aboutsummaryrefslogtreecommitdiffstats
path: root/scd (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-03-18scd:p15: Allow to use an auth object label with cmd CHECKPIN.Werner Koch2-21/+46
* scd/app-p15.c (prepare_verify_pin): Allow for PRKDF to be NULL. (make_pin_prompt): Ditto. (verify_pin): Ditto. (do_check_pin): Allow using the Label to specify a PIN. -- Note that a label may not work in all cases because we can't select the protected object's EF first. Signed-off-by: Werner Koch <[email protected]>
2021-03-18scd:p15: New attribute CHV-LABEL.Werner Koch1-18/+41
* scd/app-p15.c (parse_common_obj_attr): Map spaces in the lapel to underscores. (read_ef_aodf): Prettify printing of the type. (do_getattr): New attribute CHV-LABEL (do_learn_status): Emit CHV-LABEL. (verify_pin): Distinguish the PIN prompts. Signed-off-by: Werner Koch <[email protected]>
2021-03-16scd:p15: Implement CHV-STATUS attributeWerner Koch3-8/+119
* scd/command.c (send_status_direct): Return an error. * scd/app-p15.c (do_learn_status): Emit CHV-STATUS. (compare_aodf_objid): New. (do_getattr): Implement CHV-STATUS.
2021-03-15scd: Add handling of Ed448 key.NIIBE Yutaka1-13/+12
* scd/app-openpgp.c (struct app_local_s): Add ecc.algo field. (send_key_attr): Use ecc.algo field. (ecc_read_pubkey): Use ecc.algo field. (ecc_writekey): Ed448 means EdDSA. (parse_algorithm_attribute): Set ecc.algo field from card. Add checking for Ed25519 for ECC_FLAG_DJB_TWEAK flag. -- There used to be a possible support of Ed25519 with ECDSA, (instead of EdDSA). To distinguish key for Ed25519 for EdDSA, we use the flag: (flags eddsa). Ed448 has no support for ECDSA and defaults to EdDSA even if no such flag. Signed-off-by: NIIBE Yutaka <[email protected]>
2021-03-15scd: Fix count_sos_bits handling.NIIBE Yutaka1-3/+3
* scd/app-openpgp.c (count_sos_bits): Handle an exceptional case. Signed-off-by: NIIBE Yutaka <[email protected]>
2021-03-12scd: New option --pcsc-shared.Werner Koch5-4/+17
* scd/scdaemon.h (opt): Add field opcsc_shared. * scd/scdaemon.c (opcscShared): New. (opts): Add "--pcsc-shared". (main): Set flag. * scd/apdu.c (connect_pcsc_card): Use it. (pcsc_get_status): Take flag in account. * scd/app-openpgp.c (cache_pin): Bypass in shared mode. (verify_chv2: Do not auto verify chv1 in shared mode. * scd/app-piv.c (cache_pin): By pass caceh in shared mode. -- This option should in general not be used. The patch tries to limit bad effects but using shared mode is somewhat dangerous depending on the other PC/SC users.
