|
 |
0c9295 |
From bc496dfa59c1cfbc5c47c76511d5c6b7eff5cc6c Mon Sep 17 00:00:00 2001
|
|
|
0c9295 |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
0c9295 |
Date: Thu, 26 Jan 2017 17:11:24 +0100
|
|
|
0c9295 |
Subject: [PATCH 1/4] Set security context for CardOS 5.3 with p1=0x41 (as
|
|
|
0c9295 |
Coolkey does)
|
|
|
0c9295 |
|
|
|
0c9295 |
---
|
|
|
0c9295 |
src/libopensc/card-cardos.c | 16 +++++++++++-----
|
|
|
0c9295 |
src/libopensc/cards.h | 1 +
|
|
|
0c9295 |
2 files changed, 12 insertions(+), 5 deletions(-)
|
|
|
0c9295 |
|
|
|
0c9295 |
diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
index 0c14b32..008ce5c 100644
|
|
|
0c9295 |
--- a/src/libopensc/card-cardos.c
|
|
|
0c9295 |
+++ b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
@@ -59,7 +59,7 @@ static struct sc_atr_table cardos_atrs[] = {
|
|
|
0c9295 |
/* CardOS v5.0 */
|
|
|
0c9295 |
{ "3b:d2:18:00:81:31:fe:58:c9:01:14", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_0, 0, NULL},
|
|
|
0c9295 |
/* CardOS v5.3 */
|
|
|
0c9295 |
- { "3b:d2:18:00:81:31:fe:58:c9:03:16", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_0, 0, NULL},
|
|
|
0c9295 |
+ { "3b:d2:18:00:81:31:fe:58:c9:03:16", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_3, 0, NULL},
|
|
|
0c9295 |
{ NULL, NULL, NULL, 0, 0, NULL }
|
|
|
0c9295 |
};
|
|
|
0c9295 |
|
|
|
0c9295 |
@@ -84,6 +84,8 @@ static int cardos_match_card(sc_card_t *card)
|
|
|
0c9295 |
return 1;
|
|
|
0c9295 |
if (card->type == SC_CARD_TYPE_CARDOS_V5_0)
|
|
|
0c9295 |
return 1;
|
|
|
0c9295 |
+ if (card->type == SC_CARD_TYPE_CARDOS_V5_3)
|
|
|
0c9295 |
+ return 1;
|
|
|
0c9295 |
if (card->type == SC_CARD_TYPE_CARDOS_M4_2) {
|
|
|
0c9295 |
int rv;
|
|
|
0c9295 |
sc_apdu_t apdu;
|
|
|
0c9295 |
@@ -195,7 +197,8 @@ static int cardos_init(sc_card_t *card)
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_2B
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_2C
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_4
|
|
|
0c9295 |
- || card->type == SC_CARD_TYPE_CARDOS_V5_0) {
|
|
|
0c9295 |
+ || card->type == SC_CARD_TYPE_CARDOS_V5_0
|
|
|
0c9295 |
+ || card->type == SC_CARD_TYPE_CARDOS_V5_3) {
|
|
|
0c9295 |
rsa_2048 = 1;
|
|
|
0c9295 |
card->caps |= SC_CARD_CAP_APDU_EXT;
|
|
|
0c9295 |
}
|
|
|
0c9295 |
@@ -230,7 +233,7 @@ static int cardos_init(sc_card_t *card)
|
|
|
0c9295 |
_sc_card_add_rsa_alg(card, 2048, flags, 0);
|
|
|
0c9295 |
}
|
|
|
0c9295 |
|
|
|
0c9295 |
- if (card->type == SC_CARD_TYPE_CARDOS_V5_0) {
|
|
|
0c9295 |
+ if (card->type >= SC_CARD_TYPE_CARDOS_V5_0) {
|
|
|
0c9295 |
/* Starting with CardOS 5, the card supports PIN query commands */
|
|
|
0c9295 |
card->caps |= SC_CARD_CAP_ISO7816_PIN_INFO;
|
|
|
0c9295 |
}
|
|
|
0c9295 |
