aboutsummaryrefslogtreecommitdiffstats
path: root/scd/app-p15.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-09-09sm: Add LotW support to the key listingWerner Koch1-2/+2
* sm/certdump.c (parse_dn_part): Translate OID to "Callsign" * sm/keylist.c (oidtranstbl): Some more OIDs. -- This is Ham thingy to make it easier to read LotW certificates. Signed-off-by: Werner Koch <[email protected]>
2021-06-22scd:p15: Prepare AODF parsing for other authentication types.Werner Koch1-329/+372
* scd/app-p15.c (auth_type_t): New. (struct aodf_object_s): Add field auth_type. (read_ef_aodf): Distinguish between pin and authkey types. Include the authtype in the verbose mode diags. -- Note that the bulk of chnages are just indentation chnages. There should be no functional change. Signed-off-by: Werner Koch <[email protected]>
2021-06-18scd:p15: Add pre-check for ascii-numeric PINs.Werner Koch1-1/+9
* scd/app-p15.c (verify_pin): acii-numerix is different than BCD.
2021-06-18scd:p15: Add basic support for AET JCOP cards.Werner Koch1-5/+42
* scd/app-p15.c (CARD_TYPE_AET): New. (cardtype2str): Add string. (card_atr_list): Add corresponding ATR. (app_local_s): New flag no_extended_mode. Turn two other flags into bit flags. (select_ef_by_path): Hack to handle the 3FFF thing. (readcert_by_cdf): Do not use etxended mode for AET. (app_select_p15): Set no_extended_mode. Signed-off-by: Werner Koch <[email protected]>
2021-06-18scd:p15: Handle cards with bad encoded path objects.Werner Koch1-12/+16
* scd/app-p15.c (read_ef_prkdf, read_ef_pukdf) (read_ef_cdf, read_ef_aodf): Allow for a zero length path and correctly skip unsupported auth types. -- Signed-off-by: Werner Koch <[email protected]>
2021-06-18scd: Improve reading of binary records.Werner Koch1-2/+6
* scd/iso7816.c (iso7816_read_binary_ext): Handle the 0x6a86 SW the same as 6b00. * scd/apdu.c (apdu_get_atr): Modify debug messages. * scd/app-p15.c (app_select_p15): Print FCI on error. (read_p15_info): Clean up diag in presence of debug options. -- Some cards return 6a86 instead of 6b00. Signed-off-by: Werner Koch <[email protected]>
2021-05-20scd: avoid memory leaksJakub Jelen1-2/+3
* scd/app-p15.c (send_certinfo): free labelbuf (do_sign): goto leave instead of return * scd/app-piv.c (do_sign): goto leave instead of return, fix typo in variable name, avoid using uninitialized variables * scd/command.c (cmd_genkey): goto leave instead of return -- Signed-off-by: Jakub Jelen <[email protected]> GnuPG-bug-id: 5393
2021-05-18scd:p15: Fix logic for appending product name to MANUFACTURER.Ingo Klöcker1-2/+2
* scd/app-p15.c (do_getattr): Append product name to MANUFACTURER if manufacturer_id does not already contain a bracket and if we have a product name.
