search

Nitrokey / opcard-rs

OpenPGP card implementation
49 stars 1 forks source link

PIN retry counter locked during testing git signing #153

Closed APN-Pucky closed 1 year ago

APN-Pucky commented 1 year ago

I followed this guide to get my keys on the nitrokey 3 ( v1.4.0-rc.1): https://wiki.gentoo.org/wiki/Project:Infrastructure/Nitrokey_Pro_2_guide_for_Gentoo_developers I set the PIN and Admin PIN to 12345678 and wanted to sign git commits with it. During the commit I got prompted for the Admin PIN but my (correct) pin was not accepted so I quickly ran into the PIN retry counter.

I decided to run gpg-connect-agent < reset.txt with following reset.txt (from this thread https://lists.gnupg.org/pipermail/gnupg-users/2015-February/052376.html)

/hex
scd serialno
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
scd apdu 00 44 00 00
scd apdu 00 e6 00 00
/echo card has been reset to factory defaults

results in the key no longer being detected by gpg --card-status. I now know factor-reset would have probably been safer, but is there a way to reset the (whole) key?

Cheers APN

robin-nitrokey commented 1 year ago

Factory reset is a two-step process in the OpenPGP card protocol: First you have to terminate the card, then activate it again. The script you executed first tries to activate the card (which is a no-op if the card has not been terminated), and then terminates it. This means that the card is stuck in the termination state. In this state, the card does not allow any commands except activation. If you would have swapped the last two APDUs, the command should have worked.

You should be able to fix this by running the following steps with gpg-connect-agent. (Make sure that there is no other smartcard device connected to your machine before running this!)

/hex
scd serialno undefined
scd apdu 00 a4 04 00 06 d2 76 00 01 24 01
scd apdu 00 44 00 00
/bye

The last APDU may take a few seconds to execute. You may have to restart scdaemon after this (or just re-connect the device).

APN-Pucky commented 1 year ago

Thanks that fixed it!