2021-03-12scd: Fix computing fingerprint for ECC with SOS.NIIBE Yutaka1-1/+22
* scd/app-openpgp.c (count_sos_bits): New. Count as sos_write does. (store_fpr): For ECC, use count_sos_bits. -- Signed-off-by: NIIBE Yutaka <[email protected]>
2021-03-11scd:piv: Improve APT parser compatibility.Valtteri Vuorikoski1-4/+9
* scd/app-piv.c (app_select_piv): Allow for full AID. -- It appears that SP-800-73-x is not too clear about the format of these objects. Many current cards (such as the Yubikey 5 series) apparently have only the PIX in DO 0x4F and only the RID in object 0x79/0x4F. However, other cards as well as the PivApplet Javacard applet have the full AID in 0x4F (which actually seems closer to what the standard says). PivApplet also has the full AID in 0x79/0x4F, but this is probably incorrect. (Here is a long discussion of the matter from an OpenSC author: https://github.com/arekinath/PivApplet/issues/43#issuecomment-772649709) [Taken from a mail to gnupg-devel date 2021-02-03.] Signed-off-by: Werner Koch <[email protected]>
2021-03-10scd:p15: Fix faulty removal of a test code change.Werner Koch1-1/+1
-- Fixes-commit: 08b5ac492afc6c6e7eaaa1f70d67c81cbda2c9be
2021-03-10scd:p15: Support special extended usage flags for OpenPGP keys.Werner Koch1-6/+93
* scd/app-p15.c (struct gpgusage_flags_s): New. (struct prkdf_object_s): Add field gpgusage. (struct app_local_s): Add field any_gpgusage. (dump_gpgusage_flags): New. (read_p15_info): Parse athe gpgusage flags. (do_getattr): Take care of the gpgusage flags. -- This features allows to mark keys to be used for OpenPGP. This is done by putting additional extended key infos into the certificate stored on the cards. Only if any such extended key usage is detected for a stored certificate this new mode chimes in. This feature gives the card issuer a high flexibility on how to make sure certain keys are used with OpenPGP.
2021-03-09scd: Swapped openpgp card vendor 0x000a with new 0x000d.Werner Koch1-1/+2
--
2021-03-09scd: Add new Openpgp card vendor nameWerner Koch1-0/+1
--
2021-03-08scd: Fix for X448.NIIBE Yutaka1-0/+2
* scd/app-openpgp.c (do_decipher): Support with no prefix. Signed-off-by: NIIBE Yutaka <[email protected]>
2021-02-25scd:p15: Read out the access flags.Werner Koch1-68/+141
* scd/app-p15.c (struct keyaccess_flags_s): New. (struct prkdf_object_s): Add field accessflags. (dump_keyusage_flags): New. (dump_keyaccess_flags): New. (parse_keyaccess_flags): New. (parse_common_key_attr): Return access flags. (read_ef_prkdf): Parse the access flags. Allow for ECkeys. (read_ef_pukdf): Ditto. Use new functions for printing. (read_p15_info): Use new fucntion for printing.
2021-02-24scd:p15: Get the label value of all objects for better diagnostics.Werner Koch1-78/+180
* scd/app-p15.c (struct cdf_object_s): Add fields authid, authidlen, and label. (struct prkdf_object_s): Add field label. (struct aodf_object_s): Ditto. (release_cdflist): Free new fields. (release_prkdflist): Free new field. (release_aodf_object): Ditto. (parse_common_obj_attr): Return the label. (read_ef_prkdf): Store the label. (read_ef_pukdf): Ditto. (read_ef_cdf): Use parse_common_obj_attr and store authid and label. Print them im verbose mode. (read_ef_aodf): Store the label and print it.
2021-02-23scd:p15: Make it code work again for D-Trust cards.Werner Koch4-29/+67
* scd/app-p15.c (select_and_read_binary): Allow to skip the select. (select_and_read_record): Return the statusword. Silence error message for SW_FILE_STRUCT. (select_ef_by_path): Fix selection with a home_DF. (read_first_record): Fallback to read_binary for CardOS and return info about this. (read_ef_prkdf): Use info from read_first_record to decide whether to use record or binary mode. (read_ef_pukdf): Ditto. (read_ef_aodf): Ditto. (read_ef_cdf): Ditto. New arg cdftype for diagnostics. (read_p15_info): Pass cdftype. * scd/apdu.h (SW_FILE_STRUCT): New. * scd/apdu.c (apdu_strerror): Map that one to a string. * scd/iso7816.c (map_sw): and to a gpg-error.
2021-02-22scd: Fix readkey --info in case a readkey command is available.Werner Koch2-41/+35
* scd/command.c (do_readkey): Make --info also work if a readkey command is available. * scd/app-p15.c (cdf_object_from_certid): Fix a but introduced with the previous commit.
