Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

epass 2003 - Failed to erase card #767

Closed
jursonovicst opened this issue May 27, 2016 · 15 comments
Closed

epass 2003 - Failed to erase card #767

jursonovicst opened this issue May 27, 2016 · 15 comments

Comments

@jursonovicst
Copy link

Expected behaviour

What should happen?

epass 2003 should be erased

Actual behaviour

What happens instead?

pkcs15-init -E gives the following error:

root@ubuntu:~# pkcs15-init -E
Using reader with a card: Feitian ePass2003 00 00
Failed to erase card: Security status not satisfied

Steps to reproduce

  1. connect epass 2003
  2. pkcs15-init -E

Logs

pkcs15-init -E -vvv logs
@vDorst
Copy link

vDorst commented May 27, 2016

Please contact @FeitianSmartcardReader, they can provide you a tool to fix that problem.
Still on my todo list to update the Wiki.

@FeitianSmartcardReader
Copy link
Contributor

@jursonovicst Please send mail to Leon@ftsafe.com, he will give you a tool, thanks

@jursonovicst
Copy link
Author

Thank you...

@aurabindo
Copy link

aurabindo commented Jun 9, 2016 •
edited

@FeitianSmartcardReader it would be convenient if you could post the tool here. I also have the same problem, and I request you to send me the tool. I've sent you a mail already (from mail at aurabindo dot in). kindly respond to that.

@alistairmackenzie
Copy link

Also having this issue with two different devices. @FeitianSmartcardReader dropped the address above an email.

@FeitianSmartcardReader
Copy link
Contributor

did you send mail to us? We didn't receive your mail, please send mail to us, thanks
leon@ftsafe.com and copy hongbin@ftsafe.com

@alistairmackenzie
Copy link

alistairmackenzie commented Jun 20, 2016 •
edited

@FeitianSmartcardReader Have sent again to both addresses. Should be coming from --removed--

@FeitianSmartcardReader
Copy link
Contributor

FeitianSmartcardReader commented Jul 4, 2016 •
edited

@alistairmackenzie We finish linux tool, check and download from below:
Fix_tool
After running fix-tool by root, please do re-plug token/card

@persmule
Copy link

Source code for Fix_tool is needed, otherwise we cannot know whether the Fix_tool do something other than fixing the token.

@zweipunktnull
Copy link

zweipunktnull commented Aug 31, 2017 •
edited by frankmorgner

Hey ;)
I am trying to run:

sudo pkcs15-init --store-certificate cs.pem --auth-id 01 --id 01 --format pem -vvv

but it gives me the following output...

