50 5b 17 9f 8e d4
    Decrypted: 00 02 f1 28 cd ce 4a ea 94 60 52 9e c7 9d 0b e8 01 79 68 45 cb 11 08 1b aa ae b7 24 c2 89 d4 6a b8 42 09 46 e6 2e 05 b6 66 2a f4 69 de 6d 98 7a c0 38 5a e5 fa 3b 09 53 01 b4 f3 99 67 aa a6 8c c8 f8 bb d8 51 9a 63 d8 35 c5 b1 84 3c 8d 6a e4 50 b7 47 19 d3 a8 1a 5c c4 96 9c 3a 77 b8 64 06 31 30 66 88 10 d1 e0 9e 0d 1b 03 db 38 89 64 c1 7b f3 4f be 6f 15 47 02 03 1f f7 fd 52 7b 01 bc b1 69 4b 5f 3f 2a 23 6a fa d5 53 e5 57 81 aa 59 cf a0 37 f4 a1 ae fe 62 47 74 4a b3 fb 37 b1 4f 20 95 1a eb 4b d2 15 cb d8 b5 0e 5d 57 0d 9f b5 e1 f8 7e 90 f1 d0 ea f1 61 ca da 9a 06 4d df 0a 3c 34 f0 22 b5 a3 ed 93 9f f6 8f 6f 11 9d b1 99 db b2 cb 62 c5 98 82 fc 96 06 2e f4 9f 27 a1 25 ac 0b 82 ac aa f4 45 44 92 3e f3 8a 50 0d fd 74 f8 5a 6d 39 68 00 00 67 cf 99 50 5b 17 9f 8e d4
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 32 f4 d1 9d 5c d1 6e 5d b7
    Decrypted: 00 02 7a 63 f8 fa 90 5d 0f e2 74 45 6e 03 8e 46 42 ca 11 0d 3e d0 a2 99 ca 10 f0 34 49 8d 2d bc a3 55 78 75 2a c4 4f 0b 5c 8e 4e eb 11 24 bc 74 c5 94 c5 95 f9 0e b1 d8 5f 90 05 2b 46 5b bb 1f f3 b1 1b bc d8 34 da 67 1a 54 77 8e d7 bf 8e 8e 97 0c 9f 7f cd de 86 f5 88 d1 f2 29 7c a5 f4 f1 bb 40 cf af b1 5b 5f 1f f3 41 1e b5 88 27 94 95 bc 86 8c 12 16 2e 0c 64 1c b8 c4 25 79 9e e6 57 e6 7b 86 db e4 15 83 1b ce 70 89 29 3f 4a c4 83 ca 44 46 cb 3e be 6f 9e 37 54 76 45 cb 08 69 39 71 9a 87 5e 84 3a 50 be 81 9a 46 25 21 dc 84 8f c7 53 51 4f d7 e5 36 ca b1 9e 6a 0b 65 48 15 8c 2f ba e3 60 69 cb 71 f9 91 67 46 39 a5 4a 4f 99 8e e3 1c 25 55 a0 51 85 07 10 7f ca e8 6c 28 07 e6 4b fa 74 d4 fe de 5e fa 7a 59 ec 24 a9 cc 05 eb b3 0d a1 f1 00 00 32 f4 d1 9d 5c d1 6e 5d b7
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 e9 9f 21 bc 52 13 1b 2a f4
    Decrypted: 00 02 fe 7c 61 71 0f be df 6f 91 32 41 9f f8 0e 77 48 56 07 49 11 05 09 4b 6f 6f e9 ec 93 4b c3 8d 8e bb 3e db c3 d6 3b 0e 06 b0 1c 59 fd 54 56 44 0c ad 2d 20 46 23 bb d5 dd e4 7a 92 06 91 01 2b e9 95 8f 33 44 6f f5 15 e9 48 f1 c6 04 c5 30 a0 c9 30 78 26 78 f3 be e2 e1 0e 84 f8 71 f4 7a 43 6e cd f0 ab 4e 61 41 39 d8 89 bb 30 de 81 9c 7d 46 63 23 22 8b ac e5 f9 ac 8c 17 df 1b 40 5b 98 6b 6f 04 f0 60 23 71 62 e5 e6 1d 14 23 54 66 43 e6 fb 88 7b 6a 70 b5 9a 30 66 4b ec d1 fe e1 3f 2f 0e b9 8e c4 12 ed ee d8 04 c0 99 5b 05 d8 14 cd 7e 29 23 c7 0b 25 b6 07 8d 4e 17 92 31 3f 0f 38 d9 59 dc cb a3 61 65 74 b3 84 a3 4d 3b 1c 93 66 76 48 a6 7b 2f 17 f1 40 e4 22 b9 ae ad 91 cb b7 0f a7 2e fd 42 a8 81 96 11 a3 e3 05 5e de b8 49 20 04 96 00 00 e9 9f 21 bc 52 13 1b 2a f4
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 43 2c a9 2b bc 42 94 5a e3
    Decrypted: 00 02 30 ed 7a 55 49 db 84 ca e9 21 20 d4 72 09 16 d1 c2 3a 9c fa b6 3c 99 be d2 16 14 bf 40 ba 1f ff 3a 1f 2f 16 6e fc 50 45 37 0a 26 27 17 24 38 d1 a5 12 e1 58 fc 58 45 af 24 0f 17 81 ed 1f 7a e5 ab ce a1 5a db 5b 93 df fc 12 46 51 02 ff 89 a8 1a eb ef c4 10 9b 9f 1f e8 82 f8 24 a6 c3 40 b8 3d 94 ff 47 e4 17 a6 74 84 4a 4a 0b df 67 b3 ec e6 67 fa 85 35 31 9d d7 69 d9 99 bc 44 e6 d5 14 6b b1 76 35 e0 01 ea ef e2 45 0d 75 ea 79 9f 97 14 c4 cb 60 3b c4 2b d3 c7 4b 11 64 0a 50 df d5 85 9b 84 d7 6b 21 98 b1 88 ce 28 b7 2b 4d b7 20 5d 55 eb 16 df 86 88 ab f1 95 ae 2d e4 5d 1f 07 7f 84 3d c1 e0 c8 ee 3a d3 cc 7a 16 6a 02 6f 42 0b 4d db 9d c4 54 f4 2b 50 6b 7d a2 01 c1 c7 82 8f ab 45 70 d6 da 8f 8c a3 eb e4 6e de ca b5 ef 61 e6 b4 00 00 43 2c a9 2b bc 42 94 5a e3
19 errors

