aboutsummaryrefslogtreecommitdiffstats
path: root/scd (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* scd:p15: Make $SIGNKEY et al determination more fault tolerant.Werner Koch2021-03-241-16/+21
| | | | | * scd/app-p15.c (do_getattr): Change how we use gpgUsage to figure out the keys to use.
* scd:openpgp: Allow reading and writing user certs for keys 1 and 2Werner Koch2021-03-193-22/+126
| | | | | | | | | | | | | | * scd/iso7816.c (CMD_SELECT_DATA): New. (iso7816_select_data): New. * scd/app-openpgp.c (do_readcert): Allow OpenPGP.1 and OPENPGP.2 (do_writecert): Ditto. (do_setattr): Add CERT-1 and CERT-2. -- This has been tested with a Zeitcontrol 3.4 card. A test with a Yubikey 5 (firmware 5.2.6) claiming to support 3.4 failed. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Rename an internal variable.Werner Koch2021-03-191-13/+14
| | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): s/extcap_v3/is_v3/. s/max_certlen_3/max_certlen. Change users. -- The extcap_v3 flag is set if the version is 3 or later and as such does not only declare that the v3 extcap layout is used. Make this clear by renaming. Likewise for max_certlen_3. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Small speedup reading card properties.Werner Koch2021-03-191-2/+18
| | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add new flag. (get_cached_data): Force chace use if flag is set. (app_select_openpgp): Avoid reading DO 6E multiple times. -- The do not cache property of 6E was introduced so that we can change for example key attributes without getting into with the cache. However, for initial reading the cache makes a lot of sense and thus we now use this hack to only temporary cache. A better strategy would be to clear the cache when we change card data but that is more error prone. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Allow to use an auth object label with cmd CHECKPIN.Werner Koch2021-03-182-21/+46
| | | | | | | | | | | | | * scd/app-p15.c (prepare_verify_pin): Allow for PRKDF to be NULL. (make_pin_prompt): Ditto. (verify_pin): Ditto. (do_check_pin): Allow using the Label to specify a PIN. -- Note that a label may not work in all cases because we can't select the protected object's EF first. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: New attribute CHV-LABEL.Werner Koch2021-03-181-18/+41
| | | | | | | | | | | * scd/app-p15.c (parse_common_obj_attr): Map spaces in the lapel to underscores. (read_ef_aodf): Prettify printing of the type. (do_getattr): New attribute CHV-LABEL (do_learn_status): Emit CHV-LABEL. (verify_pin): Distinguish the PIN prompts. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Implement CHV-STATUS attributeWerner Koch2021-03-163-8/+119
| | | | | | | * scd/command.c (send_status_direct): Return an error. * scd/app-p15.c (do_learn_status): Emit CHV-STATUS. (compare_aodf_objid): New. (do_getattr): Implement CHV-STATUS.
* scd: Add handling of Ed448 key.NIIBE Yutaka2021-03-151-13/+12
| | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add ecc.algo field. (send_key_attr): Use ecc.algo field. (ecc_read_pubkey): Use ecc.algo field. (ecc_writekey): Ed448 means EdDSA. (parse_algorithm_attribute): Set ecc.algo field from card. Add checking for Ed25519 for ECC_FLAG_DJB_TWEAK flag. -- There used to be a possible support of Ed25519 with ECDSA, (instead of EdDSA). To distinguish key for Ed25519 for EdDSA, we use the flag: (flags eddsa). Ed448 has no support for ECDSA and defaults to EdDSA even if no such flag. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix count_sos_bits handling.NIIBE Yutaka2021-03-151-3/+3
| | | | | | * scd/app-openpgp.c (count_sos_bits): Handle an exceptional case. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: New option --pcsc-shared.Werner Koch2021-03-125-4/+17
| | | | | | | | | | | | | | | | | * scd/scdaemon.h (opt): Add field opcsc_shared. * scd/scdaemon.c (opcscShared): New. (opts): Add "--pcsc-shared". (main): Set flag. * scd/apdu.c (connect_pcsc_card): Use it. (pcsc_get_status): Take flag in account. * scd/app-openpgp.c (cache_pin): Bypass in shared mode. (verify_chv2: Do not auto verify chv1 in shared mode. * scd/app-piv.c (cache_pin): By pass caceh in shared mode. -- This option should in general not be used. The patch tries to limit bad effects but using shared mode is somewhat dangerous depending on the other PC/SC users.
