Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Problems with OpenPGP CryptoStick smartcard and OpenSC PKCS#11 module #125

Closed
neuro18 opened this issue Jan 27, 2013 · 17 comments
Closed

Problems with OpenPGP CryptoStick smartcard and OpenSC PKCS#11 module #125

neuro18 opened this issue Jan 27, 2013 · 17 comments

Comments

@neuro18
Copy link

neuro18 commented Jan 27, 2013

Hello. I have several problems under Windows 7 x64 using GPF CryptoStick v1.2 smart-card and OpenCS 0.13.0 (and below) opensc-pkcs11.dll module:

TRUECRYPT 7.1a

  1. have a keyfile stored into CryptoStick DO3 by TrueCrypt itself via a proprietary pkcs11 module recommended by the manufacturer
    http://imageshost.ru/photo/177858/id2747477.html

  2. setting up TrueCrypt to use OpenSC PKCS#11 module
    http://imageshost.ru/photo/177965/id2747476.html

  3. when trying to mount a TrueCrypt volume with a keyfile I get a User PIN request twice it a row:
    FIRST - http://imageshost.ru/photo/50551/id2747470.html
    SECOND - http://imageshost.ru/photo/50539/id2747471.html

  4. after entering User PIN twice I get either 'Security Token Error''
    http://imageshost.ru/photo/41896/id2747473.html
    or 'Keyfile not found' error
    http://imageshost.ru/photo/50329/id2747472.html

  5. Available keyfiles list is empty, TrueCrypt volume obviously is not mounted
    http://imageshost.ru/photo/178020/id2747469.html

FIREFOX (and any app utilizing X.509 certificate stored into CryptoStick)

  1. load OpenSC PKCS#11 module
    http://imageshost.ru/photo/322098/id2747480.html

  2. the same behavior of asking for a User PIN twice in a row:
    http://imageshost.ru/photo/66486/id2747479.html
    AND
    http://imageshost.ru/photo/70470/id2747478.html)

  3. certificate SUCCESSFULLY retrieved from a smart-card

Though, there is no any problems with using proprietary DLL mentioned above
http://smartcard-auth.de/download-en.html

PS. There is "pkcs11-tool --list-slots --module opensc-pkcs11.dll" execution result if needed:

Available slots:
Slot 0 (0xffffffff): Virtual hotplug slot
  (empty)
Slot 1 (0x1): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN (sig))
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469
Slot 2 (0x2): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN)
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469
@neuro18
Copy link
Author

neuro18 commented Feb 5, 2013

To sum up the problems with PKCS#11 driver on Windows 7:

  1. incorrect work with OpenPGP v.2 smart-cards' DOs (Data Objects) -- GPF CryptoStick in my case;
  2. the driver always asks for a User PIN twice in a row when is trying to retrieve any smart-card object (DOs, X.509 certificate, private RSA keys).

I'm just an end-user, not a programmer. How can I draw the OpenSC devolopers in digging into these issues? Thanks in advance.

@viktorTarasov
Copy link
Member

  1. You can activate the OpenSC debugging logs: in opensc.conf (in "Program Files\OpenSC Project\OpenSC) set "debug = 8" and "debug_file = ".
  2. These two PINs are different -- one UserPIN and other SignPIN (look the PIN label on your images.)
    FF ask you to enter PIN for the both. Do you have the same value in two cases ?

Default behavior of OpenSC is to expose one slot per PIN and per on-card application.
You can change this behavior and select the PIN to be presented by the OpenSC module's slot.
Use 'create_slots_for_pins' option in OpenSC configuration, read the comments in opensc.conf for the possible values.

@neuro18
Copy link
Author

neuro18 commented Feb 18, 2013

  1. Debug log for TrueCrypt: http://pastebin.com/kfFcGaJm
    The result of trying to list all keyfiles stored onto GPF Cryptostick 1.2. There's one in DO3, but the list is empty.
  2. Debug log created when trying to login to a web-site (successfully) using X.509 personal certificate and AUTH RSA-key, both stored onto GPF Cryptostick 1.2: http://pastebin.com/RRujMtiJ/

In both cases I used default opensc.conf, so it were 2 PINs in a row to enter. It seems "User PIN" and "User PIN (sig)" are different. The smart-card itself has two PINs - User and Admin. But I entered the same User PIN in both PIN prompts and still can successfully access my X.509 certificate in Firefox. Firefox shows a dialog which states that certificate was retrieved by using "User PIN" (not "User PIN (sig)"): http://imageshost.ru/photo/11766/id2826329.html

I also tried to cut off "User PIN (sig)" by using option "create_slots_for_pins" in opensc.conf file and leave "User PIN" only to enter. No success. "User PIN (sig)" is always there, with or without "User PIN" depending of options I use:

Available slots:
Slot 0 (0xffffffff): Virtual hotplug slot
  (empty)
Slot 1 (0x1): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN (sig))
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469

Viktor, it seems you're Russian (or from one of ex-USSR regions). If so, we can use Russian language to communicate more productively.