dengert · 2020-03-23T02:02:42Z

@loblik Thanks for the debug logs. The cardos_compute_signature tries to determine if the algorithm can do "RSA_SIG" or "RSA_PURE_SIG". and the comments says:
"/* There are two ways to create a signature, depending on the way,

the key was created: RSA_SIG and RSA_PURE_SIG."
RSA_SIG appears to expect caller to have added padding, i.e. RSA_RAW, where RSA_PURE_SIG strips pkcs1 BT-01 padding. It then writes in the log:
""I was unable to determine, whether this key can be used with RSA_SIG or RSA_PURE I will just try both." 19 occurrences in the dump. First is at line 5177.

The APDU for this is at line 5188. 00 2A 9E 9A 00 01 00 00 0F 95 B1 EB F1 B3 05 EF Using extended APDU, and sending 256 bytes. Data starts with 00 0F which is not a valid padding. (pkcs11-tool makes up data to send). The operation completed and returned 256 bytes + 9000 (OK). But leading byte was not 00. The software verify then fails.

This routine is used by all the versions of CardOS, so may have worked at some time or may work with some cards today. It should have been updated over the years.

The comment also implies that the attribute depends on how the key was created, so some cards may support RSA_RAW and some may not.

I do not have one of these cards. This is getting way to complicated. The community of CardOS users need to take over this patch. I believe the chaining and MIN(card,reader) part is good, as is the decipher with a minor change to tell it it needs to strip the padding.

dengert · 2020-03-23T13:14:13Z

@fbezdeka I have just pushed 3477532 is support of this comment.
OK, after sleeping on this problem, I agree that the card can support SC_ALGORITHM_RSA_RAW, just as all the previous versions. But in cardos_init(), V5_0 is treated differently and says only SC_ALGORITHM_RSA_PKCS1.

