search

Nitrokey / nitrokey-start-firmware

A mirror of Gnuk's 1.0.x and 1.2.x branches.
56 stars 15 forks source link

Update RTM fails with "Could not connect to the device" #21

Closed peterroth closed 4 years ago

peterroth commented 4 years ago

Hi everybody,

I followed the steps from prebuilt/README.md to update my Nitrokey Start (to RTM.7), but it fails every time, doesn't matter what I change or do. I have pyusb and pytest:

pip3 list | egrep "usb|test"
pytest             5.3.1
pyusb              1.0.2

I modified the gnuk_get_random.py, upgrade_by_passwd.py and usb_strings.py to point to the location where my Python 3 is installed. The error I can see is:

*** Could not connect to the device. Attempting to close scdaemon.
*** Running: gpg-connect-agent "SCD KILLSCD" "SCD BYE" /bye
*** Please try again...
*** Could not proceed with the update. Please close other applications, that possibly use it (e.g. scdaemon, pcscd) and try again.

I checked and no scdaemon, nor pcscd is running:

ps -ef | grep -i scd
  504 44977 36923   0  4:00PM ttys002    0:00.01 grep --colour=always -i scd

I read that I should remove the device from the USB plug, reinsert it and run the same command, but it still fails with the same error message. Oddly, the 'gpg --card-status' doesn't show any RTM version:

gpg --card-status
Reader ...........: Nitrokey Nitrokey Start

The 'usb_strings.py' shows the device is on RTM.6. My device is the red blinking one.

Do you have any idea what else can be checked or set to overcome this cumbersome situation?

szszszsz commented 4 years ago

Hi!

What is your attempt counter on the device? It should be listed on gpg2 --card-status.

Edit: update might fail, if the counter is equal 0 as far as I remember.

szszszsz commented 4 years ago

Please make another run with this updated version [1], where the error strings are printed to console.

Edit: Make sure the attempt counter is higher than 1, or the device will lock itself. Update attempt might decrease the attempt counter, if the provided Admin PIN is invalid.

[1] https://github.com/Nitrokey/nitrokey-start-firmware/blob/21-update-verbose/tool/upgrade_by_passwd.py

peterroth commented 4 years ago

Thanks, I checked and the counters are on 3:

gpg2 --card-status
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3

I'm not sure if printing the error did the trick (checked the last commit) but with the updated Python script it succeeded this time:

Device:
    Vendor: Nitrokey
   Product: Nitrokey Start
    Serial: FS***3
  Revision: RTM.7
    Config: NITROKEY_START:dfu=no:debug=no:pinpad=no:certdo=yes:factory_reset=yes
       Sys: 3.0

Thanks a lot!

szszszsz commented 4 years ago

I wish we would better pinpoint the cause, but anyway I am glad it works for you!

I have modified the update tool, so it would print the error message right away, so it should be more obvious in the future.

peterroth commented 4 years ago

Only for debugging purposes: I tried on the machine where I couldn't update originally on last Wednesday, when I opened the report; there it still fails with the below error:

Could not connect to the device. Attempting to close scdaemon. Running: gpg-connect-agent "SCD KILLSCD" "SCD BYE" /bye Please try again... Could not proceed with the update. Please close other applications, that possibly use it (e.g. scdaemon, pcscd) and try again.

It is printed after I downloaded the newest available version with 'git clone'.