aboutsummaryrefslogtreecommitdiffstats
path: root/scd/app-piv.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* scd: Add an re-select mechanism to switch apps.Werner Koch2019-06-251-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add func ptr 'reselect'. * scd/app-piv.c (do_reselect): New. (app_select_piv): Move AID constant to file scope. * scd/app-openpgp.c (do_reselect): New. (app_select_openpgp): Move AID constant to file scope. * scd/app.c (apptype_from_name): New. (check_application_conflict): Check against all apps of the card. Always set current_apptype. (select_additional_application): New. (maybe_switch_app): New. (app_write_learn_status, app_readcert, app_readkey, app_getattr) (app_setattr, app_sign, app_auth, app_decipher, app_writecert) (app_writekey, app_genkey, app_change_pin, app_check_pin): Use it here. (app_do_with_keygrip): Force reselect on success. (app_new_register): Move setting of CURRENT_APPTYPE to ... (select_application): here so that it will be set to the requested card. * scd/command.c (open_card_with_request): Select additional application if possible. -- Noet that we will likely need to rework this even more so to get well defined semantics for card access. Signed-off-by: Werner Koch <[email protected]>
* scd: Simplify inclusion of app-common.h.Werner Koch2019-06-211-1/+0
| | | | | | | | | | | | | | * scd/scdaemon.h: Include app-common.h. Remove inclusion of that header from all other files. (card_t, app_t): Move typedef to ... * scd/app-common.h: here. Use them in the defs. -- In another patch we will need apptype_t in the ctrl object and thus we need to reorganize things a bit now. Given that most files need app-common anyway it makes sense to always include it. Signed-off-by: Werner Koch <[email protected]>
* scd: Use enums for cardtype and apptype.Werner Koch2019-06-211-2/+2
| | | | | | | | | | | | | | | | * scd/app-common.h (cardtype_t): New. (apptype_t): New. (struct card_ctx_s): Change type of cardtype. (struct app_ctx_s): Change type of apptype. Adjust all users. * scd/app.c (struct app_priority_list_s): Add field apptype. (strcardtype): New. Use as needed. (strapptype): New. Use as needed. -- Using strcmp is lame and we can't use a switch to let the compiler complain about missed cases. Signed-off-by: Werner Koch <[email protected]>
* scd: Split data structures into app and card related objects.Werner Koch2019-06-191-31/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-common.h (struct card_ctx_s): New. (struct app_ctx_s): Factor card specific fields out to card_ctx_s. (app_get_slot): New. * scd/scdaemon.h (card_t): New. (struct server_control_s): Rename field app_ctx to card_ctx and change all users. * scd/app-dinsig.c: Use app_get_slot and adjust for chang in card related fields. * scd/app-geldkarte.c: Ditto. * scd/app-nks.c: Ditto. * scd/app-openpgp.c: Ditto. * scd/app-p15.c: Ditto. * scd/app-sc-hsm.c: Ditto. * scd/app.c: Lost of changes to adjust for the changed data structures. Change all callers. (app_list_lock): Rename to card_list_lock. (app_top): Remove. (card_top): New. (lock_app): Rename to lock_card and change arg type. (unlock_app): Rename to unlock_card. (app_dump_state): Print card and app info. (app_reset): Rename to card_reset. (app_new_register): Change for the new data structure. (deallocate_card): Dealloc card and all apps. (app_ref): Rename to card_ref. (app_unref): Rename to card_unref. (app_unref_locked): Rename to card_unref_locked. (card_get_serialno): New. * scd/command.c (cmd_pkdecrypt): Actually use the looked up card and former app object and not the standard one from the context. -- Although quite large, this is a straightforward change to separate card/token related data from card application related data. Before this change there was a one-to-one relation between card and application and no way to represent several applications on a card. The new data structure will allow for such a representation. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Add the do_with_keygrip feature.Werner Koch2019-06-171-0/+89
| | | | | | | * scd/app-piv.c (do_with_keygrip): New. (app_select_piv): Register function. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Fix RSA decryption.Werner Koch2019-04-041-6/+25
| | | | | | | * scd/app-piv.c (do_decipher): Fixup leading zero byte. -- Signed-off-by: Werner Koch <[email protected]>
* scd: New options --info and --info-only for READKEY.Werner Koch2019-04-031-5/+31
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_readkey): New options --info and --info-only. * scd/app.c (app_readkey): New arg 'flags'. * scd/app-common.h (APP_READKEY_FLAG_INFO): New. (struct app_ctx_s): New args 'ctrl' and 'flags' for member readkey. Change all implementers. * scd/app-nks.c (do_readkey): Stub implementation of APP_READKEY_FLAG_INFO. * scd/app-openpgp.c (do_readkey): Implement APP_READKEY_FLAG_INFO. * scd/app-piv.c (do_readkey): Ditto. -- This feature allows to quickly get the keygrip and in most cases also the usage flags for one specific keyref. Example: <- readkey --info-only PIV.9D -> S KEYPAIRINFO FC6061FB457224370B85C6F34DD56CD29E669620 PIV.9D e -> OK Signed-off-by: Werner Koch <[email protected]>