The flags (which saw what operations are supported on the card ) should be set as be:

     flags |= SC_ALGORITHM_RSA_RAW
             | SC_ALGORITHM_RSA_HASH_NONE
             | SC_ALGORITHM_NEED_USAGE
             | SC_ALGORITHM_ONBOARD_KEY_GEN;

The flags should not include SC_ALGORITHM_RSA_PAD_PKCS1 or SC_ALGORITHM_RSA_PAD_PSS because the OpenSC code is not able to tell the card to do PKCS1 or PSS (add or strip the padding on the card) and the card just does RSA_RAW. OpenSC decipher will still support PKCS1 and PSS in software in higher layers when RSA_RAW is used.

Thus the mod in #1987 (comment) should not be needed. It should only be needed if the flags have SC_ALGORITHM_RSA_PAD_PKCS1
You never sent a debug log, or said what other flags you were using. You only said you added SC_ALGORITHM_RSA_RAW. I assume you added it to the flags I had set so both SC_ALGORITHM_RSA_RAW and SC_ALGORITHM_RSA_PAD_PKCS1 were set.

If in the future someone can figure out how to tell the card to do SC_ALGORITHM_RSA_PAD_PKCS1 or SC_ALGORITHM_RSA_PAD_PSS on the card, for both sign and decrypt, the code could be added to OpenSC. But that requires vendor documentation.

loblik · 2020-03-23T17:48:20Z

Thanks for not giving up. Now the decryption works fine. But I still have signing and verification issues. Should I post the full debug log again?

C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22) 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
    RSA-PKCS:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
    SHA1-RSA-PKCS:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
    MD5-RSA-PKCS:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
    RIPEMD160-RSA-PKCS:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
    SHA256-RSA-PKCS:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22) with 1 mechanism
    RSA-X-509:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21) with 1 mechanism
    RSA-X-509:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18) with 1 mechanism
    RSA-X-509:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18) with 1 mechanism
    RSA-X-509:   ERR: wrong signature length: 257 instead of 256
ERR: verification failed
Verify (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22)
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22) with 1 mechanism
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21) with 1 mechanism
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18) with 1 mechanism
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18) with 1 mechanism
    RSA-X-509:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
Decryption (currently only for RSA)
  testing key 0 (Auth 13.06.19 13:33:25 - 13.06.22)
    RSA-X-509: OK
    RSA-PKCS: OK
  testing key 1 (Encr 13.06.19 15:33:27 - 13.06.22)
    RSA-X-509: OK
    RSA-PKCS: OK
  testing key 2 (Encr 22.08.18 09:19:02 - 22.08.21)
    RSA-X-509: OK
    RSA-PKCS: OK
  testing key 3 (Encr 02.10.15 17:12:37 - 02.10.18)
    RSA-X-509: OK
    RSA-PKCS: OK
  testing key 4 (Encr 02.10.15 16:53:55 - 02.10.18)
    RSA-X-509: OK
    RSA-PKCS: OK
25 errors

avoidik · 2020-05-07T06:29:23Z

I wasn't able to build it from the scratch, a vagrant provisioning has failed with the following

    ubuntu.test: opensc-notify.c: In function ‘sig_handler’:
    ubuntu.test: opensc-notify.c:194:2: error: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Werror=unused-result]
    ubuntu.test:   (void)write(cancellation_fd[1], &sig, sizeof sig);
    ubuntu.test:   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ubuntu.test: cc1: all warnings being treated as errors
    ubuntu.test: Makefile:1245: recipe for target 'opensc_notify-opensc-notify.o' failed

vagrantfile
https://gist.github.com/avoidik/e01b4dfb61bebecd25825e22aa5f1b5b

michaelweiser · 2020-05-07T07:06:45Z

Same for me (I didn't want to bring this seemingly unrelated Werror problem up in this already long thread): Running make with V=1 and running the gcc command without -Werror manually obviously works around that. My compiler is gcc 9.3.0 - so it might be a new or even false positive warning with the new compiler (considering that the unused return is seemingly already being worked around by adding (void) in front of write).