@hongquan
Copy link
Contributor

Hi Viktor and neuro18,
Based on 2nd log, I found:

  1. OpenPGP driver retrieved successfully keys and certificates:
2013-02-18 14:46:19.977 Flags:0x8; Auth User/Sign PINs 05669CA8/00000000
2013-02-18 14:46:19.977 Found 3 RSA private keys
2013-02-18 14:46:19.977 Found 3 RSA public keys
...
2013-02-18 14:46:20.804 Found 1 certificate
  1. Things seem to be OK until PKCS#11 layer failed to list objects:
2013-02-18 14:47:01.818 C_FindObjectsInit(slot = 1)
2013-02-18 14:47:01.818 [opensc-pkcs11] pkcs11-object.c:343:C_FindObjectsInit: C_FindObjectsInit(): CKA_TOKEN = TRUE
2013-02-18 14:47:01.818 [opensc-pkcs11] pkcs11-object.c:343:C_FindObjectsInit: C_FindObjectsInit(): CKA_CLASS = CKO_CERTIFICATE
2013-02-18 14:46:21.225 [opensc-pkcs11] misc.c:138:session_start_operation: called
2013-02-18 14:46:21.225 Session 0x5679ea0, type 0
2013-02-18 14:46:21.225 Object with handle 0x56654f0
2013-02-18 14:46:21.225 Object 2/90592496: Private object and not logged in.
2013-02-18 14:46:21.225 Object with handle 0x5679d88
2013-02-18 14:46:21.225 Object 2/90676616: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 Object with handle 0x5665550
2013-02-18 14:46:21.225 Object 2/90592592: Private object and not logged in.
2013-02-18 14:46:21.225 Object with handle 0x5679dc0
2013-02-18 14:46:21.225 Object 2/90676672: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 Object with handle 0x5679e30
2013-02-18 14:46:21.225 Object 2/90676784: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 0 matching objects

@viktorTarasov Do you have any idea where error may come from?

Update:
Please ignore my comment above. Because the 2nd log is from authentication with Firefox, which you succeed. So, there is no thing wrong with certificate and auth key.
I need to investigate about retrieving TrueCrypt key from private DO.

@hongquan
Copy link
Contributor

I found the cause: My PKCS15 binding for OpenPGP card does not support "DATA" object yet. This object type is used by TrueCrypt to store its own data.
http://paste.ubuntu.com/5564103/
I will improve the module to support it.

@neuro18
Copy link
Author

neuro18 commented Feb 27, 2013

Thank you, Hongquan. And what about disabling "User PIN (sig)" to enter in the .conf file or somehow else?

@hongquan
Copy link
Contributor

@neuro18 There is no way to disable "User PIN (sig)" slot.

@viktorTarasov
Copy link
Member

@neuro18
Try to play with create_slots_for_pins parameter from OpenSC configuration.

By default a PKCS#11 slot is created for any preset PKCS#15 PIN object.
You can change this setting and export, for ex., only UserPIN.

Look onto the comments in
https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/framework-pkcs15.c#L1041 to get know how SignPIN is distinguished from UserPIN.

@neuro18 neuro18 mentioned this issue Mar 16, 2013
Closed
@neuro18
Copy link
Author

neuro18 commented Mar 16, 2013

@viktorTarasov
I've tried every possible combinations of "user", "sign", "application" options with 'create_slots_for_pins' parameter. "User PIN (sig)" slot is always there. The only thing I achieved is disabled 'User PIN' itself :). What else can I do?

@viktorTarasov
Copy link
Member

What is the output of

pkcs15-tool --list-pins

@neuro18
Copy link
Author

neuro18 commented Mar 16, 2013 

PIN [User PIN (sig)]
    Object Flags   : [0x3], private, modifiable
    ID             : 01
    Flags          : [0x13], case-sensitive, local, initialized
    Length         : min_len:6, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 1 (0x01)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

PIN [User PIN]
    Object Flags   : [0x3], private, modifiable
    ID             : 02
    Flags          : [0x13], case-sensitive, local, initialized
    Length         : min_len:6, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 2 (0x02)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

PIN [Admin PIN]
    Object Flags   : [0x3], private, modifiable
    ID             : 03
    Flags          : [0x9B], case-sensitive, local, unblock-disabled, initialized, soPin
    Length         : min_len:8, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 3 (0x03)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

@viktorTarasov
Copy link
Member

Ok, thanks.

Try to remove 'local' flag from the UserPIN and AdminPIN -- all your PINs are defined at the MF level, so, for me they all are 'global'.

Nevertheless, leave the 'local' flag for the SignPIN -- it will allow to PKCS#11 framework to distinguish UserPIN and SignPIN. (Probably we should introduce an explicit internal flag for that at the PKCS#15 level.)

@neuro18
Copy link
Author

neuro18 commented Mar 18, 2013

@viktorTarasov
Sorry for a noob question, but how can I remove these flags? Will this affect the current usability of the smart-card with other applications (e.g. gnupg, truecrypt, putty pagent)? BTW, OpenVPN with OpenSC PKCS#11 module under Windows asks for User PIN properly. Only Firefox request for 'User PIN (sig)' in addition to 'User PIN'.

@viktorTarasov
Copy link
Member

@neuro18
these flags are encoded into PKCS#15 emulator.
If you are not owner of OpenPGP card driver and are using one of the official OpenSC builds, you will not be able change these flags.
Maybe Nguyen (@hongquan) could help.

Finally, I think that we could introduce a new option into the OpenSC configuration to overwrite internal mechanism used to distinguish User and Sign PINs.

@hongquan
Copy link
Contributor

@neuro18 Sorry for this limitation.
As Viktor said, these flags are hard-coded in driver, so to get the change, you have to either:

  • Use a custom build of the driver. I can change the source code, but unfortunately, I have no experience in building it on Windows.
  • Wait for future release, when we define new mechanism to allow to override this.

@neuro18
Copy link
Author

neuro18 commented Mar 22, 2013

@viktorTarasov @hongquan
I'll wait for future release then. Thanks for all your efforts.
Should I close this topic?

@hongquan
Copy link
Contributor

OK.

@neuro18 neuro18 closed this as completed Mar 23, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@viktorTarasov @hongquan @neuro18