2021-04-28scd:p15: Fix the name of a card.Werner Koch1-1/+1
--
2021-04-25scd:p15: Fix last commit and improve D-TRUST detection.Werner Koch1-7/+16
* scd/app-p15.c (read_p15_info): Improve D-TRUST card detection. (do_getattr): Fix faulty code for the last commit. Append the product name to MANUFACTURER. Signed-off-by: Werner Koch <[email protected]>
2021-04-25scd:p15: Shorten the displayed s/n of RSCS cardsWerner Koch1-1/+9
* scd/app-p15.c (get_dispserialno): Add dedicated handling for RSCS. -- In fact we fix the display of the s/n because the s/n was taken from a certificate. Signed-off-by: Werner Koch <[email protected]>
2021-04-16scd:p15: Support attribute KEY-FPR.Werner Koch1-5/+170
* scd/app-p15.c: Include openpgpdefs.h. (struct prkdf_object_s): Add fields have_keytime and ecdh_kdf. (read_p15_info): Set ecdh_kdf. (keygrip_from_prkdf): Flag that we have the keytime. (send_keypairinfo): Send the key time only if valid. (send_key_fpr_line): New. (send_key_fpr): New. (do_getattr): Add KEY-FPR. Signed-off-by: Werner Koch <[email protected]>
2021-04-12scd:p15: Match private keys with certificates also by labels.Werner Koch1-28/+59
* scd/app-p15.c (cdf_object_from_label): New. (cdf_object_from_certid): Fallback to label matching. (read_p15_info): Ditto. (keygrip_from_prkdf): Ditto. Replace duplicated code by a call to cdf_object_from_objid. -- In case there is no certificate for a private key we now also try to find a certificate using a matching label. Signed-off-by: Werner Koch <[email protected]>
2021-04-01scd:p15: New flag APP_LEARN_FLAG_REREAD.Werner Koch1-27/+72
* scd/app-p15.c (do_deinit): Factor code out to ... (release_lists, release_tokeninfo): new. (read_ef_tokeninfo): Reset all data before reading. (read_p15_info): Ditto. (do_learn_status): Implement reread flag. -- Objects of a card may be protected by a PIN and thus only readble after a verify command. This new flag makes it possible to gather the entire PKCS#15 card info again without a need for a reset (and thus loss of the verify status). Signed-off-by: Werner Koch <[email protected]>
2021-03-31scd: Replace all assert macros by the log_assert macro.Werner Koch1-7/+6
Signed-off-by: Werner Koch <[email protected]>
2021-03-30scd:p15: Return labels for keys and certificates.Werner Koch1-0/+42
* scd/app-p15.c (send_certinfo): Extend certinfo. (do_getattr): Support KEY-LABEL. Signed-off-by: Werner Koch <[email protected]>
2021-03-30scd:p15: For CardOS make use of ISO7816_VERIFY_NOT_NEEDED.Werner Koch1-11/+17
* scd/app-p15.c (verify_pin): Take care of verify status. Signed-off-by: Werner Koch <[email protected]>
2021-03-30scd:p15: Return the creation time of the keys.Werner Koch1-0/+32
* scd/app-p15.c (struct prkdf_object_s): Add keytime and keyalgostr. (keygrip_from_prkdf): Set them. (send_keypairinfo): Extend KEYPAIRINFO. Signed-off-by: Werner Koch <[email protected]>
2021-03-29scd:p15: Make RSA with SHA512 work with CardOS.Werner Koch1-121/+117
* scd/app-p15.c (do_sign): Rewrite. -- This basically works now but for my test card I need to pass --cert-digest-algo-512 manually. Need to check this again and automate it. It will also be useful to take the NotBefore timestamp from the dummy X.509 certificate and use that for the PGP key creation time. Signed-off-by: Werner Koch <[email protected]>
2021-03-29scd:p15: Support ECDSA and ECDH for CardOS.Werner Koch1-100/+313
* scd/iso7816.c (iso7816_pso_csv): New. * scd/app-help.c (app_help_pubkey_from_cert): Uncompress a point if needed. * scd/app-p15.c (CARD_PRODUCT_RSCS): New. (struct prkdf_object_s): Add fields is_ecc, token_label, and tokenflags. (do_deinit): Free new fields. (cardproduct2str): New. (read_ef_prkdf): Set new is_ecc flag. (read_ef_tokeninfo): Store some data and move Tokeninfo diags to ... (read_p15_info): here. set the product info here after all data has been gathered. (send_keypairinfo): Chnage the way the gpgusage flags are used. (make_pin_prompt): If the token has a label and the current cert has no CN, show the label as holder info. (do_sign): Support ECDSA. Take care of the gpgusage flags. (do_decipher): Support ECDH. Take care of the gpgusage flags. -- This has been tested with Trusted Object Manager generated cards by Rohde & Schwarz Cybersecurity. Signed-off-by: Werner Koch <[email protected]>
2021-03-24scd:p15: Make $SIGNKEY et al determination more fault tolerant.Werner Koch1-16/+21
* scd/app-p15.c (do_getattr): Change how we use gpgUsage to figure out the keys to use.
