aboutsummaryrefslogtreecommitdiffstats
path: root/scd/app-piv.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* scd:piv: Fix RSA decryption.Werner Koch2019-04-041-6/+25
| | | | | | | * scd/app-piv.c (do_decipher): Fixup leading zero byte. -- Signed-off-by: Werner Koch <[email protected]>
* scd: New options --info and --info-only for READKEY.Werner Koch2019-04-031-5/+31
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_readkey): New options --info and --info-only. * scd/app.c (app_readkey): New arg 'flags'. * scd/app-common.h (APP_READKEY_FLAG_INFO): New. (struct app_ctx_s): New args 'ctrl' and 'flags' for member readkey. Change all implementers. * scd/app-nks.c (do_readkey): Stub implementation of APP_READKEY_FLAG_INFO. * scd/app-openpgp.c (do_readkey): Implement APP_READKEY_FLAG_INFO. * scd/app-piv.c (do_readkey): Ditto. -- This feature allows to quickly get the keygrip and in most cases also the usage flags for one specific keyref. Example: <- readkey --info-only PIV.9D -> S KEYPAIRINFO FC6061FB457224370B85C6F34DD56CD29E669620 PIV.9D e -> OK Signed-off-by: Werner Koch <[email protected]>
* scd: New standard attributes $ENCRKEYID and $SIGNKEYID.Werner Koch2019-04-031-1/+13
| | | | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_keypairinfo): Use --keypairinfo. * sm/call-agent.c (gpgsm_agent_scd_keypairinfo): Ditto. * scd/app-openpgp.c (do_getattr): Add attributes "$ENCRKEYID" and "$SIGNKEYID". * scd/app-piv.c (do_getattr): Ditto. -- We already have $AUTHKEYID to locate the keyref of the key to be used with ssh. It will also be useful to have default keyref for encryption and signing. For example, this will allow us to repalce the use of "OPENPGP.2" by a app type specific keyref. Signed-off-by: Werner Koch <[email protected]>
* doc: Add a spec comment to app-piv.cWerner Koch2019-03-221-0/+1
| | | | --
* scd: Rename a shared info field name.Werner Koch2019-03-051-1/+1
| | | | | | | | * scd/app-piv.c (app_select_piv): * scd/app-common.h (struct app_ctx_s): Rename 'card_version' to 'cardversion'. Rename all users. Add 'appversion'. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement import of private keys for Yubikeys.Werner Koch2019-03-051-13/+429
| | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (concat_tlv_list): Add arg 'secure' and adjust callers. (writekey_rsa, writekey_ecc): New. (do_writekey): New. (do_writecert): Provide a better error message for an empty cert. (app_select_piv): Register do_writekey. * scd/iso7816.c (iso7816_send_apdu): New. * scd/app-common.h (APP_WRITEKEY_FLAG_FORCE): New. * agent/command.c (cmd_keytocard): Make the timestamp optional. * tools/card-call-scd.c (inq_writekey_parms): Remove. (scd_writekey): Rewrite. * tools/gpg-card.c (cmd_writekey): New. (enum cmdids): Add cmdWRITEKEY. (dispatch_command, interactive_loop): Call cmd_writekey. -- This has been tested with gpgsm and RSA keys. For ECC keys only partly tested using the sample OpenPGP nistp256 and nistp384 keys because gpgsm does not yet support ECC certificates and thus we can't write the certificates to the cert object after a writekey. Note that they nevertheless show up in "gpgcard list" because gpg-card searches for them in gpg and gpgsm. However, this does not work completely. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Add feature to read Yubikey attestation certificates.Werner Koch2019-03-011-2/+28
| | | | | | | | | | | * scd/app-piv.c (do_readcert): Add hack to read Yubikey attestaions. -- Use gpg-card 'readcert PIV.ATST.9A >x.crt' to store the attestation certificate for 9A into X.CRT. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Allow writecert to only write matching certs.Werner Koch2019-03-011-22/+55
| | | | | | | | | * scd/app-piv.c (do_readkey): Read the key from the cert here instead of letting the upper layer do this. (do_writecert): Check that the cert matches the key and that a key has already been generated. Signed-off-by: Werner Koch <[email protected]>
* scd: Simplify the app_readkey parameters.Werner Koch2019-02-261-15/+2
| | | | | | | | | | | | | | * scd/app-help.c (app_help_pubkey_from_cert): New. * scd/command.c (cmd_readkey): Refactor to use that new function and handle the --advanced flag only here. * scd/app.c (app_readkey): Remove parm advanced. * scd/app-common.h (struct app_ctx_s): Remove parm advanced from the readkey member. * scd/app-nks.c (do_readkey): Adjust for removed parm. * scd/app-piv.c (do_readkey): Ditto. * scd/app-openpgp.c (do_readkey): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: PIV: Always require a PIN for signing with 9C.Werner Koch2019-02-251-8/+20
| | | | | | | * scd/app-piv.c (verify_chv): Add arg 'force'. (do_sign): Use force for 0x9c. Signed-off-by: Werner Koch <[email protected]>
* scd: Extend KEYPAIRINFO by key usage info.Werner Koch2019-02-211-45/+84
| | | | | | | | | | * scd/app-openpgp.c (send_keypair_info): Append usage string. * scd/app-piv.c (struct data_object_s): Remove column 'binary'. Add column 'usage'. (dump_all_do): Adjust for removed 'binary'. (send_keypair_and_cert_info): Append usage string. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement decryption for PIV cards.Werner Koch2019-02-111-1/+146
| | | | | | | | | | * scd/app-piv.c (do_decipher): New. -- Note that ECDH decryption has not been tested due to the lack of ECC support in gpgsm. Signed-off-by: Werner Koch <[email protected]>
