Opensc: Commit 642a3ee73411 broke CardOS 5.0

Created on 25 Mar 2020 · 8Comments · Source: OpenSC/OpenSC

Commit 642a3ee73411761c03a5480484be4d51b087f304 broke support for the CardOS 5.0 card I have. The user-observable symptom is that authentication to a TLS server using a client certificate/private key stored on the card using Firefox fails. It works with 0.19.0 but not with 0.20.0. The test results of pkcs11-tool --login --test coincide with that:

Current master:

# git log --oneline | head -1
78408047 fixed typo
# git diff
# make -j8 > /dev/null 2>&1
# src/tools/pkcs11-tool --module src/pkcs11/.libs/onepin-opensc-pkcs11.so --test --login
Using slot 0 with a present token (0x0)
Logging in to "PKCS#15 Card + OTP FS".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700)
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-PKCS: ERR: verification failed
    SHA1-RSA-PKCS: ERR: verification failed
    MD5-RSA-PKCS: ERR: verification failed
    RIPEMD160-RSA-PKCS: ERR: verification failed
    SHA256-RSA-PKCS: ERR: verification failed
  testing key 1 (ENC 643A[...]C946) with 1 mechanism
    RSA-PKCS: ERR: verification failed
  testing key 2 (michael.weiser ENC 21) with 1 mechanism
    RSA-PKCS: ERR: verification failed
Verify (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700)
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 1 (ENC 643A[...]C946) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
  testing key 2 (michael.weiser ENC 21) with 1 mechanism
    RSA-PKCS:   ERR: C_Verify() returned CKR_GENERAL_ERROR (0x5)
Decryption (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700) -- can't be used to decrypt, skipping
  testing key 1 (ENC 643A[...]C946)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 cb [...] 23 1e
    Decrypted: 02 16 [...] 40 c1
  testing key 2 (michael.weiser ENC 21)
    RSA-PKCS: resulting cleartext doesn't match input
    Original: 00 00 [...] 5b 17
    Decrypted: 02 4d [...] 5b 17
12 errors
#

With commit 642a3ee73411 reverted off of current master:

# git revert --no-edit 642a3ee73411
Auto-merging src/libopensc/card-cardos.c
[master 1df5d85a] Revert "cardos: Use more appropriate RSA flags for CardOS 5"
 Date: Wed Mar 25 21:03:05 2020 +0100
 1 file changed, 12 insertions(+), 27 deletions(-)
# make -j8 > /dev/null 2>&1
# src/tools/pkcs11-tool --module src/pkcs11/.libs/onepin-opensc-pkcs11.so --test --login
Using slot 0 with a present token (0x0)
Logging in to "PKCS#15 Card + OTP FS".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700)
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
  testing key 1 (ENC 643A[...]C946) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (michael.weiser ENC 21) with 1 mechanism
    RSA-X-509: OK
Verify (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700)
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
  testing key 1 (ENC 643A[...]C946) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (michael.weiser ENC 21) with 1 mechanism
    RSA-X-509: OK
Decryption (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700) -- can't be used to decrypt, skipping
  testing key 1 (ENC 643A[...]C946)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 54 [...] 10 8b
    Decrypted: 54 d8 [...] 10 8b
    RSA-PKCS: OK
  testing key 2 (michael.weiser ENC 21)
    RSA-X-509: resulting cleartext doesn't match input
    Original: 00 fe [...] 91 6c
    Decrypted: fe 6b [...] 91 6c
    RSA-PKCS: OK
2 errors
#

Conversely, TLS client authentication using Firefox works again with that commit reverted (tested with 0.20.0 release, actually). Offending commit determined using git bisect. The commit just before works fine, this commit does not, reverting it off of 0.20.0 or current master makes it work again.

Reverting parts of the commit in trial'n'error fashion, I can narrow it down to the following change making pkcs11-tool and TLS client authentication work again:

diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
index 306822b9..10977ce9 100644
--- a/src/libopensc/card-cardos.c
+++ b/src/libopensc/card-cardos.c
@@ -173,7 +173,8 @@ static int cardos_init(sc_card_t *card)
        /* Set up algorithm info. */
        flags = 0;
        if (card->type == SC_CARD_TYPE_CARDOS_V5_0) {
-               flags |= SC_ALGORITHM_RSA_PAD_PKCS1;
+               //flags |= SC_ALGORITHM_RSA_PAD_PKCS1;
+               flags |= SC_ALGORITHM_RSA_RAW;
        } else {
                flags |= SC_ALGORITHM_RSA_RAW
                        | SC_ALGORITHM_RSA_HASH_NONE

Reading the discussion about raw RSA signature support in CardOS 5.0 cards in issue #1864 referenced in the commit I seem to either have a very, very broken or very special card that it requires that flag to work at all. :) I stand by to help debug this in every way possible.