* scd: Fix computing fingerprint for ECC with SOS.NIIBE Yutaka2021-03-121-1/+22
| | | | | | | | | * scd/app-openpgp.c (count_sos_bits): New. Count as sos_write does. (store_fpr): For ECC, use count_sos_bits. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:piv: Improve APT parser compatibility.Valtteri Vuorikoski2021-03-111-4/+9
| | | | | | | | | | | | | | | | | | | | * scd/app-piv.c (app_select_piv): Allow for full AID. -- It appears that SP-800-73-x is not too clear about the format of these objects. Many current cards (such as the Yubikey 5 series) apparently have only the PIX in DO 0x4F and only the RID in object 0x79/0x4F. However, other cards as well as the PivApplet Javacard applet have the full AID in 0x4F (which actually seems closer to what the standard says). PivApplet also has the full AID in 0x79/0x4F, but this is probably incorrect. (Here is a long discussion of the matter from an OpenSC author: https://github.com/arekinath/PivApplet/issues/43#issuecomment-772649709) [Taken from a mail to gnupg-devel date 2021-02-03.] Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Fix faulty removal of a test code change.Werner Koch2021-03-101-1/+1
| | | | | | -- Fixes-commit: 08b5ac492afc6c6e7eaaa1f70d67c81cbda2c9be
* scd:p15: Support special extended usage flags for OpenPGP keys.Werner Koch2021-03-101-6/+93
| | | | | | | | | | | | | | | | | | * scd/app-p15.c (struct gpgusage_flags_s): New. (struct prkdf_object_s): Add field gpgusage. (struct app_local_s): Add field any_gpgusage. (dump_gpgusage_flags): New. (read_p15_info): Parse athe gpgusage flags. (do_getattr): Take care of the gpgusage flags. -- This features allows to mark keys to be used for OpenPGP. This is done by putting additional extended key infos into the certificate stored on the cards. Only if any such extended key usage is detected for a stored certificate this new mode chimes in. This feature gives the card issuer a high flexibility on how to make sure certain keys are used with OpenPGP.
* scd: Swapped openpgp card vendor 0x000a with new 0x000d.Werner Koch2021-03-091-1/+2
| | | | --
* scd: Add new Openpgp card vendor nameWerner Koch2021-03-091-0/+1
| | | | --
* scd: Fix for X448.NIIBE Yutaka2021-03-081-0/+2
| | | | | | * scd/app-openpgp.c (do_decipher): Support with no prefix. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:p15: Read out the access flags.Werner Koch2021-02-251-68/+141
| | | | | | | | | | | | * scd/app-p15.c (struct keyaccess_flags_s): New. (struct prkdf_object_s): Add field accessflags. (dump_keyusage_flags): New. (dump_keyaccess_flags): New. (parse_keyaccess_flags): New. (parse_common_key_attr): Return access flags. (read_ef_prkdf): Parse the access flags. Allow for ECkeys. (read_ef_pukdf): Ditto. Use new functions for printing. (read_p15_info): Use new fucntion for printing.
* scd:p15: Get the label value of all objects for better diagnostics.Werner Koch2021-02-241-78/+180
| | | | | | | | | | | | | | | | * scd/app-p15.c (struct cdf_object_s): Add fields authid, authidlen, and label. (struct prkdf_object_s): Add field label. (struct aodf_object_s): Ditto. (release_cdflist): Free new fields. (release_prkdflist): Free new field. (release_aodf_object): Ditto. (parse_common_obj_attr): Return the label. (read_ef_prkdf): Store the label. (read_ef_pukdf): Ditto. (read_ef_cdf): Use parse_common_obj_attr and store authid and label. Print them im verbose mode. (read_ef_aodf): Store the label and print it.
