Unable to upload KEY into card

[popovec]

Problem Description

Key upload failed with Security status not satisfied. (opensc 0.19.0-rc1, tested on MyEID card 3.3.3)

Steps to reproduce

pkcs15-init -E
pkcs15-init -C --so-pin 00000000 --so-puk 00000000 --pin 11111111
pkcs15-init --store-pin --id 01 --pin 11111111 --puk 11111111 --so-pin 00000000
pkcs15-init -F
pkcs15-init --store-private-key keys/rsa2048-key.pem --auth-id=1 --pin 11111111 --so-pin 00000000 -key-usage sign,decrypt --label test
Failed to store private key: Security status not satisfied

Proposed Resolution

commit 360e95d introduces lot of changes, but one change break correct reading of security attributes: (parent of this commit is 8fe377e)

$ git diff 8fe377e93b4b56060e5bbfb6f3142ceaeca744fa src/libopensc/sc.c
diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c
index af71cafa..53fefb3e 100644
--- a/src/libopensc/sc.c
+++ b/src/libopensc/sc.c
@@ -628,7 +628,7 @@ int sc_file_set_sec_attr(sc_file_t *file, const u8 *sec_attr,
                return SC_ERROR_INVALID_ARGUMENTS;
        }
 
-       if (sec_attr == NULL) {
+       if (sec_attr == NULL || sec_attr_len) {
                if (file->sec_attr != NULL)
                        free(file->sec_attr);
                file->sec_attr = NULL;

Is this condition correct ? / if (sec_attr == NULL || sec_attr_len==0) /

[frankmorgner]

Could you paste a permalink with the exact line?

[popovec]

line 631 in src/libopensc/sc.c commit details here: 360e95d#diff-db0cd89ff279ad8c7b3bb780cdf2770a

[frankmorgner]

Yes, could you try if this change fixes it:

diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c
index 53fefb3e..ea634100 100644
--- a/src/libopensc/sc.c
+++ b/src/libopensc/sc.c
@@ -628,7 +628,7 @@ int sc_file_set_sec_attr(sc_file_t *file, const u8 *sec_attr,
                return SC_ERROR_INVALID_ARGUMENTS;
        }
 
-       if (sec_attr == NULL || sec_attr_len) {
+       if (sec_attr == NULL || sec_attr_len == 0) {
                if (file->sec_attr != NULL)
                        free(file->sec_attr);
                file->sec_attr = NULL;

[popovec]

OK, patch above checked, now key upload working as expected.