Nitrokey / opcard-rs

OpenPGP card implementation
50 stars 1 forks source link

Add support for GET DATA with odd instruction #62

Open sosthene-nitrokey opened 2 years ago

sosthene-nitrokey commented 2 years ago

I'm not sure I got it right. The documentation is unclear and gnuk doesn't support it.

Maybe it should actually be handled by the card or in APDU dispatch because if I understand correctly the information matters to be able to correctly SELECT the openpgp application.

sosthene-nitrokey commented 2 years ago

I also dived a bit deeper into the historical bytes and fixed the Options struct

sosthene-nitrokey commented 2 years ago

If the card indicates DO handling for EF.DIR, then it should support the GET DATA com- mand for reading all DOs in the EF at once ('00CB 2F00 02 5C00 00') directly after a reset.

I think this is not true for our implementation because apdu-dispatch requires a SELECT before allowing the GET DATA command. From my understanding, we would have to add support for the EF (and maybe MF?) to apdu-dispatch. What do you think?

That would seem right. Do other applications also have data in the EF.DIR and ATR? I guess apdu_dispatch would need to merge the data for each application.

sosthene-nitrokey commented 2 years ago

Looking at the fido implementation it doesn't seem to require it.

sosthene-nitrokey commented 2 years ago

Achim Pietig (Author of the spec) has given some clarifications regarding this feature: 

The files EF.DIR and EF.ATR are optional – in my implementations I added them as example how to read data objects from such files. I think there is no need to implement GET DATA with ODD INS, because I don’t know any implementation on such a card. In addition all relevant information of the ATR is present in the OpenPGP app itself.

But as @daringer found out the EF.DIR might be relevant for interoperability with other software:

❯ pkcs11-tool -k --key-type EC:curve25519
Using slot 0 with a present token (0x0)
error: Generate EC key mechanism 1056 not supported
Aborting.
[opensc-pkcs11] card.c:1614:sc_card_sm_check: called
[opensc-pkcs11] card.c:1619:sc_card_sm_check: returning with: 0 (Success)
[opensc-pkcs11] card.c:397:sc_connect_card: returning with: 0 (Success)
[opensc-pkcs11] slot.c:285:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Connected SC card 0x5594ab16b590
[opensc-pkcs11] dir.c:171:sc_enum_apps: called
[opensc-pkcs11] card.c:853:sc_select_file: called; type=2, path=3f002f00
[opensc-pkcs11] card-openpgp.c:1442:pgp_select_file: called
[opensc-pkcs11] card-openpgp.c:1496:pgp_select_file: returning with: -1201 (File not found)
[opensc-pkcs11] card.c:875:sc_select_file: 'SELECT' error: -1201 (File not found)
[opensc-pkcs11] dir.c:180:sc_enum_apps: Cannot select **EF.DIR** file: -1201 (File not found)
[opensc-pkcs11] slot.c:292:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detecting Framework. 0 on-card applications
[opensc-pkcs11] slot.c:293:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: generic application <none>
[opensc-pkcs11] slot.c:307:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detected framework 0. Creating tokens.
[opensc-pkcs11] slot.c:322:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Try to bind 'generic' token.
[opensc-pkcs11] framework-pkcs15.c:321:pkcs15_bind: Bind PKCS#15 '<anonymous>' application
[opensc-pkcs11] pkcs15.c:1230:sc_pkcs15_bind: called
[opensc-pkcs11] pkcs15.c:1231:sc_pkcs15_bind: application(aid:'empty')
[opensc-pkcs11] pkcs15.c:1266:sc_pkcs15_bind: PKCS#15 options: use_file_cache=0 use_pin_cache=1 pin_cache_counter=10 pin_cache_ignore_user_consent=0 private_certificate=0
[opensc-pkcs11] card.c:473:sc_lock: called
[opensc-pkcs11] reader-pcsc.c:688:pcsc_lock: called