@@ -249,7 +252,7 @@ static const struct sc_card_error cardos_errors[] = {
|
|
|
0c9295 |
{ 0x6f82, SC_ERROR_CARD_CMD_FAILED, "not enough memory in xram"},
|
|
|
0c9295 |
{ 0x6f84, SC_ERROR_CARD_CMD_FAILED, "general protection fault"},
|
|
|
0c9295 |
|
|
|
0c9295 |
-/* the card doesn't now thic combination of ins+cla+p1+p2 */
|
|
|
0c9295 |
+/* the card doesn't now this combination of ins+cla+p1+p2 */
|
|
|
0c9295 |
/* i.e. command will never work */
|
|
|
0c9295 |
{ 0x6881, SC_ERROR_NO_CARD_SUPPORT, "logical channel not supported"},
|
|
|
0c9295 |
{ 0x6a86, SC_ERROR_INCORRECT_PARAMETERS,"p1/p2 invalid"},
|
|
|
0c9295 |
@@ -781,6 +784,8 @@ cardos_set_security_env(sc_card_t *card,
|
|
|
0c9295 |
if (card->type == SC_CARD_TYPE_CARDOS_CIE_V1) {
|
|
|
0c9295 |
cardos_restore_security_env(card, 0x30);
|
|
|
0c9295 |
apdu.p1 = 0xF1;
|
|
|
0c9295 |
+ } else if (card->type == SC_CARD_TYPE_CARDOS_V5_3) {
|
|
|
0c9295 |
+ apdu.p1 = 0x41;
|
|
|
0c9295 |
} else {
|
|
|
0c9295 |
apdu.p1 = 0x01;
|
|
|
0c9295 |
}
|
|
|
0c9295 |
@@ -1235,7 +1240,8 @@ cardos_logout(sc_card_t *card)
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_2C
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_3
|
|
|
0c9295 |
|| card->type == SC_CARD_TYPE_CARDOS_M4_4
|
|
|
0c9295 |
- || card->type == SC_CARD_TYPE_CARDOS_V5_0) {
|
|
|
0c9295 |
+ || card->type == SC_CARD_TYPE_CARDOS_V5_0
|
|
|
0c9295 |
+ || card->type == SC_CARD_TYPE_CARDOS_V5_3) {
|
|
|
0c9295 |
sc_apdu_t apdu;
|
|
|
0c9295 |
int r;
|
|
|
0c9295 |
sc_path_t path;
|
|
|
0c9295 |
diff --git a/src/libopensc/cards.h b/src/libopensc/cards.h
|
|
|
0c9295 |
index d71c02f..9f8f641 100644
|
|
|
0c9295 |
--- a/src/libopensc/cards.h
|
|
|
0c9295 |
+++ b/src/libopensc/cards.h
|
|
|
0c9295 |
@@ -47,6 +47,7 @@ enum {
|
|
|
0c9295 |
SC_CARD_TYPE_CARDOS_CIE_V1, /* Italian CIE (eID) v1 */
|
|
|
0c9295 |
SC_CARD_TYPE_CARDOS_M4_4,
|
|
|
0c9295 |
SC_CARD_TYPE_CARDOS_V5_0,
|
|
|
0c9295 |
+ SC_CARD_TYPE_CARDOS_V5_3,
|
|
|
0c9295 |
|
|
|
0c9295 |
/* flex/cyberflex drivers */
|
|
|
0c9295 |
SC_CARD_TYPE_FLEX_BASE = 2000,
|
|
|
0c9295 |
--
|
|
|
0c9295 |
2.9.3
|
|
|
0c9295 |
|
|
|
0c9295 |
|
|
|
0c9295 |
From 5dec534cf07e45ffb0209a53d6145022ecd9259a Mon Sep 17 00:00:00 2001
|
|
|
0c9295 |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
0c9295 |
Date: Mon, 30 Jan 2017 14:33:05 +0100
|
|
|
0c9295 |
Subject: [PATCH 2/4] Do not emulate signatures in CardOS 5.3
|
|
|
0c9295 |
|
|
|
0c9295 |
Remove the bogus SC_ALGORITHM_NEED_USAGE which prevents using the
|
|
|
0c9295 |
actual implementation in cardos_compute_signature().
|
|
|
0c9295 |
|
|
|
0c9295 |
It might be bogus also in previous version, but I don't have a way
|
|
|
0c9295 |
to verify against these cards.