2021-03-18scd:p15: Allow to use an auth object label with cmd CHECKPIN.Werner Koch1-20/+41
* scd/app-p15.c (prepare_verify_pin): Allow for PRKDF to be NULL. (make_pin_prompt): Ditto. (verify_pin): Ditto. (do_check_pin): Allow using the Label to specify a PIN. -- Note that a label may not work in all cases because we can't select the protected object's EF first. Signed-off-by: Werner Koch <[email protected]>
2021-03-18scd:p15: New attribute CHV-LABEL.Werner Koch1-18/+41
* scd/app-p15.c (parse_common_obj_attr): Map spaces in the lapel to underscores. (read_ef_aodf): Prettify printing of the type. (do_getattr): New attribute CHV-LABEL (do_learn_status): Emit CHV-LABEL. (verify_pin): Distinguish the PIN prompts. Signed-off-by: Werner Koch <[email protected]>
2021-03-16scd:p15: Implement CHV-STATUS attributeWerner Koch1-3/+111
* scd/command.c (send_status_direct): Return an error. * scd/app-p15.c (do_learn_status): Emit CHV-STATUS. (compare_aodf_objid): New. (do_getattr): Implement CHV-STATUS.
2021-03-10scd:p15: Fix faulty removal of a test code change.Werner Koch1-1/+1
-- Fixes-commit: 08b5ac492afc6c6e7eaaa1f70d67c81cbda2c9be
2021-03-10scd:p15: Support special extended usage flags for OpenPGP keys.Werner Koch1-6/+93
* scd/app-p15.c (struct gpgusage_flags_s): New. (struct prkdf_object_s): Add field gpgusage. (struct app_local_s): Add field any_gpgusage. (dump_gpgusage_flags): New. (read_p15_info): Parse athe gpgusage flags. (do_getattr): Take care of the gpgusage flags. -- This features allows to mark keys to be used for OpenPGP. This is done by putting additional extended key infos into the certificate stored on the cards. Only if any such extended key usage is detected for a stored certificate this new mode chimes in. This feature gives the card issuer a high flexibility on how to make sure certain keys are used with OpenPGP.
2021-02-25scd:p15: Read out the access flags.Werner Koch1-68/+141
* scd/app-p15.c (struct keyaccess_flags_s): New. (struct prkdf_object_s): Add field accessflags. (dump_keyusage_flags): New. (dump_keyaccess_flags): New. (parse_keyaccess_flags): New. (parse_common_key_attr): Return access flags. (read_ef_prkdf): Parse the access flags. Allow for ECkeys. (read_ef_pukdf): Ditto. Use new functions for printing. (read_p15_info): Use new fucntion for printing.
2021-02-24scd:p15: Get the label value of all objects for better diagnostics.Werner Koch1-78/+180
* scd/app-p15.c (struct cdf_object_s): Add fields authid, authidlen, and label. (struct prkdf_object_s): Add field label. (struct aodf_object_s): Ditto. (release_cdflist): Free new fields. (release_prkdflist): Free new field. (release_aodf_object): Ditto. (parse_common_obj_attr): Return the label. (read_ef_prkdf): Store the label. (read_ef_pukdf): Ditto. (read_ef_cdf): Use parse_common_obj_attr and store authid and label. Print them im verbose mode. (read_ef_aodf): Store the label and print it.
2021-02-23scd:p15: Make it code work again for D-Trust cards.Werner Koch1-29/+64
* scd/app-p15.c (select_and_read_binary): Allow to skip the select. (select_and_read_record): Return the statusword. Silence error message for SW_FILE_STRUCT. (select_ef_by_path): Fix selection with a home_DF. (read_first_record): Fallback to read_binary for CardOS and return info about this. (read_ef_prkdf): Use info from read_first_record to decide whether to use record or binary mode. (read_ef_pukdf): Ditto. (read_ef_aodf): Ditto. (read_ef_cdf): Ditto. New arg cdftype for diagnostics. (read_p15_info): Pass cdftype. * scd/apdu.h (SW_FILE_STRUCT): New. * scd/apdu.c (apdu_strerror): Map that one to a string. * scd/iso7816.c (map_sw): and to a gpg-error.
2021-02-22scd: Fix readkey --info in case a readkey command is available.Werner Koch1-2/+2
* scd/command.c (do_readkey): Make --info also work if a readkey command is available. * scd/app-p15.c (cdf_object_from_certid): Fix a but introduced with the previous commit.