fbezdeka · 2020-05-07T07:12:45Z

82258b6 still works for me. No warning with GCC 9.3.1 (on Fedora 31)

dengert · 2020-05-07T12:27:16Z

#1987 (comment) should have been fixed in #2003 Its not a cardos issue, but the compiler treating the dropping of a return value from a function. So it should be reported in #2003 if still a problem.

michaelweiser · 2020-05-07T17:30:19Z

It's fixed by 1202ece which is not on this PRs branch yet. So the next rebase or eventual merge should take care of it.

see: OpenSC#1995 (comment) On branch cardos-5.3 Changes to be committed: modified: asn1.c

In tests, make sute test data is either padded, or "zero" padded so size if data <= modlen - 11. The smallest pad in 11 bytes, 00 | NN | PS | 00. PS is at least 8 bytes. "zero" padding has N = 00, PS >= 8 byte of 00. On branch cardos-5.3 Changes to be committed: modified: tools/pkcs11-tool.c

CardOS cards may have more then 8 supported_algo_info entries in tokenInfo. We may bemissing some. We have seen 8 in some pkcs15-tool -i -v output. Simple fix is to incrase the limit. More appropriate fix is to remove the limit, much like is done with sc_algorithm_info. and use realloc of the array. On branch cardos-5.3 Changes to be committed: modified: src/libopensc/pkcs15-prkey.c modified: src/libopensc/pkcs15-skey.c modified: src/libopensc/pkcs15.c modified: src/libopensc/types.h

Mismatch of ASN1 parsing of tokeninfo.supported_algos[n].paramters in one place parameter was treated as a pointer to sc_object_id and in another as inline structure. This caused segfaults in pkcs15-tool when it tried to print the OID. Changes to be committed: modified: src/libopensc/opensc.h modified: src/libopensc/pkcs15.c

Some cards can provide supported algorithms in tokenInfo which contain ECDSA OID, and PKCS11 mechanism Don't know how many Algo_refs were actually read, and a ref of 0 may be valid. print at least one Algo_refs. Print the mechanism from PKCS11, and print operations Use the $(top_srcdir)/src/pkcs11/pkcs11-display.c on Unix Use the $(TOPDIR)\src\pkcs11\pkcs11-display.obj on Windows pkcs15.tool.c treat ECDSA OID as inline pkcs15-tool prints PKCS11 mechanisms using pkcs11-display.c Automake now warns that the default will change, in the future so "[subdir-objects]" is added to configure.ac Changes to be committed: modified: configure.ac modified: src/tools/Makefile.am modified: src/tools/Makefile.mak modified: src/tools/pkcs15-tool.c