* scd: New standard attributes $ENCRKEYID and $SIGNKEYID.Werner Koch2019-04-031-1/+13
| | | | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_keypairinfo): Use --keypairinfo. * sm/call-agent.c (gpgsm_agent_scd_keypairinfo): Ditto. * scd/app-openpgp.c (do_getattr): Add attributes "$ENCRKEYID" and "$SIGNKEYID". * scd/app-piv.c (do_getattr): Ditto. -- We already have $AUTHKEYID to locate the keyref of the key to be used with ssh. It will also be useful to have default keyref for encryption and signing. For example, this will allow us to repalce the use of "OPENPGP.2" by a app type specific keyref. Signed-off-by: Werner Koch <[email protected]>
* doc: Add a spec comment to app-piv.cWerner Koch2019-03-221-0/+1
| | | | --
* scd: Rename a shared info field name.Werner Koch2019-03-051-1/+1
| | | | | | | | * scd/app-piv.c (app_select_piv): * scd/app-common.h (struct app_ctx_s): Rename 'card_version' to 'cardversion'. Rename all users. Add 'appversion'. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement import of private keys for Yubikeys.Werner Koch2019-03-051-13/+429
| | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (concat_tlv_list): Add arg 'secure' and adjust callers. (writekey_rsa, writekey_ecc): New. (do_writekey): New. (do_writecert): Provide a better error message for an empty cert. (app_select_piv): Register do_writekey. * scd/iso7816.c (iso7816_send_apdu): New. * scd/app-common.h (APP_WRITEKEY_FLAG_FORCE): New. * agent/command.c (cmd_keytocard): Make the timestamp optional. * tools/card-call-scd.c (inq_writekey_parms): Remove. (scd_writekey): Rewrite. * tools/gpg-card.c (cmd_writekey): New. (enum cmdids): Add cmdWRITEKEY. (dispatch_command, interactive_loop): Call cmd_writekey. -- This has been tested with gpgsm and RSA keys. For ECC keys only partly tested using the sample OpenPGP nistp256 and nistp384 keys because gpgsm does not yet support ECC certificates and thus we can't write the certificates to the cert object after a writekey. Note that they nevertheless show up in "gpgcard list" because gpg-card searches for them in gpg and gpgsm. However, this does not work completely. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Add feature to read Yubikey attestation certificates.Werner Koch2019-03-011-2/+28
| | | | | | | | | | | * scd/app-piv.c (do_readcert): Add hack to read Yubikey attestaions. -- Use gpg-card 'readcert PIV.ATST.9A >x.crt' to store the attestation certificate for 9A into X.CRT. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Allow writecert to only write matching certs.Werner Koch2019-03-011-22/+55
| | | | | | | | | * scd/app-piv.c (do_readkey): Read the key from the cert here instead of letting the upper layer do this. (do_writecert): Check that the cert matches the key and that a key has already been generated. Signed-off-by: Werner Koch <[email protected]>
* scd: Simplify the app_readkey parameters.Werner Koch2019-02-261-15/+2
| | | | | | | | | | | | | | * scd/app-help.c (app_help_pubkey_from_cert): New. * scd/command.c (cmd_readkey): Refactor to use that new function and handle the --advanced flag only here. * scd/app.c (app_readkey): Remove parm advanced. * scd/app-common.h (struct app_ctx_s): Remove parm advanced from the readkey member. * scd/app-nks.c (do_readkey): Adjust for removed parm. * scd/app-piv.c (do_readkey): Ditto. * scd/app-openpgp.c (do_readkey): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: PIV: Always require a PIN for signing with 9C.Werner Koch2019-02-251-8/+20
| | | | | | | * scd/app-piv.c (verify_chv): Add arg 'force'. (do_sign): Use force for 0x9c. Signed-off-by: Werner Koch <[email protected]>
* scd: Extend KEYPAIRINFO by key usage info.Werner Koch2019-02-211-45/+84
| | | | | | | | | | * scd/app-openpgp.c (send_keypair_info): Append usage string. * scd/app-piv.c (struct data_object_s): Remove column 'binary'. Add column 'usage'. (dump_all_do): Adjust for removed 'binary'. (send_keypair_and_cert_info): Append usage string. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement decryption for PIV cards.Werner Koch2019-02-111-1/+146
| | | | | | | | | | * scd/app-piv.c (do_decipher): New. -- Note that ECDH decryption has not been tested due to the lack of ECC support in gpgsm. Signed-off-by: Werner Koch <[email protected]>
* scd: For PIV cards used NO_AUTH instead of BAD_PIN.Werner Koch2019-02-111-1/+14
| | | | | | | | | * common/util.h (GPG_ERR_NO_AUTH, GPG_ERR_BAD_AUTH): Add replacement codes for gpgrt < 1.36. * scd/app-piv.c (auth_adm_key): (do_genkey, do_writecert): Use better error codes. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement RSA signing for PIV cards.Werner Koch2019-02-081-99/+299