|
|
|
0c9295 |
---
|
|
|
0c9295 |
src/libopensc/card-cardos.c | 8 +++++---
|
|
|
0c9295 |
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
0c9295 |
|
|
|
0c9295 |
diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
index 008ce5c..a21e67a 100644
|
|
|
0c9295 |
--- a/src/libopensc/card-cardos.c
|
|
|
0c9295 |
+++ b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
@@ -177,11 +177,13 @@ static int cardos_init(sc_card_t *card)
|
|
|
0c9295 |
card->cla = 0x00;
|
|
|
0c9295 |
|
|
|
0c9295 |
/* Set up algorithm info. */
|
|
|
0c9295 |
- flags = SC_ALGORITHM_NEED_USAGE
|
|
|
0c9295 |
- | SC_ALGORITHM_RSA_RAW
|
|
|
0c9295 |
+ flags = SC_ALGORITHM_RSA_RAW
|
|
|
0c9295 |
| SC_ALGORITHM_RSA_HASH_NONE
|
|
|
0c9295 |
| SC_ALGORITHM_ONBOARD_KEY_GEN
|
|
|
0c9295 |
;
|
|
|
0c9295 |
+ if (card->type != SC_CARD_TYPE_CARDOS_V5_3)
|
|
|
0c9295 |
+ flags |= SC_ALGORITHM_NEED_USAGE;
|
|
|
0c9295 |
+
|
|
|
0c9295 |
_sc_card_add_rsa_alg(card, 512, flags, 0);
|
|
|
0c9295 |
_sc_card_add_rsa_alg(card, 768, flags, 0);
|
|
|
0c9295 |
_sc_card_add_rsa_alg(card, 1024, flags, 0);
|
|
|
0c9295 |
@@ -252,7 +254,7 @@ static const struct sc_card_error cardos_errors[] = {
|
|
|
0c9295 |
{ 0x6f82, SC_ERROR_CARD_CMD_FAILED, "not enough memory in xram"},
|
|
|
0c9295 |
{ 0x6f84, SC_ERROR_CARD_CMD_FAILED, "general protection fault"},
|
|
|
0c9295 |
|
|
|
0c9295 |
-/* the card doesn't now this combination of ins+cla+p1+p2 */
|
|
|
0c9295 |
+/* the card doesn't know this combination of ins+cla+p1+p2 */
|
|
|
0c9295 |
/* i.e. command will never work */
|
|
|
0c9295 |
{ 0x6881, SC_ERROR_NO_CARD_SUPPORT, "logical channel not supported"},
|
|
|
0c9295 |
{ 0x6a86, SC_ERROR_INCORRECT_PARAMETERS,"p1/p2 invalid"},
|
|
|
0c9295 |
--
|
|
|
0c9295 |
2.9.3
|
|
|
0c9295 |
|
|
|
0c9295 |
|
|
|
0c9295 |
From 057197c7abf29715a2b7793045c35adf2a34dc17 Mon Sep 17 00:00:00 2001
|
|
|
0c9295 |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
0c9295 |
Date: Fri, 10 Mar 2017 16:37:43 +0100
|
|
|
0c9295 |
Subject: [PATCH 3/4] Hack for returning the padding back in CardOS 5.3
|
|
|
0c9295 |
|
|
|
0c9295 |
---
|
|
|
0c9295 |
src/libopensc/card-cardos.c | 25 +++++++++++++++++++++++++
|
|
|
0c9295 |
1 file changed, 25 insertions(+)
|
|
|
0c9295 |
|
|
|
0c9295 |
diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
index a21e67a..39ec4ac 100644
|
|
|
0c9295 |
--- a/src/libopensc/card-cardos.c
|
|
|
0c9295 |
+++ b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
@@ -979,6 +979,30 @@ cardos_compute_signature(sc_card_t *card, const u8 *data, size_t datalen,
|
|
|
0c9295 |
}
|
|
|
0c9295 |
|
|
|
0c9295 |
static int
|
|
|
0c9295 |
+cardos_decipher(struct sc_card *card,
|
|
|
0c9295 |
+ const u8 * crgram, size_t crgram_len,
|
|
|
0c9295 |
+ u8 * out, size_t outlen)
|
|
|
0c9295 |
+{
|
|
|
0c9295 |
+ int r;
|
|
|
0c9295 |
+ u8 *tmp = NULL;
|
|
|
0c9295 |
+ size_t tmp_len = crgram_len;
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+ assert(card != NULL && crgram != NULL && out != NULL);
|
|
|
0c9295 |
+ LOG_FUNC_CALLED(card->ctx);
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+ tmp = malloc(tmp_len);
|
|
|
0c9295 |
+ r = iso_ops->decipher(card, crgram, crgram_len, tmp, tmp_len);