00 20 00 F4 08 31 32 33 34 35 36 37 38 . ...12345678
0x7f16f2344700 16:24:07.848 [pkcs15-init] reader-pcsc.c:212:pcsc_internal_transmit: called
0x7f16f2344700 16:24:07.860 [pkcs15-init] reader-pcsc.c:293:pcsc_transmit: 
Incoming APDU (2 bytes):
6A 81 j.
0x7f16f2344700 16:24:07.860 [pkcs15-init] apdu.c:390:sc_single_transmit: returning with: 0 (Success)
0x7f16f2344700 16:24:07.860 [pkcs15-init] apdu.c:543:sc_transmit: returning with: 0 (Success)
0x7f16f2344700 16:24:07.860 [pkcs15-init] card.c:459:sc_unlock: called
0x7f16f2344700 16:24:07.860 [pkcs15-init] card-cardos.c:313:cardos_check_sw: function/mode not supported
0x7f16f2344700 16:24:07.860 [pkcs15-init] card-cardos.c:1232:cardos_pin_cmd: returning with: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] sec.c:216:sc_pin_cmd: returning with: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:3754:sc_pkcs15init_verify_secret: 'VERIFY' pin cmd failed: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:3816:sc_pkcs15init_authenticate: returning with: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:3884:sc_pkcs15init_create_file: Cannot create file: 'CREATE' authentication failed: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:3929:sc_pkcs15init_update_file: Failed to create file: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:2245:sc_pkcs15init_store_data: returning with: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] pkcs15-lib.c:2042:sc_pkcs15init_store_certificate: returning with: -1408 (Not supported)
0x7f16f2344700 16:24:07.860 [pkcs15-init] card.c:459:sc_unlock: called
0x7f16f2344700 16:24:07.860 [pkcs15-init] reader-pcsc.c:662:pcsc_unlock: called
Failed to store certificate: Not supported
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:430:sc_pkcs15init_unbind: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:431:sc_pkcs15init_unbind: Pksc15init Unbind: 1:0x2466660:1
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:3012:sc_pkcs15init_update_lastupdate: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:2978:sc_pkcs15init_update_tokeninfo: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:3913:sc_pkcs15init_update_file: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] pkcs15-lib.c:3917:sc_pkcs15init_update_file: path:3f0050155032; datalen:297
0x7f16f2344700 16:24:07.868 [pkcs15-init] card.c:748:sc_select_file: called; type=2, path=3f0050155032
0x7f16f2344700 16:24:07.868 [pkcs15-init] card-cardos.c:484:cardos_select_file: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] apdu.c:554:sc_transmit_apdu: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] card.c:407:sc_lock: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] reader-pcsc.c:612:pcsc_lock: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] card.c:449:sc_lock: returning with: 0 (Success)
0x7f16f2344700 16:24:07.868 [pkcs15-init] apdu.c:521:sc_transmit: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] apdu.c:371:sc_single_transmit: called
0x7f16f2344700 16:24:07.868 [pkcs15-init] apdu.c:378:sc_single_transmit: CLA:0, INS:A4, P1:8, P2:0, data(4) 0x7ffee684a302
0x7f16f2344700 16:24:07.868 [pkcs15-init] reader-pcsc.c:283:pcsc_transmit: reader 'Gemalto PC Twin Reader (FFACA692) 00 00'
0x7f16f2344700 16:24:07.868 [pkcs15-init] reader-pcsc.c:284:pcsc_transmit:

Dont know where the error failed to store certificate: not supported come from
Maybe can you guys help me? I would be very thankful!

Greetings

@RichieB2B
Copy link

I'm trying to overcome this problem:

$ pkcs15-init --create-pkcs15 --profile pkcs15+openpin --label 'test'
Using reader with a card: Feitian ePass2003 00 00
New User PIN.
Please enter User PIN: 
Please type again to verify: 
Unblock Code for New User PIN (Optional - press return for no PIN).
Please enter User unblocking PIN (PUK): 
Please type again to verify: 
Failed to create PKCS #15 meta structure: Not allowed

When running the fix-tool posted above it pretends to be working:

# ./FIX_TOOL 
[]===================================================[]
 |              FIX_TOOL_ePass2003/2003Auto         |
 |                                      FT V2.0     |
[]===================================================[]

Fixing.............

Done................

However the problem remains even after replugging the epass2003 usb key. I am able to do a pkcs15-init --erase-card after the fix-tool but the pkcs15-init --create-pkcs15 still fails.

1 similar comment
@RichieB2B
Copy link

I'm trying to overcome this problem:

$ pkcs15-init --create-pkcs15 --profile pkcs15+openpin --label 'test'
Using reader with a card: Feitian ePass2003 00 00
New User PIN.
Please enter User PIN: 
Please type again to verify: 
Unblock Code for New User PIN (Optional - press return for no PIN).
Please enter User unblocking PIN (PUK): 
Please type again to verify: 
Failed to create PKCS #15 meta structure: Not allowed

When running the fix-tool posted above it pretends to be working:

# ./FIX_TOOL 
[]===================================================[]
 |              FIX_TOOL_ePass2003/2003Auto         |
 |                                      FT V2.0     |
[]===================================================[]

Fixing.............

Done................

However the problem remains even after replugging the epass2003 usb key. I am able to do a pkcs15-init --erase-card after the fix-tool but the pkcs15-init --create-pkcs15 still fails.

