SC-HSM PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5) on OpenSC 0.21 & 0.22

[scottthomas007]

Bonjour Community & Support,

I have SmartCard-HSM with an RSA-2048 bit key and certificate which fails with pkcs11-tool (OpenSC version 0.21 & 0.22) and receive
PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5) on OpenSC 0.21 & 0.22

but works perfectly fine with pkcs11-tool (OpenSC version 0.15)

################################################################
OUTPUT on OpenSC 0.21 & 0.22 on Debian 11

pkcs11-tool -l -t
Using slot 0 with a present token (0x0)
Logging in to "SmartCard-HSM (UserPIN)".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
seems to be OK
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only for RSA)
testing key 0 (httpdcert)
error: PKCS11 function C_SignFinal failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

################################################################

################################################################
OUTPUT on OpenSC 0.15 on Windows Server 2019
C:\Program Files (x86)\OpenSC Project\OpenSC\tools>pkcs11-tool.exe -t -l
Using slot 1 with a present token (0x1)
Logging in to "SmartCard-HSM (UserPIN)".
Please enter User PIN: 2022-01-20 12:34:47.201 cannot lock memory, sensitive data may be paged to disk
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
seems to be OK
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only RSA signatures)
testing key 0 (httpdcert)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
SHA256-RSA-PKCS: OK
Verify (currently only for RSA):
testing key 0 (httpdcert)
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
Unwrap: not implemented
Decryption (RSA)
testing key 0 (httpdcert)
RSA-X-509: OK
RSA-PKCS: OK
No errors

C:\Program Files (x86)\OpenSC Project\OpenSC\tools>

[dengert]

It could be related to: #2469
An OPENSC debug log would help. https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC

[Kestrel401]

Hi,

I have the same issue on my Mac Mini running macOS 10.15.7 Catalina with OpenSC 0.22.0. With OpenSC 0.20.0 it's working and I can use my smartcard for login.

I investigated this issue with two partitions on my Mac - one my current working partition with OpenSC 0.20.0, second a fresh Catalina-installation with OpenSC 0.22.0. I used my Siemens Employee Smartcard with an Omnikey CardMan 3121 USB card reader.

The command line used reads as follows:
OPENSC_DEBUG=5 /Library/OpenSC/bin/pkcs11-tool --login --test
as suggested in the MacOS Quick Start wiki.

The log of the terminal output can be found in the following files:

opensc_debug5_20.txt
opensc_debug5_22.txt

As far as I can understand the debug output the problem seems to start after the input of the User PIN (See line 3039 in opensc_debug5_20.txt and line 3176 in opensc_debug5_22.txt).

The code of 0.20.0 calls 'code-cardos.c:cardos_pin_cmd' and sends the PIN to the smart card (Outgoing/Incoming ADPU with PIN) whereas 0.22.0 returns directly from 'sec.c:sc_pin_cmd' with 'success/code 0'.

This is the most obvious difference I could find - hopefully I could save some work for you.

Best regards and many thanks for OpenSC so far :-)

Matthias

[dengert]

The problem is not with the PIN. d06f23e is covering up the fact that the debug was turned off at this point. It should at least log in it turning off debugging, and the log when it turns it back on. @frankmorgner can you look at this?

The real problem is with line 3905
P:584; T:0x4501495232 13:05:54.977 [opensc-pkcs11] reader-pcsc.c:271:pcsc_internal_transmit: OMNIKEY AG CardMan 3121:SCardTransmit/Control failed: 0x80100016 (Google for pcsc 0x80100016) which says the PC/SC layer had a problem, and may not be OpenSC problem.
The equivalent line in opensc_debug5_20.txt looks like 3759 that then reads the response of the decipher.

