Open sosthene-nitrokey opened 2 years ago
I also dived a bit deeper into the historical bytes
and fixed the Options
struct
If the card indicates DO handling for EF.DIR, then it should support the GET DATA com- mand for reading all DOs in the EF at once ('00CB 2F00 02 5C00 00') directly after a reset.
I think this is not true for our implementation because
apdu-dispatch
requires aSELECT
before allowing theGET DATA
command. From my understanding, we would have to add support for the EF (and maybe MF?) toapdu-dispatch
. What do you think?
That would seem right. Do other applications also have data in the EF.DIR and ATR? I guess apdu_dispatch
would need to merge the data for each application.
Looking at the fido implementation it doesn't seem to require it.
Achim Pietig (Author of the spec) has given some clarifications regarding this feature:
The files EF.DIR and EF.ATR are optional – in my implementations I added them as example how to read data objects from such files. I think there is no need to implement GET DATA with ODD INS, because I don’t know any implementation on such a card. In addition all relevant information of the ATR is present in the OpenPGP app itself.
But as @daringer found out the EF.DIR might be relevant for interoperability with other software:
❯ pkcs11-tool -k --key-type EC:curve25519 Using slot 0 with a present token (0x0) error: Generate EC key mechanism 1056 not supported Aborting.
[opensc-pkcs11] card.c:1614:sc_card_sm_check: called [opensc-pkcs11] card.c:1619:sc_card_sm_check: returning with: 0 (Success) [opensc-pkcs11] card.c:397:sc_connect_card: returning with: 0 (Success) [opensc-pkcs11] slot.c:285:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Connected SC card 0x5594ab16b590 [opensc-pkcs11] dir.c:171:sc_enum_apps: called [opensc-pkcs11] card.c:853:sc_select_file: called; type=2, path=3f002f00 [opensc-pkcs11] card-openpgp.c:1442:pgp_select_file: called [opensc-pkcs11] card-openpgp.c:1496:pgp_select_file: returning with: -1201 (File not found) [opensc-pkcs11] card.c:875:sc_select_file: 'SELECT' error: -1201 (File not found) [opensc-pkcs11] dir.c:180:sc_enum_apps: Cannot select **EF.DIR** file: -1201 (File not found) [opensc-pkcs11] slot.c:292:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detecting Framework. 0 on-card applications [opensc-pkcs11] slot.c:293:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: generic application <none> [opensc-pkcs11] slot.c:307:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detected framework 0. Creating tokens. [opensc-pkcs11] slot.c:322:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Try to bind 'generic' token. [opensc-pkcs11] framework-pkcs15.c:321:pkcs15_bind: Bind PKCS#15 '<anonymous>' application [opensc-pkcs11] pkcs15.c:1230:sc_pkcs15_bind: called [opensc-pkcs11] pkcs15.c:1231:sc_pkcs15_bind: application(aid:'empty') [opensc-pkcs11] pkcs15.c:1266:sc_pkcs15_bind: PKCS#15 options: use_file_cache=0 use_pin_cache=1 pin_cache_counter=10 pin_cache_ignore_user_consent=0 private_certificate=0 [opensc-pkcs11] card.c:473:sc_lock: called [opensc-pkcs11] reader-pcsc.c:688:pcsc_lock: called
I'm not sure I got it right. The documentation is unclear and
gnuk
doesn't support it.Maybe it should actually be handled by the card or in APDU dispatch because if I understand correctly the information matters to be able to correctly
SELECT
the openpgp application.