| | | | | | | | | * scd/app-piv.c (concat_tlv_list): New. (get_key_algorithm_by_dobj): Rename args for clarity. (do_auth): factor all code out to ... (do_sign): new. Implement RSA signing. Signed-off-by: Werner Koch <[email protected]>
* scd: Allow generating ECC curves on PIV cards.Werner Koch2019-02-081-0/+53
| | | | | | | | | * scd/app-piv.c (genkey_parse_ecc): New. (get_keygrip_by_tag): Call that one. (do_readkey): Call that one. * scd/command.c (cmd_genkey): Add option --algo. Signed-off-by: Werner Koch <[email protected]>
* scd: Store a new PIV public key in the certificate DO.Werner Koch2019-02-071-106/+179
| | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (struct genkey_result_s): Remove type and all users. (send_keypair_and_cert_info): Print certinfo only if we got a cert.. (readcert_by_tag): Add arg r_mechanism and implement reading of public keys. (get_keygrip_by_tag): Use a public key to compute the keygrip. (do_readcert): Make sure to only return a certificate. (do_readkey): Read public key from the DO if a certificate is missing. (get_key_algorithm_by_dobj): Get the algorithm also from a public key. (does_key_exist): String changes. (do_genkey): Remove result caching and store public key in the DO. -- This removes the result cache and instead stores the public key in the certificate object. This allows to properly list public keys at any time after generating a key and before a new certificate is stored there. Signed-off-by: Werner Koch <[email protected]>
* card: Support reading and writing PIV certificatesWerner Koch2019-02-071-8/+191
| | | | | | | | | | | | * scd/app-piv.c (add_tlv): New. (put_data): New. (do_writecert): New. (do_setattr): Remove usused special mode 0. * tools/gpg-card-tool.c (cmd_writecert): Allow other cards than OPENPGP. (cmd_readcert): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: Add genkey command to app-piv (rsa-only)Werner Koch2019-02-061-7/+355
| | | | | | | | | | | | | | | | | | * scd/app-piv.c (struct genkey_result_s): new. (struct app_local_s): add member genkey_results. (do_deinit): Free that one. (flush_cached_data): Extend to delete all items. (keyref_from_dobj): New. (do_readkey): New. (do_auth): Use keyref_from_dobj. (does_key_exist): New. (genkey_parse_rsa): New. (do_genkey): New. -- We need to extend the GENKEY in command.c to support other algos. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement PIN changing and unblocking for PIV cards.Werner Koch2019-02-061-66/+201
| | | | | | | * scd/app-piv.c: Some refactoring (do_change_chv): Implement. Signed-off-by: Werner Koch <[email protected]>
* scd: Add DES authentication for PIV card.Werner Koch2019-01-311-7/+248
| | | | | | | | | | | * scd/app-piv.c (flush_cached_data): New. (auth_adm_key): New. (set_adm_key): New. (do_setattr): New. * scd/command.c (MAXLEN_SETATTRDATA): New. (cmd_setattr): Add an inquire option. Signed-off-by: Werner Koch <[email protected]>
* card: Support factory reset for Yubikey PIV application.Werner Koch2019-01-291-1/+19
| | | | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add field cardtype. * scd/app.c (app_new_register): Set cardtype for yubikey. (app_getattr): Add CARDTYPE. (app_write_learn_status): Emit new attribute. * scd/app-piv.c (do_getattr): Add CHV-USAGE. (do_learn_status): Emit it. * tools/card-tool.h (struct card_info_s): Add field cardtype. * tools/card-call-scd.c (learn_status_cb): Parse "CARDTYPE". * tools/gpg-card-tool.c (list_piv): Print PIN usage policy. (list_card): Print card type. (cmd_factoryreset): Implement for Yubikey with PIV. Signed-off-by: Werner Koch <[email protected]>
* card: Print keyinfo for PIV cards.Werner Koch2019-01-291-1/+4
| | | | | | | | | | * scd/app-piv.c (do_learn_status): Print CHV-STATUS. * tools/card-tool.h (struct card_info_s): Rename chvretry to chvinfo. * tools/card-call-scd.c (learn_status_cb): Depend CHV-STATUS on app type. * tools/gpg-card-tool.c (list_piv): New. Signed-off-by: Werner Koch <[email protected]>
* scd: Support CHV-STATUS and CHECKPIN for PIV.Werner Koch2019-01-211-25/+212
| | | | | | | | | | | | * scd/app-piv.c (parse_pin_keyref): New. (get_chv_status): New. (do_getattr): Add name CHV-STATUS. (verify_pin): Add arg keyref to support other PINs. (do_change_pin): New. Right now limited to --clear. (do_check_pin): New. (app_select_piv): Register new commands. Signed-off-by: Werner Koch <[email protected]>
* scd: Add very basic support for PIV cards.Werner Koch2019-01-201-0/+1238
* scd/app-piv.c: New. * scd/Makefile.am (card_apps): Add app-piv.c * scd/app.c (app_new_register): Try to get a Yubikey serial number. Detect the PIV application. (get_supported_applications): Add "piv". -- Right now this allows the use of the authentication key (9A) for SSH authentication. More support will follow soon. Tested with Yubikey-5.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-21 11:31:00 +0000