* scd: For PIV cards used NO_AUTH instead of BAD_PIN.Werner Koch2019-02-111-1/+14
| | | | | | | | | * common/util.h (GPG_ERR_NO_AUTH, GPG_ERR_BAD_AUTH): Add replacement codes for gpgrt < 1.36. * scd/app-piv.c (auth_adm_key): (do_genkey, do_writecert): Use better error codes. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement RSA signing for PIV cards.Werner Koch2019-02-081-99/+299
| | | | | | | | | * scd/app-piv.c (concat_tlv_list): New. (get_key_algorithm_by_dobj): Rename args for clarity. (do_auth): factor all code out to ... (do_sign): new. Implement RSA signing. Signed-off-by: Werner Koch <[email protected]>
* scd: Allow generating ECC curves on PIV cards.Werner Koch2019-02-081-0/+53
| | | | | | | | | * scd/app-piv.c (genkey_parse_ecc): New. (get_keygrip_by_tag): Call that one. (do_readkey): Call that one. * scd/command.c (cmd_genkey): Add option --algo. Signed-off-by: Werner Koch <[email protected]>
* scd: Store a new PIV public key in the certificate DO.Werner Koch2019-02-071-106/+179
| | | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (struct genkey_result_s): Remove type and all users. (send_keypair_and_cert_info): Print certinfo only if we got a cert.. (readcert_by_tag): Add arg r_mechanism and implement reading of public keys. (get_keygrip_by_tag): Use a public key to compute the keygrip. (do_readcert): Make sure to only return a certificate. (do_readkey): Read public key from the DO if a certificate is missing. (get_key_algorithm_by_dobj): Get the algorithm also from a public key. (does_key_exist): String changes. (do_genkey): Remove result caching and store public key in the DO. -- This removes the result cache and instead stores the public key in the certificate object. This allows to properly list public keys at any time after generating a key and before a new certificate is stored there. Signed-off-by: Werner Koch <[email protected]>
* card: Support reading and writing PIV certificatesWerner Koch2019-02-071-8/+191
| | | | | | | | | | | | * scd/app-piv.c (add_tlv): New. (put_data): New. (do_writecert): New. (do_setattr): Remove usused special mode 0. * tools/gpg-card-tool.c (cmd_writecert): Allow other cards than OPENPGP. (cmd_readcert): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: Add genkey command to app-piv (rsa-only)Werner Koch2019-02-061-7/+355
| | | | | | | | | | | | | | | | | | * scd/app-piv.c (struct genkey_result_s): new. (struct app_local_s): add member genkey_results. (do_deinit): Free that one. (flush_cached_data): Extend to delete all items. (keyref_from_dobj): New. (do_readkey): New. (do_auth): Use keyref_from_dobj. (does_key_exist): New. (genkey_parse_rsa): New. (do_genkey): New. -- We need to extend the GENKEY in command.c to support other algos. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement PIN changing and unblocking for PIV cards.Werner Koch2019-02-061-66/+201
| | | | | | | * scd/app-piv.c: Some refactoring (do_change_chv): Implement. Signed-off-by: Werner Koch <[email protected]>
* scd: Add DES authentication for PIV card.Werner Koch2019-01-311-7/+248
| | | | | | | | | | | * scd/app-piv.c (flush_cached_data): New. (auth_adm_key): New. (set_adm_key): New. (do_setattr): New. * scd/command.c (MAXLEN_SETATTRDATA): New. (cmd_setattr): Add an inquire option. Signed-off-by: Werner Koch <[email protected]>
* card: Support factory reset for Yubikey PIV application.Werner Koch2019-01-291-1/+19
| | | | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add field cardtype. * scd/app.c (app_new_register): Set cardtype for yubikey. (app_getattr): Add CARDTYPE. (app_write_learn_status): Emit new attribute. * scd/app-piv.c (do_getattr): Add CHV-USAGE. (do_learn_status): Emit it. * tools/card-tool.h (struct card_info_s): Add field cardtype. * tools/card-call-scd.c (learn_status_cb): Parse "CARDTYPE". * tools/gpg-card-tool.c (list_piv): Print PIN usage policy. (list_card): Print card type. (cmd_factoryreset): Implement for Yubikey with PIV. Signed-off-by: Werner Koch <[email protected]>
* card: Print keyinfo for PIV cards.Werner Koch2019-01-291-1/+4
| | | | | | | | | | * scd/app-piv.c (do_learn_status): Print CHV-STATUS. * tools/card-tool.h (struct card_info_s): Rename chvretry to chvinfo. * tools/card-call-scd.c (learn_status_cb): Depend CHV-STATUS on app type. * tools/gpg-card-tool.c (list_piv): New. Signed-off-by: Werner Koch <[email protected]>
* scd: Support CHV-STATUS and CHECKPIN for PIV.Werner Koch2019-01-211-25/+212
| | | | | | | | | | | | * scd/app-piv.c (parse_pin_keyref): New. (get_chv_status): New. (do_getattr): Add name CHV-STATUS. (verify_pin): Add arg keyref to support other PINs. (do_change_pin): New. Right now limited to --clear. (do_check_pin): New. (app_select_piv): Register new commands. Signed-off-by: Werner Koch <[email protected]>
* scd: Add very basic support for PIV cards.Werner Koch2019-01-201-0/+1238
* scd/app-piv.c: New. * scd/Makefile.am (card_apps): Add app-piv.c * scd/app.c (app_new_register): Try to get a Yubikey serial number. Detect the PIV application. (get_supported_applications): Add "piv". -- Right now this allows the use of the authentication key (9A) for SSH authentication. More support will follow soon. Tested with Yubikey-5.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 22:17:57 +0000