Line 21:

P:584; T:0x4501495232 13:05:40.808 [opensc-pkcs11] reader-pcsc.c:1082:part10_detect_max_data: get dwMaxAPDUDataSize property returned 0
P:584; T:0x4501495232 13:05:40.808 [opensc-pkcs11] reader-pcsc.c:1299:detect_reader_features: Assuming that the reader supports transceiving short length APDUs only
P:584; T:0x4501495232 13:05:40.808 [opensc-pkcs11] reader-pcsc.c:1121:part10_get_vendor_product: id_vendor=076b id_product=3021

The "Assuming that the reader supports transceiving short length APDUs only" may be a problem too, as the failing command is using extended APDU.

line 92 in one and 98 the other:

P:584; T:0x4501495232 13:05:41.329 [opensc-pkcs11] card.c:385:sc_connect_card: card info name:'Atos CardOS', type:1006, flags:0x0, max_send/recv_size:255/256

db41cd9ab was the last big commit in 2020, but prior to this from 2005, 2006, where in card-cardos.c: card->caps |= SC_CARD_CAP_APDU_EXT; is still being set which says card supports extended APDU.

In both dumps the outgoing APDU 00 2A 80 86 00 01 01 00 ... is using extended length. for 0x0101 = 257 because card-cardos.c overrides the max_send/recv_size:255/256

There are two different readers OMNIKEY CardMan (076B:3021) 3021 vs OMNIKEY AG CardMan 3121 This brings the readers in to question. Can you try swapping readers? Or uses a different reader.

https://ccid.apdu.fr/#readers says the 076B:3021 (same vid:pid) for both do not support extended APDU. But one of them does or some lower level code is handling it.

Mac Mini vs two partitions on your Mac could be an issue. Different pcsc or ccid drivers

[Kestrel401]

Hmm... I must admit I really forgot that I installed a quite old driver (Release date 15 Jan 2018) from Omnikey on my main partition whereas on the fresh installed OS I did not and tried to use whatever macOS uses for this device.

The reader is of course always the same (i.e. identical) device and it is labeled "CardMan 3121" on the housing of the reader. Probably the OmniKey-driver only knows about a 3021 device - predecessor device perhaps. Can I determine if the driver is still working?

Anyway - the mentioned driver is still available for download:
https://www.hidglobal.de/drivers/29885
I'll install this driver on the fresh installed OS and see if this solves the problem. (I'll report here ;-)

Thanks for reading the logs and for your explanation.

Regards - Matthias

[Kestrel401]

OK, now it becomes embarrassing : Installing the driver solved the problem. All certificates on the card are recognised and I was asked to link the authentication certificate to my user account.

I'm still not asked for the PIN at the login screen when booting from the 'fresh-install-partition', but I'm sure that's a macOS problem - on my main partition I will be asked for the PIN.

The card reader is still not listed in the keychain.app as described in the OpenSC-Wiki for macOS, but that's more a blemish(?).

Again thank you very much for your support, Doug.

[scottthomas007]

OK, now it becomes embarrassing : Installing the driver solved the problem. All certificates on the card are recognised and I was asked to link the authentication certificate to my user account.

I'm still not asked for the PIN at the login screen when booting from the 'fresh-install-partition', but I'm sure that's a macOS problem - on my main partition I will be asked for the PIN.

The card reader is still not listed in the keychain.app as described in the OpenSC-Wiki for macOS, but that's more a blemish(?).

Again thank you very much for your support, Doug.

Bonjour
The issue was that the OmniKey smart card reader was using the default libccid driver on linux. The issue disappeared when i plugged the Gemalto IDbridge CT40 smart card reader. I installed the latest OmniKey Driver on my linux and the smart card was working with the OmniKey reader as well.
Thanks.
The issue is resolved.

[scottthomas007]

OK, now it becomes embarrassing : Installing the driver solved the problem. All certificates on the card are recognised and I was asked to link the authentication certificate to my user account.
I'm still not asked for the PIN at the login screen when booting from the 'fresh-install-partition', but I'm sure that's a macOS problem - on my main partition I will be asked for the PIN.
The card reader is still not listed in the keychain.app as described in the OpenSC-Wiki for macOS, but that's more a blemish(?).
Again thank you very much for your support, Doug.

Bonjour The issue was that the OmniKey smart card reader was using the default libccid driver on linux. The issue disappeared when i plugged the Gemalto IDbridge CT40 smart card reader. I installed the latest OmniKey Driver on my linux and the smart card was working with the OmniKey reader as well. Thanks. The issue is resolved.

Issue resolved