Treat CardOS V5_0 and V5_3 cards differently then older versions: Use card->dvr_data as a pointer to cardos_data_t to store private driver data to pass internally, especially between set security environment and the crypto operations. Sc_get_encoding_flags sets sec_flags from algo_info->flags in pkcs15-sec.c and it passed to decipher. Some cards when doing a decipher may drop leading 00 byte when returning data from RSA_RAW decipher. Add leading byte(s) as needed. Get Cryptographic Mechanism Reference from Key Reference: Key reference byte appears to be a 4 bit Cryptographic Mechanism Reference and a 4 bit key reference. This is only done if key reference & 0xF0 != 0 i.e. default Cryptographic mechanism reference is 0. which appears to be the case for RSA RAW. PKCS1 appears to be 0x10 and ECDSA 0x30 See iso 7816-4 table 55 for DST: 84 Reference of a private key 95 Usage qualifier byte - Table 57 - 40 looks OK 80 Cryptographic mechanism reference and referes to section 9.2 The 4 bit key reference limits card to 16 keys. In future this may not work, but we can derive a Cryptographic Mechanism Reference from what OpenSC thinks the card needs to do. Only know RSA RAW, PKCS1 and ECDSA. ECDSA code has not been tested, but expected to work. Allow setting CardOS type and flags from opensc.conf using card_atr stanza This is a fallback if newer cards are added or older cards have problems giving us time to make need changes in next release. It will help in identifying what flags are needed for each card. As user can report what combination of flags work for them. They do this by adding to opensc.conf with something like this. (Change the ATR to your card's ATR): card_atr 3b:d2:18:00:81:31:fe:58:c9:03:16 { driver = "cardos"; # type is decimal from cards.h: # SC_CARD_TYPE_CARDOS_V5_0 is 1009 # SC_CARD_TYPE_CARDOS_V5_3 is 1010 type = 1010; # flags is hex from opensc.h: #define SC_ALGORITHM_ONBOARD_KEY_GEN 0x80000000 #define SC_ALGORITHM_NEED_USAGE 0x40000000 #define SC_ALGORITHM_RSA_RAW 0x00000001 /* RSA_RAW is PAD_NONE */ #define SC_ALGORITHM_RSA_PAD_NONE 0x00000001 #define SC_ALGORITHM_RSA_PAD_PKCS1 0x00000002 /* PKCS#1 v1.5 padding */ #define SC_ALGORITHM_RSA_PAD_ANSI 0x00000004 #define SC_ALGORITHM_RSA_PAD_ISO9796 0x00000008 #define SC_ALGORITHM_RSA_PAD_PSS 0x00000010 /* PKCS#1 v2.0 PSS */ #define SC_ALGORITHM_RSA_PAD_OAEP 0x00000020 /* PKCS#1 v2.0 OAEP */ #define SC_ALGORITHM_RSA_HASH_NONE 0x00000100 /* only applies to PKCS1 padding */ # example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_HASH_NONE | SC_ALGORITHM_RSA_RAW flags = 80000101; #example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_PAD_PKCS1 flags = 80000002; } For V5_0 and v5_3 cards, use sc_get_max_send_size and sc_get_max_recv_size which takes care or reader sizes even on Windows where SCardControl can not get PART_10 sizes. (commit eddea6f on Windows forces reader sizes to 255, 256 in reader-pcsc.c if not already set. It should not do this, but leave that up to card drivers.) pkcs15-cardos.c added: New file, pkcs15-cardos.c, added as emulation only for CardOS V5_0 and V5_3 cards. sc_pkcs15_bind_internal is called to get tokenInfo as CardOS cards are substantially PKCS15 cards. But some V5_* cards have errors in the tokenInfo, Which are corrected. For older CardOS cards, card-cardos.c will create all the card->algorithms. Pkcs15-cardos.c will check for card->algorithms and if there are none, it will do the following: SC_CARDCTL_CARDOS_PASS_ALGO_FLAGS is called twice. First to get the flags as set by user via opensc.conf card_atr or default flags set by the card driver. Then after determining from the tokenInfo what algorithms the card can support, the new flags are passed to card_cardos.c to create card->algorithms. https://atos.net/wp-content/uploads/2018/11/CT_181026_LPM_CardOS_V5-3_Multifunctionality_FS_en3_web.pdf says card supports: "“Command chaining” in accordance with ISO/IEC 7816-4" To take advantage of this with older readers, max_send_size and max_recv_size is now based on minimum of reader limits and "data_field_length" from card. This should allow card to work in older readers not capable of extended APDU. So far current cards we have seen do no appear to support “Command chaining”. Changes to be committed: modified: src/libopensc/Makefile.am modified: src/libopensc/Makefile.mak modified: src/libopensc/card-cardos.c modified: src/libopensc/cardctl.h modified: src/libopensc/cards.h new file: src/libopensc/pkcs15-cardos.c modified: src/libopensc/pkcs15-syn.c modified: src/libopensc/pkcs15-syn.h

dengert · 2020-05-07T18:28:18Z

@michaelweiser I forced pushed a rebased PR on current master. This should now include 1202ece

The PR is down to 6 commits, with all the card-cardos.c and pkcs15-cardos.c in one commit.
The others are related fixes for other parts of OpenSC.

Again I ask those of you who have CardOS cards, to test this (hopefully) final version.

michaelweiser · 2020-05-07T19:12:43Z

Builds and works fine for me.

fbezdeka · 2020-05-07T20:45:25Z

Same here. Build and tests successful. Thank you @dengert!

avoidik · 2020-05-07T21:22:41Z

@dengert thank you, everything is working

sklaes · 2020-05-08T06:25:26Z

the lastest builds also work fine for me (Tested with cardOS 5.0 and 4.2c)
@dengert Thanks for your support

Silvanoc · 2020-05-11T06:30:59Z

Thank you @dengert for your hard work on fixing this! 👏

niladam · 2020-05-26T11:35:38Z

Hello. I'm apparently affected by this as well. Any ETA on the 0.21 release date ?

fbezdeka · 2020-05-26T11:46:57Z

@niladam, you should inform the package maintainer of your distribution. It will take some time for 0.21 to be released.

