aboutsummaryrefslogtreecommitdiffstats
path: root/scd (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* scd: Shorten cardio debug output for all zeroes.Werner Koch2020-06-291-4/+33
| | | | | | | * scd/apdu.c (all_zero_p): New. (send_le): Use it. Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Fix remaining tries warning in --reset mode.Werner Koch2020-06-251-9/+10
| | | | | | * scd/app-nks.c (do_change_pin): Chnage computaion of 'remaining'. Signed-off-by: Werner Koch <[email protected]>
* build: Fix recent commit for SOURCE_DATE_EPOCH.Werner Koch2020-06-081-1/+1
| | | | | | | | | | -- Fixes-commit: 074ab108e768b2f946d789c1f3a7f14a65e07c52 which was recently pushed to make use of $SOURCE_DATE_EPOCH as fallback. Also fixes two typos
* scd: Fix condition for C5 data object for newer Yubikey.NIIBE Yutaka2020-05-291-1/+1
| | | | | | | * scd/app-openpgp.c (compare_fingerprint): Relax the condition. GnuPG-bug-id: 4957 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: New KEY-STATUS attribute.Werner Koch2020-05-271-1/+10
| | | | * scd/app-openpgp.c (do_getattr): Return KEY-STATUS
* scd:openpgp: Add attribute "UIF" for convenience.Werner Koch2020-05-261-5/+11
| | | | | | | | | | | | * scd/app-openpgp.c (do_getattr): New attrubute "UIF". (do_learn_status): Use that. -- Actually this is not just convenience but will make it easier to add new keys to an openpgp card - we will need to change this only at one place. Signed-off-by: Werner Koch <[email protected]>
* scd: Fix Yubikey app switching problemWerner Koch2020-05-261-4/+12
| | | | | | | | | | | | | | * scd/app.c (select_all_additional_applications_internal): Re-select first app. Add arg 'ctrl'. -- Usually keygrip based access to the Yubikey does a switching back and forth and thus keeps the card and scdaemon's internal state in sync. However, if we do only a listing scdaemon did not reselect the first application (e.g. OpenPGP) after adding other applications (e.g. PIV) and thus led to wrong info returned in a listing. Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Add framework to support IDKey cards.Werner Koch2020-05-071-51/+124
| | | | | | | | | | | | | | | * scd/app-nks.c (NKS_APP_IDLM): New. (struct app_local_s): Replace NKS_VERSION by the global APPVERSION. (do_learn_status): Always send CHV-STATUS. (find_fid_by_keyref): Basic support for IDLM only use. (do_learn_status_core): Ditto. (do_readcert): Ditto. (verify_pin): Ditto. (parse_pwidstr): Ditto. (do_with_keygrip): Ditto. (switch_application): Ditto. (app_select_nks): Fallback to IDLM. --
* scd:nks: Get the PIN prompts right for the Signature CardWerner Koch2020-05-071-56/+136
| | | | | | | | | | | | * scd/app-nks.c (get_dispserialno): Move more to the top. (do_getattr): Add $DISPSERIALNO and SERIALNO. Make CHV-STATUS work with NKS15. (verify_pin): Use dedicated min. PIN lengths. (parse_pwidstr): Support NKS15 -- GnuPG-bug-id: 4938 Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Support decryption using ECDH.Werner Koch2020-05-071-75/+307
| | | | | | | | | | | | | | | | | * scd/app-nks.c (struct fid_cache_s): Add field 'algo'. (keygripstr_from_pk_file): Add arg 'r_algo' to return the algo. (find_fid_by_keyref): Ditto. (get_dispserialno): New. (make_prompt): New. (verify_pin): Provide better prompts. (do_decipher): Support ECDH. (parse_pwidstr): Add hack tospecify any pwid.. (do_change_pin): Support Signature Card V2.0 (NKS15) style NullPIN. Provide a better prompt. -- GnuPG-bug-id: 4938 Signed-off-by: Werner Koch <[email protected]>
* scd: Extend an internal function to also return the algo.Werner Koch2020-05-058-17/+24
| | | | | | | | * scd/app-help.c (app_help_get_keygrip_string_pk): Add optional arg r_algo. Change all callers. (app_help_get_keygrip_string): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Add do_with_keygrip and implement a cache.Werner Koch2020-05-041-90/+349
| | | | | | | | | | | | * scd/app-nks.c (struct fid_cache_s): New. (struct app_local_s): Add field 'fid_cache'. (do_deinit): Release the cache. (keygripstr_from_pk_file): Implement the cache. (find_fid_by_keyref): New (do_sign, do_decipher): Use new function. (do_with_keygrip): New. Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Allow retrieving certificates from a Signature Card v.20Werner Koch2020-04-171-164/+299
