search

Yubico / ykneo-openpgp

OpenPGP applet for the YubiKey NEO
https://developers.yubico.com/ykneo-openpgp/
GNU General Public License v2.0
215 stars 67 forks source link

opensc compatibility #4

Open klali opened 11 years ago

klali commented 11 years ago

The openpgp applet today is not compatible with opensc, it would probably be a good idea to be compatible even if opensc requires the atr to be listed to recognize the card.

Yannovitch commented 10 years ago

+1

oliverklee commented 10 years ago

:+1:

Doridian commented 10 years ago

+1

jas4711 commented 10 years ago

So what's involved in making this happen? Is it about patching OpenSC, or is something required in the applet?

klali commented 10 years ago

It's probably only changes to the applet to conform to expectations of OpenSC.

As the openpgp driver in OpenSC does it's detection based on ATR the driver choice has to be forced instead of autodetected. The first and simplest test is to run:

$ OPENSC_DEBUG=9 opensc-tool -c openpgp -n

and compare with a standard openpgp card.

asheiduk commented 9 years ago

It seems that OpenSC sends SELECT-FILE:

00 A4 04 00 06 D2 76 00 01 24 01 00

The OpenPGP card returns

62 15 84 10 D2 76 00 01 24 01 02 00 00 05 00 00
21 E4 00 00 8A 01 05 90 00

but Yubico only returns

90 00

The OpenPGP spec 2.0 allows to return a FCI or empty (p. 31) but OpenSC bails out expecting either an FCI or FCP response.

stv0g commented 9 years ago

The OpenPGP spec 2.0 allows to return a FCI or empty (p. 31) but OpenSC bails out expecting either an FCI or FCP response.

Sounds like OpenSC is not following the spec? In this case we should patch OpenSC instead of the applet?

jas4711 commented 9 years ago

What's the SELECT FILE command supposed to do? If we can make OpenSC accept this (supposedly legal?) output, would it make the OpenSC OpenPGP PKCS#11 driver work? That would be good -- I just read http://changelog.complete.org/archives/9381-detailed-smart-card-cryptographic-token-security-guide and it suggested the neo didn't work with opensc in openpgp mode.

frankmorgner commented 6 years ago

Just stumbled across this; a bug report would have been nice...

Anyway, it's fixed in OpenSC with https://github.com/OpenSC/OpenSC/pull/1232