Some distributions are already working on a backport / update:

Fedora (already released): https://bugzilla.redhat.com/show_bug.cgi?id=1830528
Debian (Testing): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961123

These are all bug reports I know of. If your distribution is missing: Please fill a bug report for your distribution.

niladam · 2020-05-26T11:48:09Z

@fbezdeka I'm actually using OpenSC's release, on a Mac. Was hoping to get the latest fixes in..

frankmorgner · 2020-05-27T21:32:35Z

See https://github.com/OpenSC/OpenSC/projects/7 for missing stuff for a new release. You may try the nightly builds of OpenSC in the mean time, see https://github.com/OpenSC/Nightly. Last successful build for macOS was https://github.com/OpenSC/Nightly/tree/2020-05-13_27a819ba

dengert force-pushed the cardos-5.3 branch from 82258b6 to 2669182 Compare May 7, 2020 18:09

dengert added 6 commits May 7, 2020 13:13

asn1.c don't use strict mode

955f0c8

see: OpenSC#1995 (comment) On branch cardos-5.3 Changes to be committed: modified: asn1.c

dengert force-pushed the cardos-5.3 branch from 2669182 to f472f0e Compare May 7, 2020 18:20

dengert mentioned this pull request May 7, 2020

Commit 4fd34e28eaf1 broke out-of-source build #2027

Closed

frankmorgner merged commit db41cd9 into OpenSC:master May 9, 2020

Release 0.21.0 automation moved this from In progress to Done May 9, 2020

Jakuje mentioned this pull request May 19, 2020

C_Login failed: rv = CKR_USER_PIN_NOT_INITIALIZED (0x102) #1995

Closed

Jakuje mentioned this pull request Jun 15, 2020

Towards new release 0.21.0 #2061

Closed

dengert mentioned this pull request Dec 7, 2020

Aventra MyEID cards fail to sign data with more than 51 bytes #2173

Closed

dengert mentioned this pull request Mar 5, 2021

D-Trust card 3.1 + Reiner SCT cyberJack Komfort + OpenSC + Mac => Pin only works if it has max length?? + Asking for PIN twice #2244

Open

Various CardOS 5.3 Fixes #1987

Various CardOS 5.3 Fixes #1987

Conversation

dengert commented Mar 21, 2020

loblik commented Mar 21, 2020

dengert commented Mar 21, 2020 via email

dengert commented Mar 21, 2020

loblik commented Mar 22, 2020 • edited Loading

dengert commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

loblik commented Mar 22, 2020

dengert commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

loblik commented Mar 22, 2020

dengert commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

dengert commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

loblik commented Mar 22, 2020

dengert commented Mar 22, 2020

loblik commented Mar 22, 2020

fbezdeka commented Mar 22, 2020 • edited Loading

dengert commented Mar 22, 2020

loblik commented Mar 22, 2020

dengert commented Mar 22, 2020

loblik commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

fbezdeka commented Mar 22, 2020

dengert commented Mar 22, 2020

loblik commented Mar 22, 2020

dengert commented Mar 23, 2020

dengert commented Mar 23, 2020

loblik commented Mar 23, 2020

avoidik commented May 7, 2020 • edited Loading

michaelweiser commented May 7, 2020

fbezdeka commented May 7, 2020

dengert commented May 7, 2020

michaelweiser commented May 7, 2020

dengert commented May 7, 2020

michaelweiser commented May 7, 2020

fbezdeka commented May 7, 2020

avoidik commented May 7, 2020

sklaes commented May 8, 2020

Silvanoc commented May 11, 2020

niladam commented May 26, 2020

fbezdeka commented May 26, 2020

niladam commented May 26, 2020 • edited Loading

frankmorgner commented May 27, 2020

loblik commented Mar 22, 2020 •

edited

Loading

fbezdeka commented Mar 22, 2020 •

edited

Loading

avoidik commented May 7, 2020 •

edited

Loading

niladam commented May 26, 2020 •

edited

Loading