@FeitianSmartcardReader
Copy link
Contributor

FeitianSmartcardReader commented Mar 8, 2019 via email •
edited

@FeitianSmartcardReader
Copy link
Contributor

@RichieB2B can please share your pcsc log for our engineer to check? or is possible to have a remote session to have a look? thanks and looking forward to your reply,

my mail hongbin@ftsafe.com

@RichieB2B
Copy link

@FeitianSmartcardReader I was all set to record the pcscd logs, but I can't seem to reproduce the issue. pkcs15-init --create-pkcs15 is working again.

riastradh pushed a commit to riastradh/OpenSC that referenced this issue Aug 19, 2020
epass2003: Fix erase sequence.
2496f5d 
The previous erase sequence did not always work.  For example:

   % pkcs15-init -C
   Using reader with a card: Feitian ePass2003 00 00
   New User PIN.
   Please enter User PIN: 1234
   Please type again to verify: 1234
   Unblock Code for New User PIN (Optional - press return for no PIN).
   Please enter User unblocking PIN (PUK):
   Failed to create PKCS OpenSC#15 meta structure: Security status not satisfied

   % pkcs15-init -E
   Using reader with a card: Feitian ePass2003 00 00
   Failed to erase card: Security status not satisfied

This apparently bricked many people's ePass2003 devices:

OpenSC#767
https://sourceforge.net/p/opensc/mailman/message/33621883/
https://github.com/OpenSC/OpenSC/wiki/Feitian-ePass2003

Feitian provided a proprietary binary blob called `FIX_TOOL' to recover
devices from this state, but declined to offer source code when asked:

https://download.ftsafe.com/files/ePass/Fix_Tool.tar.gz
https://download.ftsafe.com/files/reader/SDK/Fix_Tool_20200604.zip

With reverse-engineering help by Saleem Rashid (@saleemrashid on
Github), I was able to find the sequence of three APDUs that the tool
submits to the device to erase it.  The mechanism seems to be:

1. Install a magic PIN.  This is like install_secret_key, as used by
   internal_install_pin, but with a few different magic constants.

2. Verify the magic PIN.

3. Delete the MF file, without selecting anything first.

With this patch, `pkcs15-init -E' successfully erases my ePass2003, and
I am able to initialize it with `pkcs15-init -C -p pkcs15+onepin' if I
set both a user pin and a PUK.  (This patch does not prevent the
ePass2003 from getting into the state which could not be erased by the
old erase sequence.)
@riastradh riastradh mentioned this issue Aug 19, 2020
Merged
3 tasks
frankmorgner pushed a commit that referenced this issue Sep 23, 2020
@frankmorgner
epass2003: Fix erase sequence.
5a369a8 
The previous erase sequence did not always work.  For example:

   % pkcs15-init -C
   Using reader with a card: Feitian ePass2003 00 00
   New User PIN.
   Please enter User PIN: 1234
   Please type again to verify: 1234
   Unblock Code for New User PIN (Optional - press return for no PIN).
   Please enter User unblocking PIN (PUK):
   Failed to create PKCS #15 meta structure: Security status not satisfied

   % pkcs15-init -E
   Using reader with a card: Feitian ePass2003 00 00
   Failed to erase card: Security status not satisfied

This apparently bricked many people's ePass2003 devices:

#767
https://sourceforge.net/p/opensc/mailman/message/33621883/
https://github.com/OpenSC/OpenSC/wiki/Feitian-ePass2003

Feitian provided a proprietary binary blob called `FIX_TOOL' to recover
devices from this state, but declined to offer source code when asked:

https://download.ftsafe.com/files/ePass/Fix_Tool.tar.gz
https://download.ftsafe.com/files/reader/SDK/Fix_Tool_20200604.zip

With reverse-engineering help by Saleem Rashid (@saleemrashid on
Github), I was able to find the sequence of three APDUs that the tool
submits to the device to erase it.  The mechanism seems to be:

1. Install a magic PIN.  This is like install_secret_key, as used by
   internal_install_pin, but with a few different magic constants.

2. Verify the magic PIN.

3. Delete the MF file, without selecting anything first.

With this patch, `pkcs15-init -E' successfully erases my ePass2003, and
I am able to initialize it with `pkcs15-init -C -p pkcs15+onepin' if I
set both a user pin and a PUK.  (This patch does not prevent the
ePass2003 from getting into the state which could not be erased by the
old erase sequence.)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@frankmorgner @aurabindo @RichieB2B @vDorst @alistairmackenzie @persmule @FeitianSmartcardReader @jursonovicst @zweipunktnull