| | | | | | | | | | * scd/app-nks.c: Major rework to support non-RSA cards. -- This is a fist step so support this ECC card. The code has been reworked while taking care that old cards should keep on working. Signed-off-by: Werner Koch <[email protected]>
* scd: Detect missing card in "getinfo all_active_apps".Werner Koch2020-04-171-0/+5
| | | | | | | | | * scd/app.c (send_card_and_app_list): Detect no app case. -- This is a minor nug fix to return a better error message. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Return a display S/N via Assuan.Werner Koch2020-04-091-21/+54
| | | | | | | | * scd/app-p15.c (make_pin_prompt): Factor some code out to ... (get_dispserialno): this. (do_getattr): Use new fucntion for a $DISPSERIALNO. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Show a pretty PIN prompt.Werner Koch2020-04-071-13/+197
| | | | | | | | | | | | | | | | | | | | * scd/app-p15.c (struct prkdf_object_s): New fields common_name and serial_number. (release_prkdflist): Free them. (keygrip_from_prkdf): Parse cert and set them. (any_control_or_space): New. (make_pin_prompt): New. (verify_pin): Construct a pretty PIN prompt. (do_sign): Remove debug output. -- The D-Trust card has the SerialNumber part of the Subject printed on the front matter, we assume this is also possible with other cards and thus we show this as serial number. The holder of the card is also extracted from the card's subject. Signed-off-by: Werner Koch <[email protected]>
* scd: Return GPG_ERR_BAD_PIN on 0x63Cn status word.Werner Koch2020-04-071-0/+2
| | | | | | | | | | * scd/iso7816.c (map_sw): Detect 0x63Cn status code. -- I really wonder when that got lost and we ended up with a simple card error. Signed-off-by: Werner Koch <[email protected]>
* scd: Factor common PIN status check out.Werner Koch2020-04-074-82/+57
| | | | | | | | | | | | | | * scd/iso7816.h (ISO7816_VERIFY_ERROR): New. (ISO7816_VERIFY_NO_PIN): New. (ISO7816_VERIFY_BLOCKED): New. (ISO7816_VERIFY_NULLPIN): New. (ISO7816_VERIFY_NOT_NEEDED): New. * scd/iso7816.c (iso7816_verify_status): New. * scd/app-nks.c (get_chv_status): Use new function. * scd/app-piv.c (get_chv_status): Ditto. (verify_chv): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Fix decrypt followed by sign problem for D-Trust cards.Werner Koch2020-04-073-14/+91
| | | | | | | | | | | | | | | | | * scd/iso7816.c (iso7816_select_mf): New. * scd/app-p15.c (card_product_t): New. (struct app_local_s): Add field 'card_product'. (read_ef_tokeninfo): Detect D-Trust card. (prepare_verify_pin): Switch to D-Trust AID. (do_decipher): Restore a SE for D-TRust cards. Chnage the passing indicator to 0x81. -- Using what I learned from a USB trace running the Governikus Signer Software on Windows this fixes the left over problem with the new D-Trust card support. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Emit MANUFACTURER, $ENCRKEYID, $SIGNKEYID.Werner Koch2020-04-031-18/+62
| | | | | | | | | * scd/app-p15.c (read_ef_tokeninfo): Store manufacturer_id. (do_getattr): Implement MANUFACTURER, $ENCRKEYID and $SIGNKEYID. (send_keypairinfo): Also print usage flags. -- Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: New attribute "MANUFACTURER".Werner Koch2020-04-031-0/+50
| | | | | | | | | | | | * scd/app-openpgp.c (get_manufacturer): New.. (do_getattr): Add new attribute "MANUFACTURER". (do_learn_status): Always print it. -- This will make it easy to maintain the list of OpenPGP vendors at just one place. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Implement do_with_keygrip and capabilities.Werner Koch2020-04-021-34/+48
| | | | | | | | * scd/app-p15.c (prepare_verify_pin): Allow use without an AODF. (verify_pin): Ditto. (do_with_keygrip): Implement capability restrictions. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Rename some variables and functions for clarity.Werner Koch2020-04-021-28/+28
| | | | | | * scd/app-p15.c: Rename keyinfo to prkdf. Signed-off-by: Werner Koch <[email protected]>
* scd: Use Gcrypt usage constants for the do_with_keygrip capabilities.Werner Koch2020-04-023-8/+17
| | | | | | | | | | | | * scd/command.c (cmd_keyinfo): Use Gcrypt constants for CAP. * scd/app-openpgp.c (do_with_keygrip): Adjust for them. * scd/app-piv.c (do_with_keygrip): Ditto. -- That makes it easier to read. An open question is whether we should allow several capabilities and whether they are the ORed or ANDed. Signed-off-by: Werner Koch <[email protected]>