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+ /* add bogus padding, because the card removes it */
|
|
|
0c9295 |
+ if (sc_pkcs1_encode(card->ctx, SC_ALGORITHM_RSA_HASH_NONE|SC_ALGORITHM_RSA_PAD_PKCS1,
|
|
|
0c9295 |
+ tmp, r, out, &outlen, crgram_len) != SC_SUCCESS)
|
|
|
0c9295 |
+ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INTERNAL);
|
|
|
0c9295 |
+ out[1] = 0x02; /* this is encryption-padding */
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+ LOG_FUNC_RETURN(card->ctx, outlen);
|
|
|
0c9295 |
+}
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+static int
|
|
|
0c9295 |
cardos_lifecycle_get(sc_card_t *card, int *mode)
|
|
|
0c9295 |
{
|
|
|
0c9295 |
sc_apdu_t apdu;
|
|
|
0c9295 |
@@ -1278,6 +1302,7 @@ static struct sc_card_driver * sc_get_driver(void)
|
|
|
0c9295 |
cardos_ops.set_security_env = cardos_set_security_env;
|
|
|
0c9295 |
cardos_ops.restore_security_env = cardos_restore_security_env;
|
|
|
0c9295 |
cardos_ops.compute_signature = cardos_compute_signature;
|
|
|
0c9295 |
+ cardos_ops.decipher = cardos_decipher;
|
|
|
0c9295 |
|
|
|
0c9295 |
cardos_ops.list_files = cardos_list_files;
|
|
|
0c9295 |
cardos_ops.check_sw = cardos_check_sw;
|
|
|
0c9295 |
--
|
|
|
0c9295 |
2.9.3
|
|
|
0c9295 |
|
|
|
0c9295 |
|
|
|
0c9295 |
From 515f761f5564e91302ce672d30a24d6e6738e349 Mon Sep 17 00:00:00 2001
|
|
|
0c9295 |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
0c9295 |
Date: Mon, 13 Mar 2017 15:15:48 +0100
|
|
|
0c9295 |
Subject: [PATCH 4/4] With older cards, use iso decipher
|
|
|
0c9295 |
|
|
|
0c9295 |
---
|
|
|
0c9295 |
src/libopensc/card-cardos.c | 16 ++++++++++++++--
|
|
|
0c9295 |
1 file changed, 14 insertions(+), 2 deletions(-)
|
|
|
0c9295 |
|
|
|
0c9295 |
diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
index 39ec4ac..d479065 100644
|
|
|
0c9295 |
--- a/src/libopensc/card-cardos.c
|
|
|
0c9295 |
+++ b/src/libopensc/card-cardos.c
|
|
|
0c9295 |
@@ -992,10 +992,22 @@ cardos_decipher(struct sc_card *card,
|
|
|
0c9295 |
|
|
|
0c9295 |
tmp = malloc(tmp_len);
|
|
|
0c9295 |
r = iso_ops->decipher(card, crgram, crgram_len, tmp, tmp_len);
|
|
|
0c9295 |
+ if (r < 0)
|
|
|
0c9295 |
+ LOG_FUNC_RETURN(card->ctx, r);
|
|
|
0c9295 |
+
|
|
|
0c9295 |
+ if (card->type != SC_CARD_TYPE_CARDOS_V5_3) {
|
|
|
0c9295 |
+ /* XXX */
|
|
|
0c9295 |
+ memcpy(out, tmp, tmp_len);
|
|
|
0c9295 |
+ outlen = tmp_len;
|
|
|
0c9295 |
+ free(tmp);
|
|
|
0c9295 |
+ LOG_FUNC_RETURN(card->ctx, r);
|
|
|
0c9295 |
+ }
|
|
|
0c9295 |
|
|
|
0c9295 |
/* add bogus padding, because the card removes it */
|
|
|
0c9295 |
- if (sc_pkcs1_encode(card->ctx, SC_ALGORITHM_RSA_HASH_NONE|SC_ALGORITHM_RSA_PAD_PKCS1,
|
|
|
0c9295 |
- tmp, r, out, &outlen, crgram_len) != SC_SUCCESS)
|
|
|
0c9295 |
+ r = sc_pkcs1_encode(card->ctx, SC_ALGORITHM_RSA_HASH_NONE|SC_ALGORITHM_RSA_PAD_PKCS1,
|
|
|
0c9295 |
+ tmp, r, out, &outlen, crgram_len);
|
|
|
0c9295 |
+ free(tmp);
|
|
|
0c9295 |
+ if (r != SC_SUCCESS)
|
|
|
0c9295 |
LOG_FUNC_RETURN(card->ctx, SC_ERROR_INTERNAL);
|
|
|
0c9295 |
out[1] = 0x02; /* this is encryption-padding */
|
|
|
0c9295 |
|
|
|
0c9295 |
--
|
|
|
0c9295 |
2.9.3
|
|
|
0c9295 |
|