* scd:p15: Make it code work again for D-Trust cards.Werner Koch2021-02-234-29/+67
| | | | | | | | | | | | | | | | | | | * scd/app-p15.c (select_and_read_binary): Allow to skip the select. (select_and_read_record): Return the statusword. Silence error message for SW_FILE_STRUCT. (select_ef_by_path): Fix selection with a home_DF. (read_first_record): Fallback to read_binary for CardOS and return info about this. (read_ef_prkdf): Use info from read_first_record to decide whether to use record or binary mode. (read_ef_pukdf): Ditto. (read_ef_aodf): Ditto. (read_ef_cdf): Ditto. New arg cdftype for diagnostics. (read_p15_info): Pass cdftype. * scd/apdu.h (SW_FILE_STRUCT): New. * scd/apdu.c (apdu_strerror): Map that one to a string. * scd/iso7816.c (map_sw): and to a gpg-error.
* scd: Fix readkey --info in case a readkey command is available.Werner Koch2021-02-222-41/+35
| | | | | | | | * scd/command.c (do_readkey): Make --info also work if a readkey command is available. * scd/app-p15.c (cdf_object_from_certid): Fix a but introduced with the previous commit.
* scd:p15: Extract extended usage flagsand act upon them.Werner Koch2021-02-222-82/+239
| | | | | | | | | | | | | | | | | | | * scd/app-p15.c: Add a couple of oid constants. (struct cdf_object_s): Replace fields image and imagelen by cert. (struct prkdf_object_s): Add extusage flags (send_keypairinfo): Use them. (cdf_object_from_certid): Factor parts out to ... (cdf_object_from_objid): new function. (read_ef_prkdf): Move info printing to ... (read_p15_info): here. Fill the extusage flags. (readcert_by_cdf): Cache the ksba cert object instead of the binary cert. * scd/app.c (select_additional_application): Fix a log_debug call. (scd_update_reader_status_file): Ditto. -- This allows us to return only KEYPAIRINFO lines for keys we can actually use.
* scd: Minor tweak for easier backportingWerner Koch2021-02-193-23/+30
| | | | | | | | * scd/app-common.h (APP_CARD): New. Use it in app-*.c to access app->card. -- This should help to make backporting to 2.2 easier.
* scd:piv: Fix a typo in a string.Werner Koch2021-02-181-2/+2
| | | | --
* scd:p15: Read PuKDF and minor refactoring.Werner Koch2021-02-021-85/+447
| | | | | | | | | | | | | * scd/app-p15.c (pukdf_object_t): New. (struct app_local_s): Add field public_key_info. (release_pukdflist): New. (select_and_read_record): No diagnostic in case of not_found. (read_first_record): New. Factored out from the read_ef_ fucntions. (read_ef_pukdf): New. Basically a copy of read_ef_prkdf for now. (read_p15_info): Also read the public keys. (cardtype2str): New. (read_ef_tokeninfo): Print a string with the cardtype.
* scd:p15: Make file selection more robust.Werner Koch2021-01-271-37/+60
| | | | | | | | | | | | | | | | | | | * scd/app-p15.c: Include host2net.h. (DEFAULT_HOME_DF): New. (select_and_read_binary): Replace slot by app. Change callers. Use select_ef_by_path. (select_and_read_record): ditto. (select_ef_by_path): Make use use the home_df. (parse_certid): Adjust for always set home_df. (print_tokeninfo_tokenflags): Ditto. (app_select_p15): Take the home_df from the FCI returned by select. -- This uses modern APDUs and always selectd starting at the PCKS-15 home DF. We could have made this much simpler but the goal is to keep support for older cards although we can't test that easily. Signed-off-by: Werner Koch <[email protected]>
* scd: Define new status wordWerner Koch2021-01-274-9/+17
| | | | | | | | * scd/apdu.h (SW_NO_CURRENT_EF): New. -- This merely to show better diagnostics. Used for example by CardOS 5.3.