* scd: New command DEVINFO.NIIBE Yutaka2020-04-023-62/+203
| | | | | | | | | | | | | | | * scd/app.c (notify_cond): New condition variable. (app_send_devinfo, app_wait): New. (scd_update_reader_status_file): Kick NOTIFY_COND. (initialize_module_command): Initialize NOTIFY_COND. * scd/command.c (struct server_local_s): Add watching_status. (cmd_devinfo): New. (register_commands): Add DEVINFO command. (send_client_notifications): Write status change to DEVINFO channel. * scd/scdaemon.h (app_wait, app_send_devinfo): New. GnuPG-bug-id: 4864 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:p15: Cache the PIN.Werner Koch2020-04-011-0/+8
| | | | | | | | | | | * scd/app-p15.c (struct prkdf_object_s): Add flag pin_verified. (verify_pin): Make use of it. -- Theee is still a problem with the APDUs we send: Switching between signing and decryption does work but not in the other way. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Run a keygrip_from_prkdf before verify_pinWerner Koch2020-04-011-9/+18
| | | | | | | | | | | | | * scd/app-p15.c (do_sign): Move keygrip_from_prkdf before PIN verification. (do_decipher): Add keygrip_from_prkdf. -- This is required because that function may change the current file which is set by prepare_verify_pin right before MSE. HAs alredy been done on the backport to 2.2 Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Support decryption with CardOS 5 cards.Werner Koch2020-04-011-2/+100
| | | | | | | | | | | * scd/app-p15.c (do_decipher): New. -- tested using the D-TRUSt card and a SCR3310 reader. The Kobil KAAN Advanced, I used for the signing tests could not be used because it supports only Short APDU Level exchange. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Factor PIN verification out to a new function.Werner Koch2020-04-011-192/+224
| | | | | | | | * scd/app-p15.c (do_sign): Factor code out to ... (prepare_verify_pin, verify_pin): new functions. -- Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Support signing with CardOS 5 cards.Werner Koch2020-03-318-98/+368
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-help.c (app_help_get_keygrip_string_pk): Add optional arg r_pkey and change all callers. (app_help_get_keygrip_string): Ditto. * scd/app-p15.c (struct cdf_object_s): Use bit flags (struct aodf_object_s): Ditto. Add field 'fid'. (struct prkdf_object_s): Ditto. Add fields keygrip, keyalgo, and keynbits. (parse_certid): Allow a keygrip instead of a certid aka keyref. (read_ef_aodf): Store the FID. (keygripstr_from_prkdf): Rename to ... (keygrip_from_prkdf): this. Remove arg r_gripstr and implement cache. Change callers to directly use the values from the object. Also store the algo and length of the key ion the object. (keyref_from_keyinfo): New. Factored out code. (do_sign): Support SHA-256 and >2048 bit RSA keys. (do_with_keygrip): New. (app_select_p15): Register new function. -- This has been tested with a D-Trust card featuring 3072 bit keys. Note that non-repudiation key for a qualified signature does not yet work because we do not yet support rsaPSS padding. Thus a gpgsm --learn shows a couple of Bad Signature errors for this key. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Read certificates in extended mode.Werner Koch2020-03-311-2/+4
| | | | | | | * scd/app-p15.c (readcert_by_cdf): Allow reading in extended mode. -- Signed-off-by: Werner Koch <[email protected]>
* scd: Add function for binary read in extended mode.Werner Koch2020-03-312-4/+17
| | | | | | | * scd/iso7816.c (iso7816_read_binary): Factor code out to ... (iso7816_read_binary_ext): new function. Add arg extended_mode. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Improve diagnosticsWerner Koch2020-03-311-164/+202
| | | | | | | | | | -- This removes almost all log_debug calls and uses opt.verbose and log_info to show card information. Also avoid too long and thus harder to read lines. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Detect CardOS 5 cards and print some basic infos.Werner Koch2020-03-301-15/+150