2021-02-22scd:p15: Extract extended usage flagsand act upon them.Werner Koch2-82/+239
* scd/app-p15.c: Add a couple of oid constants. (struct cdf_object_s): Replace fields image and imagelen by cert. (struct prkdf_object_s): Add extusage flags (send_keypairinfo): Use them. (cdf_object_from_certid): Factor parts out to ... (cdf_object_from_objid): new function. (read_ef_prkdf): Move info printing to ... (read_p15_info): here. Fill the extusage flags. (readcert_by_cdf): Cache the ksba cert object instead of the binary cert. * scd/app.c (select_additional_application): Fix a log_debug call. (scd_update_reader_status_file): Ditto. -- This allows us to return only KEYPAIRINFO lines for keys we can actually use.
2021-02-19scd: Minor tweak for easier backportingWerner Koch3-23/+30
* scd/app-common.h (APP_CARD): New. Use it in app-*.c to access app->card. -- This should help to make backporting to 2.2 easier.
2021-02-18scd:piv: Fix a typo in a string.Werner Koch1-2/+2
--
2021-02-02scd:p15: Read PuKDF and minor refactoring.Werner Koch1-85/+447
* scd/app-p15.c (pukdf_object_t): New. (struct app_local_s): Add field public_key_info. (release_pukdflist): New. (select_and_read_record): No diagnostic in case of not_found. (read_first_record): New. Factored out from the read_ef_ fucntions. (read_ef_pukdf): New. Basically a copy of read_ef_prkdf for now. (read_p15_info): Also read the public keys. (cardtype2str): New. (read_ef_tokeninfo): Print a string with the cardtype.
2021-01-27scd:p15: Make file selection more robust.Werner Koch1-37/+60
* scd/app-p15.c: Include host2net.h. (DEFAULT_HOME_DF): New. (select_and_read_binary): Replace slot by app. Change callers. Use select_ef_by_path. (select_and_read_record): ditto. (select_ef_by_path): Make use use the home_df. (parse_certid): Adjust for always set home_df. (print_tokeninfo_tokenflags): Ditto. (app_select_p15): Take the home_df from the FCI returned by select. -- This uses modern APDUs and always selectd starting at the PCKS-15 home DF. We could have made this much simpler but the goal is to keep support for older cards although we can't test that easily. Signed-off-by: Werner Koch <[email protected]>
2021-01-27scd: Define new status wordWerner Koch4-9/+17
* scd/apdu.h (SW_NO_CURRENT_EF): New. -- This merely to show better diagnostics. Used for example by CardOS 5.3.
2021-01-27scd:p15: Factor the commonKeyAttributes parser out.Werner Koch1-134/+206
* scd/app-p15.c (read_ef_prkdf): Fix detection of unsupported key objects. Factor some code out to ... (parse_common_key_attr): new. --
2021-01-26scd:p15: Factor the commonObjectAttributes parser out.Werner Koch1-139/+112
* scd/app-p15.c (parse_common_obj_attr): New. (read_ef_prkdf): Use new function. (read_ef_aodf): Ditto.