2021-02-22scd:p15: Extract extended usage flagsand act upon them.Werner Koch1-80/+235
* scd/app-p15.c: Add a couple of oid constants. (struct cdf_object_s): Replace fields image and imagelen by cert. (struct prkdf_object_s): Add extusage flags (send_keypairinfo): Use them. (cdf_object_from_certid): Factor parts out to ... (cdf_object_from_objid): new function. (read_ef_prkdf): Move info printing to ... (read_p15_info): here. Fill the extusage flags. (readcert_by_cdf): Cache the ksba cert object instead of the binary cert. * scd/app.c (select_additional_application): Fix a log_debug call. (scd_update_reader_status_file): Ditto. -- This allows us to return only KEYPAIRINFO lines for keys we can actually use.
2021-02-19scd: Minor tweak for easier backportingWerner Koch1-11/+12
* scd/app-common.h (APP_CARD): New. Use it in app-*.c to access app->card. -- This should help to make backporting to 2.2 easier.
2021-02-02scd:p15: Read PuKDF and minor refactoring.Werner Koch1-85/+447
* scd/app-p15.c (pukdf_object_t): New. (struct app_local_s): Add field public_key_info. (release_pukdflist): New. (select_and_read_record): No diagnostic in case of not_found. (read_first_record): New. Factored out from the read_ef_ fucntions. (read_ef_pukdf): New. Basically a copy of read_ef_prkdf for now. (read_p15_info): Also read the public keys. (cardtype2str): New. (read_ef_tokeninfo): Print a string with the cardtype.
2021-01-27scd:p15: Make file selection more robust.Werner Koch1-37/+60
* scd/app-p15.c: Include host2net.h. (DEFAULT_HOME_DF): New. (select_and_read_binary): Replace slot by app. Change callers. Use select_ef_by_path. (select_and_read_record): ditto. (select_ef_by_path): Make use use the home_df. (parse_certid): Adjust for always set home_df. (print_tokeninfo_tokenflags): Ditto. (app_select_p15): Take the home_df from the FCI returned by select. -- This uses modern APDUs and always selectd starting at the PCKS-15 home DF. We could have made this much simpler but the goal is to keep support for older cards although we can't test that easily. Signed-off-by: Werner Koch <[email protected]>
2021-01-27scd:p15: Factor the commonKeyAttributes parser out.Werner Koch1-134/+206
* scd/app-p15.c (read_ef_prkdf): Fix detection of unsupported key objects. Factor some code out to ... (parse_common_key_attr): new. --
2021-01-26scd:p15: Factor the commonObjectAttributes parser out.Werner Koch1-139/+112
* scd/app-p15.c (parse_common_obj_attr): New. (read_ef_prkdf): Use new function. (read_ef_aodf): Ditto.
2021-01-26scd:p15: First step towards real CardOS 5 support.Werner Koch1-71/+209
* scd/iso7816.c (iso7816_select_path): Add arg from_cdf. * scd/app-nks.c (do_readkey): Adjust for this change. * scd/app-p15.c (CARD_TYPE_CARDOS_53): New. (IS_CARDOS_5): New. (card_atr_list): Add standard ATR for CardOS 5.3. (select_and_read_binary): Remove the fallback to record read hack. (select_and_read_record): New. (select_ef_by_path): Rework and support CardOS feature. (read_ef_prkdf): Use read record for CardOS. (read_ef_cdf): Ditto. (read_ef_aodf): Ditto. Also fix bug in the detection of other unsupported attribute types. (verify_pin): Use IS_CARDOS_5 macro. (app_select_p15): Force direct method for CardOS. Signed-off-by: Werner Koch <[email protected]>
2021-01-21scd:p15: Show the ATR as part of the TokenInfo diagnostics.Werner Koch1-0/+12
* scd/app-p15.c (read_ef_tokeninfo): Print the ATR in verbose mode. -- It is convenient to see the ATR close to the other info, Signed-off-by: Werner Koch <[email protected]>
2020-11-25scd:p15: Print the internal card type.Werner Koch1-0/+8
* scd/app-p15.c (read_ef_tokeninfo): Print the internal card type.