| | | | | | | | | | | | | | | | | | | | * scd/app-p15.c (read_ef_odf): Detect the home_DF on the fly. Silence the garbage warning for null bytes. (print_tokeninfo_tokenflags): New. (read_ef_tokeninfo): Print manufacturer, label, and flags. (app_select_p15): No need to use the app_get_slot macro. (CARD_TYPE_CARDOS_50): New const. (card_atr_list): Detect CardOS 5.0 -- The card under test is a "Test-Signaturkarte D-TRUST Card 3.1" for a mere 49 Euro and no specs available. D-Trust is a branch of the German Bundesdruckerei. Compare that to Telesec and Yubikey who have always been nice enough to send bunches of sample cards without a need to wade through lots of forms and not even asking for money. Guess which cards I prefer. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow PKSIGN with keygrip also for OPENPGP.3.Werner Koch2020-03-271-5/+18
| | | | | | | | | | | | | | * scd/app-openpgp.c (check_keyidstr): Add optional arg r_use_auth to test also for OpenPGP.3. (do_sign): Enable that new mode. -- This is very useful to allow gpgsm to use a certificate based on the OpenPGP card's authentication key. That key is usually used for ssh but it makes sense to use it also for user certificate based authentication. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Further simplify the gpgconf option processing.Werner Koch2020-03-141-29/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/gc-opt-flags.h (GC_OPT_FLAG_RUNTIME): Move to ... * tools/gpgconf-comp.c: here. (known_options_scdaemon): Remove "options". (known_options_dirmngr): Remove "options". (known_options_gpgsm): Remove "options". (known_options_gpg): Remove "options" and "keyserver". (struct gc_option_s): Rename active t gpgconf_list. (gc_component_list_options): Do not act upon active. (option_check_validity): Ditto. (is_known_option): Make it work correctly for unknown options. (retrieve_options_from_program): Use renamed flag gpgconf_list only to detect duplicated items from --gpgconf-list. Do not set runtime. Only e set the options if set by --gpgconf-list; never clear them. * agent/gpg-agent.c: Simplify the --gpgconf-list output. * dirmngr/dirmngr.c: Ditto. * g10/gpg.c: Ditto. * kbx/keyboxd.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * tests/openpgp/gpgconf.scm: Use "compliance" instead of "keyserver" for the string arg test. -- There is no need to read the list of options from the components unless they convey a default value. It is better to consult only the list we have in gpgconf-comp.c to decide on whether an option should be displayed. Right, this might mess up thing if a newer gpgconf version is used with an older component, but we already print warnings in this case and in general we do not want to support this anymore - the times of gpg 1.4. and 2.0 are long over now. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* scd: Re-group the options in the --help output.Werner Koch2020-03-061-12/+25
| | | | | | | | | -- This looks better and is also required for further simplifications of gpgconf. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Support reading global options (part 2).Werner Koch2020-03-061-2/+3
| | | | | | | | | | | | | | | | | | | * tools/gpgconf-comp.c: Remove all regular option descriptions. They are now read in from the component. Also remove a few meanwhile obsolete options. * agent/gpg-agent.c: Add option description which were only set in gpgconf-comp.c. * dirmngr/dirmngr.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * g10/gpg.c: Ditto. -- This second part removes all regular option descriptions because they can be read from the components. A few were missing in the components and thus moved to there. Signed-off-by: Werner Koch <[email protected]>
* scd: Fix the previous commit.NIIBE Yutaka2020-02-281-0/+3
| | | | | | * scd/app-openpgp.c (do_setattr): Flush the KDF DO just before setting. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Improve setattr for KDF.NIIBE Yutaka2020-02-281-1/+64
| | | | | | | | * scd/app-openpgp.c (do_setattr): For setting KDF DO, support standard OpenPGP card, which needs to update PIN. GnuPG-bug-id: 3891 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix pinpad handling when KDF enabled.NIIBE Yutaka2020-02-281-0/+2
| | | | | | | | | * scd/app-openpgp.c (do_getattr): Send the KDF DO information. -- Fixes-commit: 95c7498b76231d3297541172d878f6a26702539b Signed-off-by: NIIBE Yutaka <[email protected]>
* Use gpgrt's new option parser for the remaining daemons.Werner Koch2020-02-211-91/+68