2021-01-26scd:p15: First step towards real CardOS 5 support.Werner Koch4-76/+218
* scd/iso7816.c (iso7816_select_path): Add arg from_cdf. * scd/app-nks.c (do_readkey): Adjust for this change. * scd/app-p15.c (CARD_TYPE_CARDOS_53): New. (IS_CARDOS_5): New. (card_atr_list): Add standard ATR for CardOS 5.3. (select_and_read_binary): Remove the fallback to record read hack. (select_and_read_record): New. (select_ef_by_path): Rework and support CardOS feature. (read_ef_prkdf): Use read record for CardOS. (read_ef_cdf): Ditto. (read_ef_aodf): Ditto. Also fix bug in the detection of other unsupported attribute types. (verify_pin): Use IS_CARDOS_5 macro. (app_select_p15): Force direct method for CardOS. Signed-off-by: Werner Koch <[email protected]>
2021-01-21scd:p15: Show the ATR as part of the TokenInfo diagnostics.Werner Koch1-0/+12
* scd/app-p15.c (read_ef_tokeninfo): Print the ATR in verbose mode. -- It is convenient to see the ATR close to the other info, Signed-off-by: Werner Koch <[email protected]>
2021-01-06scd:nks: Add support for signing plain SHA-3 digests.Ingo Klöcker1-17/+67
* scd/app-nks.c (do_sign): Handle plain SHA-3 digests and verify encoding of ASN.1 encoded hashes. -- This makes it possible to create CSRs for NetKey card keys which are signed with SHA256 by default. GnuPG-bug-id: 5184
2020-12-11scd:nks: Support READKEY with keygrip and for "NKS-IDLM" keyref.NIIBE Yutaka1-0/+22
* scd/app-nks.c (do_readkey): Allow KEYGRIP access. Support NKS-IDLM.XXXX keyref. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-11scd:nks: Factor out pubkey retrieval from keygrip handling.NIIBE Yutaka1-84/+72
* scd/app-nks.c (pubkey_from_pk_file): New. (keygripstr_from_pk_file): Use pubkey_from_pk_file. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-10scd:nks: Add support of KEYGRIP for do_readcert.NIIBE Yutaka1-0/+18
* scd/app-nks.c (do_readcert): Support KEYGRIP. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-10scd:nks: Factor out iteration over filelist.NIIBE Yutaka1-78/+114
* scd/app-nks.c (iterate_over_filelist): New. (do_with_keygrip): Use iterate_over_filelist. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-09scd:ccid:spr532: Extend abort_cmd for initialization time.NIIBE Yutaka1-11/+18
* scd/ccid-driver.c (abort_cmd): Add INIT argument to support synchronize until success, even ignoring timeout. (bulk_in): Normal use case of abort_cmd. (ccid_vendor_specific_init): Initial use case of abort_cmd. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-09scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.NIIBE Yutaka1-0/+1
* scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532, call libusb_clear_halt. -- GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-09scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.NIIBE Yutaka1-1/+0
* scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt. -- GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-08scd:yubikey: Fix support of Yubikey NEO.NIIBE Yutaka1-0/+3
* scd/app-openpgp.c (get_public_key): Yubikey NEO also has this issue. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-03scd:nks: Fix caching keygrip (more).NIIBE Yutaka1-5/+7
* scd/app-nks.c (keygripstr_from_pk_file): Distinguish by APP_ID. -- GnuPG-bug-id: 5150, 5161 Fixes-commit: 920154370834ad8d947aed19c9d914a27dde6baa Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-03scd: Fix KEYINFO command with --data option.NIIBE Yutaka1-4/+3
* scd/command.c (cmd_keyinfo): Handle --data option correctly. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-03scd:openpgp: Fix writing ECC key to card.NIIBE Yutaka1-6/+27
* scd/app-openpgp.c (build_privkey_template): Adding another argument of ecc_d_fixed_len to handle variable-size MPI. -- GnuPG-bug-id: 5163 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-30scd:nks: Minor additions to the basic IDLM application support.Werner Koch1-15/+25
* scd/app-nks.c (filelist): Use special value -1 for IDLM pubkeys. (keygripstr_from_pk_file): Handle special value. (do_readcert): Ditto. (do_writecert): Ditto. -- This allows to get information about the keys from the card. However the do_readkey still requires a fallback to readcert. This does not work because there are no certificates yet on the card. The fix is to fully implement do_readkey.
2020-11-27scd: New getinfo sub-command apdu_strerror.Werner Koch2-15/+28
* scd/apdu.c (apdu_strerror): Add missing status codes. * scd/command.c (cmd_getinfo): New sub-command apdu_strerror. -- This is quite handy for gpg-card's APDU command and avoids that we need to duplicate the mapping table or put it into a shared file.