* scd:p15: Factor the commonKeyAttributes parser out.Werner Koch2021-01-271-134/+206
| | | | | | | * scd/app-p15.c (read_ef_prkdf): Fix detection of unsupported key objects. Factor some code out to ... (parse_common_key_attr): new. --
* scd:p15: Factor the commonObjectAttributes parser out.Werner Koch2021-01-261-139/+112
| | | | | | * scd/app-p15.c (parse_common_obj_attr): New. (read_ef_prkdf): Use new function. (read_ef_aodf): Ditto.
* scd:p15: First step towards real CardOS 5 support.Werner Koch2021-01-264-76/+218
| | | | | | | | | | | | | | | | | | | | * scd/iso7816.c (iso7816_select_path): Add arg from_cdf. * scd/app-nks.c (do_readkey): Adjust for this change. * scd/app-p15.c (CARD_TYPE_CARDOS_53): New. (IS_CARDOS_5): New. (card_atr_list): Add standard ATR for CardOS 5.3. (select_and_read_binary): Remove the fallback to record read hack. (select_and_read_record): New. (select_ef_by_path): Rework and support CardOS feature. (read_ef_prkdf): Use read record for CardOS. (read_ef_cdf): Ditto. (read_ef_aodf): Ditto. Also fix bug in the detection of other unsupported attribute types. (verify_pin): Use IS_CARDOS_5 macro. (app_select_p15): Force direct method for CardOS. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Show the ATR as part of the TokenInfo diagnostics.Werner Koch2021-01-211-0/+12
| | | | | | | | | * scd/app-p15.c (read_ef_tokeninfo): Print the ATR in verbose mode. -- It is convenient to see the ATR close to the other info, Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Add support for signing plain SHA-3 digests.Ingo Klöcker2021-01-061-17/+67
| | | | | | | | | | | * scd/app-nks.c (do_sign): Handle plain SHA-3 digests and verify encoding of ASN.1 encoded hashes. -- This makes it possible to create CSRs for NetKey card keys which are signed with SHA256 by default. GnuPG-bug-id: 5184
* scd:nks: Support READKEY with keygrip and for "NKS-IDLM" keyref.NIIBE Yutaka2020-12-111-0/+22
| | | | | | | | | | * scd/app-nks.c (do_readkey): Allow KEYGRIP access. Support NKS-IDLM.XXXX keyref. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:nks: Factor out pubkey retrieval from keygrip handling.NIIBE Yutaka2020-12-111-84/+72
| | | | | | | * scd/app-nks.c (pubkey_from_pk_file): New. (keygripstr_from_pk_file): Use pubkey_from_pk_file. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:nks: Add support of KEYGRIP for do_readcert.NIIBE Yutaka2020-12-101-0/+18
| | | | | | | | | * scd/app-nks.c (do_readcert): Support KEYGRIP. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:nks: Factor out iteration over filelist.NIIBE Yutaka2020-12-101-78/+114
| | | | | | | * scd/app-nks.c (iterate_over_filelist): New. (do_with_keygrip): Use iterate_over_filelist. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:ccid:spr532: Extend abort_cmd for initialization time.NIIBE Yutaka2020-12-091-11/+18
| | | | | | | | | * scd/ccid-driver.c (abort_cmd): Add INIT argument to support synchronize until success, even ignoring timeout. (bulk_in): Normal use case of abort_cmd. (ccid_vendor_specific_init): Initial use case of abort_cmd. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.NIIBE Yutaka2020-12-091-0/+1
| | | | | | | | | | * scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532, call libusb_clear_halt. -- GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.NIIBE Yutaka2020-12-091-1/+0
| | | | | | | | | * scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt. -- GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:yubikey: Fix support of Yubikey NEO.NIIBE Yutaka2020-12-081-0/+3
| | | | | | * scd/app-openpgp.c (get_public_key): Yubikey NEO also has this issue. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:nks: Fix caching keygrip (more).NIIBE Yutaka2020-12-031-5/+7
| | | | | | | | | | * scd/app-nks.c (keygripstr_from_pk_file): Distinguish by APP_ID. -- GnuPG-bug-id: 5150, 5161 Fixes-commit: 920154370834ad8d947aed19c9d914a27dde6baa Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix KEYINFO command with --data option.NIIBE Yutaka2020-12-031-4/+3
| | | | | | * scd/command.c (cmd_keyinfo): Handle --data option correctly. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Fix writing ECC key to card.NIIBE Yutaka2020-12-031-6/+27
| | | | | | | | | | * scd/app-openpgp.c (build_privkey_template): Adding another argument of ecc_d_fixed_len to handle variable-size MPI. -- GnuPG-bug-id: 5163 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:nks: Minor additions to the basic IDLM application support.Werner Koch2020-11-301-15/+25
| | | | | | | | | | | | | * scd/app-nks.c (filelist): Use special value -1 for IDLM pubkeys. (keygripstr_from_pk_file): Handle special value. (do_readcert): Ditto. (do_writecert): Ditto. -- This allows to get information about the keys from the card. However the do_readkey still requires a fallback to readcert. This does not work because there are no certificates yet on the card. The fix is to fully implement do_readkey.