| | | | | | | | | | | | | | | | | | | | * scd/scdaemon.c: Switch to the new option parser and enable a global conf file. * dirmngr/dirmngr.c: Ditto. * g13/g13.c: Ditto. * g13/g13-syshelp.c: Ditto. Do not force verbose mode. * dirmngr/dirmngr_ldap.c: Switch to the new option parser. * dirmngr/dirmngr-client.c: Switch to the new option parser. -- This finalizes the switch to the new option parser. What's left is to remove the old argparser code from common. g13-syshelp does not anymore default to --verbose because that can now be enabled in /etc/gnupg/g13-syshelp.conf. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use gpgrt's new option parser to provide a global conf file.Werner Koch2020-02-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | * common/util.h: Remove argparse.h. * common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS. * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include argparse.h. Do this also for all main modules which use our option parser except for gpg. Replace calls to strusage by calls to gpgrt_strusage everywhere. * g10/gpg.c (opts): Change type to gpgrt_opt_t. Flag oOptions and oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile. (main): Change type of pargs to gpgrt_argparse_t. Rework the option parser to make use of the new gpgrt_argparser. -- This is not yet finished but a make check works. gpg has the most complex and oldest option handling and thus this is the first migration target. SE-Linux checks and version-ed config files are missing and will be added later. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* Spelling cleanup.Daniel Kahn Gillmor2020-02-188-14/+14
| | | | | | | | | | | | | | | | No functional changes, just fixing minor spelling issues. --- Most of these were identified from the command line by running: codespell \ --ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \ --skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \ doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \ NEWS README README.maint TODO Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* scd: Disable pinpad if it's impossible by KDF DO.NIIBE Yutaka2020-02-171-7/+30
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add pinpad.disabled field. (do_getattr): Set pinpad.disabled field. (check_pinpad_request): Use the pinpad.disabled field. (do_setattr): Update pinpad.disabled field. -- GnuPG-bug-id: 4832 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Print the main app name also for not fully supported cards.Werner Koch2020-02-131-0/+9
| | | | | | | | | | | * scd/app.c (send_serialno_and_app_status): Add fallback. -- The app list was only printed for apps which support the with_keygrip function. That is not the case for the netkey and otehr cards. The new fallback prints the actual app name. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Return key creation time as part of KEYPARIINFO.Werner Koch2020-02-132-18/+11
| | | | | | | | | | | | | * scd/app-openpgp.c (send_keypair_info): Reaturn the key creation time as part of a KEYPAIRINFO. (do_readkey): Do not return the KEY-TIME anymore. -- Sending the KEY_TIME status as part of a READKEY command was only recently added. It is better to merge that into the KEYPAIRINFO line. Another patch with chnage this for the consumers of that info. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Send a KEY-TIME status with READKEYWerner Koch2020-02-112-1/+39
| | | | | | | | | | | * scd/app-openpgp.c (retrieve_fprtime_from_card): New. (do_readkey): Send a KEY_TIME status. -- It might be easier to fold this into KEYPAIRINFO but for backward compatibility using a separate status line is safer. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Optional allow for lowercase keyrefs.Werner Koch2020-02-111-10/+10
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Use case insensitive match of the keyref. (do_writekey, do_sign, do_auth, do_decipher): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow auto-changing of the key attributes in genkey.Werner Koch2020-02-112-47/+181
| | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add field keyalgo. (parse_algorithm_attribute): Store the new keyalgo field. (change_keyattr): Change info message. (change_keyattr_from_string): Rewrite to also accept a keyref and a keyalgo string. (do_genkey): Change the keyattr if a keyalgo string is given. -- Having this feature makes it easier to use OpenPGP cards in a similar way to other cards. Note that the explicit changing via SETATTR is still supported. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-14 11:17:47 +0000