2020-11-27scd:ccid-driver: Fix pinpad error handling for cancel/timeout.NIIBE Yutaka4-2/+17
* scd/apdu.h (SW_HOST_UI_CANCELLED, SW_HOST_UI_TIMEOUT): New. * scd/ccid-driver.h (CCID_DRIVER_ERR_UI_CANCELLED): New. (CCID_DRIVER_ERR_UI_TIMEOUT): New. * scd/ccid-driver.c (bulk_in): Handle PIN input cancel/timeout error. * scd/iso7816.c (map_sw): Support SW_HOST_UI_CANCELLED and SW_HOST_UI_TIMEOUT. -- GnuPG-bug-id: 4614 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-26agent: Fix YK s/n and prettify the request card prompt for YubikeysWerner Koch2-34/+20
* agent/divert-scd.c (ask_for_card): Detect and re-format the Yubikey prompt. * scd/app.c (app_munge_serialno): Fix Yubikey s/n munging. (card_get_dispserialno): Ditto. * scd/app-openpgp.c (get_disp_serialno): Remove. (get_prompt_info): Use app_get_dispserialno.-- --
2020-11-26scd: Do not try to use a non-enabled app after card switching.Werner Koch1-2/+19
* scd/app.c (app_dump_state): Also print the refcount. (maybe_switch_app): Make sure the app exists on the card. -- When switching the current card and the card does not support the same apps as the former, we now reset the app to the first one. Testcase is to use a standard OpenPGP card and a P15 card. Signed-off-by: Werner Koch <[email protected]>
2020-11-26scd: Add special serialno compare for OpenPGP cards.Werner Koch2-10/+44
* scd/app.c (is_same_serialno): New. (check_application_conflict): Use this. (select_application): Ditto. (app_switch_current_card): Ditto. * scd/app-openpgp.c (check_keyidstr): Ignore the card version and also compare case insensitive. -- This is required because we change what we emit as serialno of OpenPGP cards but existing keys still use the old form of the serial number (i.e. with a firmware version). See-commit: 3a8250c02031080c6c8eebd5dea03f5f87f9ddd7 Signed-off-by: Werner Koch <[email protected]>
2020-11-26scd,nks: Fix caching keygrip.NIIBE Yutaka1-3/+4
* scd/app-nks.c (keygripstr_from_pk_file): Identify by cfid if available. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-25scd:p15: Print the internal card type.Werner Koch1-0/+8
* scd/app-p15.c (read_ef_tokeninfo): Print the internal card type.
2020-11-25scd:p15: Improve support for some CardOS based cards.Werner Koch3-14/+68
* scd/iso7816.c (iso7816_read_binary_ext): Add optional arg r_sw and change callers. (iso7816_read_record): Factor all code out to ... (iso7816_read_record_ext): new. * scd/app-p15.c (select_and_read_binary): Fallback to record reading. (read_ef_aodf): Clear EOF error.
2020-11-25scd: Rework the handling of the displayed serial number.Werner Koch5-119/+178
* scd/app.c (app_new_register): Call app_munge_serialno for Yubikeys. (app_munge_serialno): Handle Yubikey serial numbers. (card_get_serialno): Remove special Yubikey treatment. Drop arg is_canonical. (app_get_serialno): Clear ERRNO on error. (card_get_dispserialno): New. Also change formatting of Yubikey and OpenPGP numbers to match those printed on the card. (app_get_dispserialno): New. * scd/app-openpgp.c (do_getattr): Use app_get_dispserialno. (yubikey_get_serialno): Remove. * scd/app-piv.c (get_dispserialno): Remove. (do_getattr): Use app_get_dispserialno. -- This patch gets us back to a unique serial number for cards and provides a stable serial number as printed for Yubikeys. Because we use a slightly different serial number now for Yubikeys and cards only supporting OpenPGP card we need to come up with another change so that the version number of OpenPGP serial numbers are ignored when comparing card serial numbers. This is so that existing stub keys of gpg-agent will continue to work. GnuPG-bug-id: 5100 Signed-off-by: Werner Koch <[email protected]>
2020-11-25scd: Fix an error return for READKEY.NIIBE Yutaka1-0/+3
* scd/command.c (cmd_readkey): Return when error. -- GnuPG-bug-id: 5150 Suggested-by: Ingo Klöcker Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-11 07:08:08 +0000