Opensc: opensc-explorer does not verify PIN on Windows 8.1

[szszszsz]

Expected behaviour

PIN should be verified correctly while using opensc-explorer tool.

Actual behaviour

Error message is shown:

Unable to verify PIN code: Transmit failed

Issue is not occurring on Ubuntu 16.10 with OpenSC 0.16.

Steps to reproduce

Preconditions:

Admin PIN set to 12345678
OS: Windows 8.1 (also reported on Windows 10)
OpenSC build: latest development, No 0.16.0.1243
Nitrokey Pro v0.8

PS C:\Program Files\OpenSC Project\OpenSC\tools> .\opensc-tool.exe -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Nitrokey Nitrokey Pro 0
PS C:\Program Files\OpenSC Project\OpenSC\tools> .\opensc-tool.exe -a
Using reader with a card: Nitrokey Nitrokey Pro 0
3b:da:18:ff:81:b1:fe:75:1f:03:00:31:c5:73:c0:01:40:00:90:00:0c
PS C:\Program Files\OpenSC Project\OpenSC\tools> .\opensc-tool.exe -n
Using reader with a card: Nitrokey Nitrokey Pro 0
CryptoStick v1.2 (OpenPGP v2.0)

Steps

1. Run opensc-explorer
2. Run verify CHV3 3132333435363738

Logs

PS C:\Program Files\OpenSC Project\OpenSC\tools> ./opensc-explorer -v
OpenSC Explorer version 0.16.0
Using reader with a card: Nitrokey Nitrokey Pro 0
OpenSC [3F00]> verify CHV3 3132333435363738
Unable to verify PIN code: Transmit failed

opensc-explorer_windows8.txt
opensc-explorer-issue-ubuntu16.10-working.txt

CC: @jans23

[martinpaljak]

I can tell the reason for the bug (Windows and transactions being limited to 5 seconds, see the remark here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379469(v=vs.85).aspx), but the solution depends on several factors.
2017-05-05 13:26:47.489 [opensc-explorer] card.c:449:sc_lock: returning with: 0 (Success) ... 2017-05-05 13:27:04.749 [opensc-explorer] sec.c:169:sc_pin_cmd: called
1) There is a bug in OpenPGP card code, that does not release the transaction after reading the file, but maybe it should release it
2) Use exclusive access on Windows 8+, if possible, for short periods

[frankmorgner]

The solution to this problem is to lock the token only when needed. It's already implemented in pkcs15-tool (c6db68fdeee256309b1612776960558c553a38f5), for example, but currently not in opensc-explorer.

[szszszsz]

Just tested the latest build (0.16.0.1294) available on Windows 8.1 and the same issue has occurred for pkcs15-init while I was trying to import/delete certificate using the command listed on Wiki:

pkcs15-init --store-certificate mycert.pem --id 3
pkcs15-init --delete-objects cert --id 3

If PIN was not supplied within 5 seconds from tool's execution, Transmit failed error was shown.

[frankmorgner]

Sure, because nobody implemented the fix above. Go ahead if you have some spare time!

[CardContact]

Related to #875

[szszszsz]

@frankmorgner
Sorry If I have sounded somewhat complaining, just wanted to note the other tool is affected too.