2020-11-25scd:p15: Improve support for some CardOS based cards.Werner Koch1-5/+30
* scd/iso7816.c (iso7816_read_binary_ext): Add optional arg r_sw and change callers. (iso7816_read_record): Factor all code out to ... (iso7816_read_record_ext): new. * scd/app-p15.c (select_and_read_binary): Fallback to record reading. (read_ef_aodf): Clear EOF error.
2020-05-05scd: Extend an internal function to also return the algo.Werner Koch1-1/+1
* scd/app-help.c (app_help_get_keygrip_string_pk): Add optional arg r_algo. Change all callers. (app_help_get_keygrip_string): Ditto. Signed-off-by: Werner Koch <[email protected]>
2020-04-09scd:p15: Return a display S/N via Assuan.Werner Koch1-21/+54
* scd/app-p15.c (make_pin_prompt): Factor some code out to ... (get_dispserialno): this. (do_getattr): Use new fucntion for a $DISPSERIALNO. Signed-off-by: Werner Koch <[email protected]>
2020-04-07scd:p15: Show a pretty PIN prompt.Werner Koch1-13/+197
* scd/app-p15.c (struct prkdf_object_s): New fields common_name and serial_number. (release_prkdflist): Free them. (keygrip_from_prkdf): Parse cert and set them. (any_control_or_space): New. (make_pin_prompt): New. (verify_pin): Construct a pretty PIN prompt. (do_sign): Remove debug output. -- The D-Trust card has the SerialNumber part of the Subject printed on the front matter, we assume this is also possible with other cards and thus we show this as serial number. The holder of the card is also extracted from the card's subject. Signed-off-by: Werner Koch <[email protected]>
2020-04-07scd:p15: Fix decrypt followed by sign problem for D-Trust cards.Werner Koch1-14/+79
* scd/iso7816.c (iso7816_select_mf): New. * scd/app-p15.c (card_product_t): New. (struct app_local_s): Add field 'card_product'. (read_ef_tokeninfo): Detect D-Trust card. (prepare_verify_pin): Switch to D-Trust AID. (do_decipher): Restore a SE for D-TRust cards. Chnage the passing indicator to 0x81. -- Using what I learned from a USB trace running the Governikus Signer Software on Windows this fixes the left over problem with the new D-Trust card support. Signed-off-by: Werner Koch <[email protected]>
2020-04-03scd:p15: Emit MANUFACTURER, $ENCRKEYID, $SIGNKEYID.Werner Koch1-18/+62
* scd/app-p15.c (read_ef_tokeninfo): Store manufacturer_id. (do_getattr): Implement MANUFACTURER, $ENCRKEYID and $SIGNKEYID. (send_keypairinfo): Also print usage flags. -- Signed-off-by: Werner Koch <[email protected]>
2020-04-02scd:p15: Implement do_with_keygrip and capabilities.Werner Koch1-34/+48
* scd/app-p15.c (prepare_verify_pin): Allow use without an AODF. (verify_pin): Ditto. (do_with_keygrip): Implement capability restrictions. Signed-off-by: Werner Koch <[email protected]>
2020-04-02scd:p15: Rename some variables and functions for clarity.Werner Koch1-28/+28
* scd/app-p15.c: Rename keyinfo to prkdf. Signed-off-by: Werner Koch <[email protected]>
2020-04-01scd:p15: Cache the PIN.Werner Koch1-0/+8
* scd/app-p15.c (struct prkdf_object_s): Add flag pin_verified. (verify_pin): Make use of it. -- Theee is still a problem with the APDUs we send: Switching between signing and decryption does work but not in the other way. Signed-off-by: Werner Koch <[email protected]>
2020-04-01scd:p15: Run a keygrip_from_prkdf before verify_pinWerner Koch1-9/+18
* scd/app-p15.c (do_sign): Move keygrip_from_prkdf before PIN verification. (do_decipher): Add keygrip_from_prkdf. -- This is required because that function may change the current file which is set by prepare_verify_pin right before MSE. HAs alredy been done on the backport to 2.2 Signed-off-by: Werner Koch <[email protected]>
2020-04-01scd:p15: Support decryption with CardOS 5 cards.Werner Koch1-2/+100
* scd/app-p15.c (do_decipher): New. -- tested using the D-TRUSt card and a SCR3310 reader. The Kobil KAAN Advanced, I used for the signing tests could not be used because it supports only Short APDU Level exchange. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 22:58:03 +0000