OpenSC.tokend cannot PIN-unlock a PIV card #11
Comments
|
@mouse07410 Have you solved this problem ? |
|
Tokend currently only does RSA, while your keys seem to be EC ? |
Looks like P-256 ? |
mouse07410
changed the title
Yes it was. Not any more - but the problem (inability to communicate successful PIN-unlock to the OS and apps) persists. Please see above. Thanks! |
|
@martinpaljak I'm also seeing this with a smartcard with RSA2048 keys. I see the certificates in Keychain Access (and the private key belonging to it), but I can't actually use it for Mail.app. |
mouse07410
changed the title
|
Should be solved in the most recent version of OpenSC together with #16 of OpenSC.tokend |
mouse07410
changed the title
|
Not sure. It works with the changes that you and @dengert suggested, but I haven't seen those changes actually merged into the mainstream??? (Or have I missed that?) And with the latest changes @dengert suggested (inspired :), see issue OpenSC/OpenSC#570 ), Outlook 2011 successfully signs outgoing emails using |
|
fixes for unlocking the token are merged now! |
Environment
Expectations - what I need
What does work
Lower-level utilities appear to work OK. I can read both CAC card and Yubikey NEO (PIV applet), load and read certificates, etc. I can make Firefox work with it by loading the appropriate PKCS11 library (in this case /Library/OpenSC/lib/opensc-pkcs11.so).
When I install SmartCardServices-2.0.1 http://smartcardservices.macosforge.org/trac/wiki/installers and remove CAC.tokend so that PIV.tokend is picked instead - CAC card is fully functional. But NEO token is not recognized/accepted by it at all, which is why I cannot just stick with SmartCardServices for all my needs.
What does not work
Card can't be unlocked by the correct PIN. Consequently, none of the Mac OS X applications that relate on tokend. In particular:
OpenSC.tokend appears to "see" the tokens and even determine what certificates are loaded - but it is unable to unlock the token, and (I think - therefore) unable to work with it.
In Keychain Access, when I select the tab "Certificates" - I see all the certificates I loaded on the token.
But when I select the tab "My Certificates" - it is empty.
I noticed a direct correlation between the ability of the Keychain Access to work with the private keys (to unlock the token) and the ability of other applications (e.g. Apple Mail) to work with that token too: if Keychain fails - Apple Mail fails too, and so does Safari.
To compare, with PIV.tokend from SmardCardServices-2.0.1 even before I unlock the CAC token, it detects both certificates and corresponding private keys. Coincidentally, it unlocks the token fine. Unfortunately I cannot use PIV.tokend with NEO, because NEO isn't recognized by PIV.tokend.
Update Based on the OpenSC logs, OpenSC.tokend succeeds in passing the PIN to the smart card (both CAC and NEO), receives OK (Success, PIN Verified) from the smart card, but somehow does not report this success to the application that initiated the operation.
Logs
Here's what I have in the /var/log/system.log:
From opensc-debug.log:
Based on the above log, it appears that OpenSC.tokend succeeds in all the operations with smart card. The problem is somewhere where it communicates with the OS and/or applications.
Syslog for NEO:
Syslog for CAC:
Low-level operations
I'm also seeking help on the Yubico forum http://forum.yubico.com/viewtopic.php?f=26&t=1768&p=7064#p7064 , but I think there's a better chance here because the problem seems to be with the tokend, or rather with how tokend interacts with the Yosemite OS and applications.
The text was updated successfully, but these errors were encountered: