Problems with OpenPGP CryptoStick smartcard and OpenSC PKCS#11 module

[neuro18]

Hello. I have several problems under Windows 7 x64 using GPF CryptoStick v1.2 smart-card and OpenCS 0.13.0 (and below) opensc-pkcs11.dll module:

TRUECRYPT 7.1a

1. have a keyfile stored into CryptoStick DO3 by TrueCrypt itself via a proprietary pkcs11 module recommended by the manufacturer
   http://imageshost.ru/photo/177858/id2747477.html

2. setting up TrueCrypt to use OpenSC PKCS#11 module
   http://imageshost.ru/photo/177965/id2747476.html

3. when trying to mount a TrueCrypt volume with a keyfile I get a User PIN request twice it a row:
   FIRST - http://imageshost.ru/photo/50551/id2747470.html
   SECOND - http://imageshost.ru/photo/50539/id2747471.html

4. after entering User PIN twice I get either 'Security Token Error''
   http://imageshost.ru/photo/41896/id2747473.html
   or 'Keyfile not found' error
   http://imageshost.ru/photo/50329/id2747472.html

5. Available keyfiles list is empty, TrueCrypt volume obviously is not mounted
   http://imageshost.ru/photo/178020/id2747469.html

FIREFOX (and any app utilizing X.509 certificate stored into CryptoStick)

1. load OpenSC PKCS#11 module
   http://imageshost.ru/photo/322098/id2747480.html

2. the same behavior of asking for a User PIN twice in a row:
   http://imageshost.ru/photo/66486/id2747479.html
   AND
   http://imageshost.ru/photo/70470/id2747478.html)

3. certificate SUCCESSFULLY retrieved from a smart-card

Though, there is no any problems with using proprietary DLL mentioned above
http://smartcard-auth.de/download-en.html

PS. There is "pkcs11-tool --list-slots --module opensc-pkcs11.dll" execution result if needed:

Available slots:
Slot 0 (0xffffffff): Virtual hotplug slot
  (empty)
Slot 1 (0x1): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN (sig))
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469
Slot 2 (0x2): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN)
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469

[neuro18]

To sum up the problems with PKCS#11 driver on Windows 7:

1. incorrect work with OpenPGP v.2 smart-cards' DOs (Data Objects) -- GPF CryptoStick in my case;
2. the driver always asks for a User PIN twice in a row when is trying to retrieve any smart-card object (DOs, X.509 certificate, private RSA keys).

I'm just an end-user, not a programmer. How can I draw the OpenSC devolopers in digging into these issues? Thanks in advance.

[viktorTarasov]

1. You can activate the OpenSC debugging logs: in opensc.conf (in "Program Files\OpenSC Project\OpenSC) set "debug = 8" and "debug_file = ".
2. These two PINs are different -- one UserPIN and other SignPIN (look the PIN label on your images.)
   FF ask you to enter PIN for the both. Do you have the same value in two cases ?

Default behavior of OpenSC is to expose one slot per PIN and per on-card application.
You can change this behavior and select the PIN to be presented by the OpenSC module's slot.
Use 'create_slots_for_pins' option in OpenSC configuration, read the comments in opensc.conf for the possible values.

[neuro18]

1. Debug log for TrueCrypt: http://pastebin.com/kfFcGaJm
   The result of trying to list all keyfiles stored onto GPF Cryptostick 1.2. There's one in DO3, but the list is empty.
2. Debug log created when trying to login to a web-site (successfully) using X.509 personal certificate and AUTH RSA-key, both stored onto GPF Cryptostick 1.2: http://pastebin.com/RRujMtiJ/

In both cases I used default opensc.conf, so it were 2 PINs in a row to enter. It seems "User PIN" and "User PIN (sig)" are different. The smart-card itself has two PINs - User and Admin. But I entered the same User PIN in both PIN prompts and still can successfully access my X.509 certificate in Firefox. Firefox shows a dialog which states that certificate was retrieved by using "User PIN" (not "User PIN (sig)"): http://imageshost.ru/photo/11766/id2826329.html

I also tried to cut off "User PIN (sig)" by using option "create_slots_for_pins" in opensc.conf file and leave "User PIN" only to enter. No success. "User PIN (sig)" is always there, with or without "User PIN" depending of options I use:

Available slots:
Slot 0 (0xffffffff): Virtual hotplug slot
  (empty)
Slot 1 (0x1): German Privacy Foundation Crypto Stick v1.2 0
  token label        : OpenPGP card (User PIN (sig))
  token manufacturer : ZeitControl
  token model        : PKCS#15 emulated
  token flags        : rng, login required, PIN initialized, token initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 000500001469

Viktor, it seems you're Russian (or from one of ex-USSR regions). If so, we can use Russian language to communicate more productively.

[hongquan]

Hi Viktor and neuro18,
Based on 2nd log, I found:

1. OpenPGP driver retrieved successfully keys and certificates:

2013-02-18 14:46:19.977 Flags:0x8; Auth User/Sign PINs 05669CA8/00000000
2013-02-18 14:46:19.977 Found 3 RSA private keys
2013-02-18 14:46:19.977 Found 3 RSA public keys
...
2013-02-18 14:46:20.804 Found 1 certificate

1. Things seem to be OK until PKCS#11 layer failed to list objects:

2013-02-18 14:47:01.818 C_FindObjectsInit(slot = 1)
2013-02-18 14:47:01.818 [opensc-pkcs11] pkcs11-object.c:343:C_FindObjectsInit: C_FindObjectsInit(): CKA_TOKEN = TRUE
2013-02-18 14:47:01.818 [opensc-pkcs11] pkcs11-object.c:343:C_FindObjectsInit: C_FindObjectsInit(): CKA_CLASS = CKO_CERTIFICATE
2013-02-18 14:46:21.225 [opensc-pkcs11] misc.c:138:session_start_operation: called
2013-02-18 14:46:21.225 Session 0x5679ea0, type 0
2013-02-18 14:46:21.225 Object with handle 0x56654f0
2013-02-18 14:46:21.225 Object 2/90592496: Private object and not logged in.
2013-02-18 14:46:21.225 Object with handle 0x5679d88
2013-02-18 14:46:21.225 Object 2/90676616: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 Object with handle 0x5665550
2013-02-18 14:46:21.225 Object 2/90592592: Private object and not logged in.
2013-02-18 14:46:21.225 Object with handle 0x5679dc0
2013-02-18 14:46:21.225 Object 2/90676672: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 Object with handle 0x5679e30
2013-02-18 14:46:21.225 Object 2/90676784: Attribute 0x0 does NOT match.
2013-02-18 14:46:21.225 0 matching objects

@viktorTarasov Do you have any idea where error may come from?

Update:
Please ignore my comment above. Because the 2nd log is from authentication with Firefox, which you succeed. So, there is no thing wrong with certificate and auth key.
I need to investigate about retrieving TrueCrypt key from private DO.

[hongquan]

I found the cause: My PKCS15 binding for OpenPGP card does not support "DATA" object yet. This object type is used by TrueCrypt to store its own data.
http://paste.ubuntu.com/5564103/
I will improve the module to support it.

[neuro18]

Thank you, Hongquan. And what about disabling "User PIN (sig)" to enter in the .conf file or somehow else?

[hongquan]

@neuro18 There is no way to disable "User PIN (sig)" slot.

[viktorTarasov]

@neuro18
Try to play with create_slots_for_pins parameter from OpenSC configuration.

By default a PKCS#11 slot is created for any preset PKCS#15 PIN object.
You can change this setting and export, for ex., only UserPIN.

Look onto the comments in
https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/framework-pkcs15.c#L1041 to get know how SignPIN is distinguished from UserPIN.

[neuro18]

@viktorTarasov
I've tried every possible combinations of "user", "sign", "application" options with 'create_slots_for_pins' parameter. "User PIN (sig)" slot is always there. The only thing I achieved is disabled 'User PIN' itself :). What else can I do?

[viktorTarasov]

What is the output of

pkcs15-tool --list-pins

[neuro18]

PIN [User PIN (sig)]
    Object Flags   : [0x3], private, modifiable
    ID             : 01
    Flags          : [0x13], case-sensitive, local, initialized
    Length         : min_len:6, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 1 (0x01)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

PIN [User PIN]
    Object Flags   : [0x3], private, modifiable
    ID             : 02
    Flags          : [0x13], case-sensitive, local, initialized
    Length         : min_len:6, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 2 (0x02)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

PIN [Admin PIN]
    Object Flags   : [0x3], private, modifiable
    ID             : 03
    Flags          : [0x9B], case-sensitive, local, unblock-disabled, initialized, soPin
    Length         : min_len:8, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 3 (0x03)
    Type           : UTF-8
    Path           : 3f00
    Tries left     : 3

[viktorTarasov]

Ok, thanks.

Try to remove 'local' flag from the UserPIN and AdminPIN -- all your PINs are defined at the MF level, so, for me they all are 'global'.

Nevertheless, leave the 'local' flag for the SignPIN -- it will allow to PKCS#11 framework to distinguish UserPIN and SignPIN. (Probably we should introduce an explicit internal flag for that at the PKCS#15 level.)

[neuro18]

@viktorTarasov
Sorry for a noob question, but how can I remove these flags? Will this affect the current usability of the smart-card with other applications (e.g. gnupg, truecrypt, putty pagent)? BTW, OpenVPN with OpenSC PKCS#11 module under Windows asks for User PIN properly. Only Firefox request for 'User PIN (sig)' in addition to 'User PIN'.

[viktorTarasov]

@neuro18
these flags are encoded into PKCS#15 emulator.
If you are not owner of OpenPGP card driver and are using one of the official OpenSC builds, you will not be able change these flags.
Maybe Nguyen (@hongquan) could help.

Finally, I think that we could introduce a new option into the OpenSC configuration to overwrite internal mechanism used to distinguish User and Sign PINs.