* scd: New getinfo sub-command apdu_strerror.Werner Koch2020-11-272-15/+28
| | | | | | | | | * scd/apdu.c (apdu_strerror): Add missing status codes. * scd/command.c (cmd_getinfo): New sub-command apdu_strerror. -- This is quite handy for gpg-card's APDU command and avoids that we need to duplicate the mapping table or put it into a shared file.
* scd:ccid-driver: Fix pinpad error handling for cancel/timeout.NIIBE Yutaka2020-11-274-2/+17
| | | | | | | | | | | | | | * scd/apdu.h (SW_HOST_UI_CANCELLED, SW_HOST_UI_TIMEOUT): New. * scd/ccid-driver.h (CCID_DRIVER_ERR_UI_CANCELLED): New. (CCID_DRIVER_ERR_UI_TIMEOUT): New. * scd/ccid-driver.c (bulk_in): Handle PIN input cancel/timeout error. * scd/iso7816.c (map_sw): Support SW_HOST_UI_CANCELLED and SW_HOST_UI_TIMEOUT. -- GnuPG-bug-id: 4614 Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Fix YK s/n and prettify the request card prompt for YubikeysWerner Koch2020-11-262-34/+20
| | | | | | | | | | * agent/divert-scd.c (ask_for_card): Detect and re-format the Yubikey prompt. * scd/app.c (app_munge_serialno): Fix Yubikey s/n munging. (card_get_dispserialno): Ditto. * scd/app-openpgp.c (get_disp_serialno): Remove. (get_prompt_info): Use app_get_dispserialno.-- --
* scd: Do not try to use a non-enabled app after card switching.Werner Koch2020-11-261-2/+19
| | | | | | | | | | | | | * scd/app.c (app_dump_state): Also print the refcount. (maybe_switch_app): Make sure the app exists on the card. -- When switching the current card and the card does not support the same apps as the former, we now reset the app to the first one. Testcase is to use a standard OpenPGP card and a P15 card. Signed-off-by: Werner Koch <[email protected]>
* scd: Add special serialno compare for OpenPGP cards.Werner Koch2020-11-262-10/+44
| | | | | | | | | | | | | | | | | * scd/app.c (is_same_serialno): New. (check_application_conflict): Use this. (select_application): Ditto. (app_switch_current_card): Ditto. * scd/app-openpgp.c (check_keyidstr): Ignore the card version and also compare case insensitive. -- This is required because we change what we emit as serialno of OpenPGP cards but existing keys still use the old form of the serial number (i.e. with a firmware version). See-commit: 3a8250c02031080c6c8eebd5dea03f5f87f9ddd7 Signed-off-by: Werner Koch <[email protected]>
* scd,nks: Fix caching keygrip.NIIBE Yutaka2020-11-261-3/+4
| | | | | | | | | | * scd/app-nks.c (keygripstr_from_pk_file): Identify by cfid if available. -- GnuPG-bug-id: 5150 Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 14:32:18 +0000