Relevant card and reader info:

# src/tools/cardos-tool -i
Using reader with a card: Gemalto PC Twin Reader 00 00
[...]
Info : CardOS V5.0, 2012
Serial number: [...]
OS Version: 201.1 (that's CardOS V5.0)
Current life cycle: 16 (operational)
Security Status of current DF:
Free memory : 817
ATR Status: 0x0 ROM-ATR
Packages installed:
[...]
Ram size: 7, Eeprom size: 96, cpu type: 78, chip config: 63, chip manufacturer: 5
Free eeprom memory: 63911
Current Maximum Data Field Length: 640
Complete chip production data:
[...]
System keys: PackageLoadKey (version 0x00, retries 10)
System keys: StartKey (version 0x00, retries 10)
Path to current DF:
# src/tools/pkcs11-tool --module src/pkcs11/.libs/onepin-opensc-pkcs11.so -L
Available slots:
Slot 0 (0x0): Gemalto PC Twin Reader 00 00
  token label        : PKCS#15 Card + OTP FS
  token manufacturer : www.atos.net/cardos
  token model        : PKCS#15
  token flags        : login required, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : [...]
  pin min/max        : 4/16

Source

michaelweiser

Most helpful comment

Good point to note that the CardOS 5.3 code path of #1987 also fixes the decryption tests for 5.0 which were broken with 0.19.0 already and remain broken with 0.20.0 and my workaround patch from above. I had ignored them because they don't seem to affect my TLS client certificate use case.

michaelweiser on 27 Mar 2020

👍2

All 8 comments

Try #1987.

it makes some very basic changes to get V5.3 cards to work, and I have asked earlier today https://github.com/OpenSC/OpenSC/pull/1987#issuecomment-603860908 for anyone with a 5.0 card try replacing in line 54. SC_CARD_TYPE_CARDOS_V5_0 with SC_CARD_TYPE_CARDOS_V5_3
If it works or not, can you send an opensc-debug.log

Not having either of these cards, I can not test this.

dengert on 25 Mar 2020

Thanks for replying so quickly. I saw the PR but missed that particular hint/request. Indeed, switching 5.0 cards to the 5.3 code path of https://github.com/dengert/OpenSC/tree/cardos-5.3 makes the test work again:

$ git log --oneline |  head -1
95efe817 Various CardOS 5.3 Fixes

diff --git a/src/libopensc/card-cardos.c b/src/libopensc/card-cardos.c
index 171f7372..5c3dbd86 100644
--- a/src/libopensc/card-cardos.c
+++ b/src/libopensc/card-cardos.c
@@ -51,7 +51,7 @@ static const struct sc_atr_table cardos_atrs[] = {
        /* CardOS 4.4 */
        { "3b:d2:18:02:c1:0a:31:fe:58:c8:0d:51", NULL, NULL, SC_CARD_TYPE_CARDOS_M4_4, 0, NULL},
        /* CardOS v5.0 */
-       { "3b:d2:18:00:81:31:fe:58:c9:01:14", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_0, 0, NULL},
+       { "3b:d2:18:00:81:31:fe:58:c9:01:14", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_3, 0, NULL},
        /* CardOS v5.3 */
        { "3b:d2:18:00:81:31:fe:58:c9:02:17", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_3, 0, NULL},
        { "3b:d2:18:00:81:31:fe:58:c9:03:16", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_3, 0, NULL},



md5-f514fd5d1d479e0c94a1949e461e819e



[...]
Signatures (currently only for RSA)
  testing key 0 (AUT 55B7[...]3700)
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
  testing key 1 (ENC 643A[...]C946) with 1 mechanism
    RSA-X-509: OK
  testing key 2 (michael.weiser ENC 21) with 1 mechanism
    RSA-X-509: OK
[...]

michaelweiser on 26 Mar 2020

I can confirm that the 5.3 code path works for my Siemens ID card with CardOS 5.3:

$ src/tools/pkcs11-tool --module src/pkcs11/.libs/onepin-opensc-pkcs11.so --test --login

Using slot 0 with a present token (0x0)
Logging in to "Siemens Corporate ID Card (V8)".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
seems to be OK
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
SHA256-RSA-PKCS: OK
testing key 1 (Encr 24.04.18 14:16:35 - 24.04.21) with 1 mechanism
RSA-X-509: OK
Verify (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
testing key 1 (Encr 24.04.18 14:16:35 - 24.04.21) with 1 mechanism
RSA-X-509: OK
Decryption (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
RSA-X-509: OK
RSA-PKCS: OK
testing key 1 (Encr 24.04.18 14:16:35 - 24.04.21)
RSA-X-509: OK
RSA-PKCS: OK
No errors

In comparison to OpenSC v0.19 which still works (while 0.20 breaks every functionality including S/MIME and WebAuth for me):

$ pkcs11-tool --test --login

Using slot 0 with a present token (0x0)
Logging in to "Siemens Corporate ID Card (V8)".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
seems to be OK
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
SHA256-RSA-PKCS: OK
testing key 1 (2048 bits, label=Encr 24.04.18 14:16:35 - 24.04.21) with 1 signature mechanism
RSA-X-509: OK
Verify (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
testing key 1 (Encr 24.04.18 14:16:35 - 24.04.21) with 1 mechanism
RSA-X-509: OK
Unwrap: not implemented
Decryption (currently only for RSA)
testing key 0 (Auth 24.04.18 12:16:34 - 24.04.21)
RSA-X-509: resulting cleartext doesn't match input
Original: 61 [..] 00
Decrypted: 02 [..] 00
RSA-PKCS: OK
testing key 1 (Encr 24.04.18 14:16:35 - 24.04.21)
RSA-X-509: resulting cleartext doesn't match input
Original: 61 [..] 00
Decrypted: 02 [..] 00
RSA-PKCS: OK
2 errors

macgeneral on 27 Mar 2020

michaelweiser on 27 Mar 2020

👍2

My card (also 3B D2 18 00 81 31 FE 58 C9 03 16) exhibits signing errors with 0.20.0 as well. Can't test #1987 due to #1995, ah yak shaving!

saper on 30 Mar 2020

Join the #1987 club. You card says: ManufactureID "Atos IT Solutions and Services GmbH" I don't believe anyone else has a similar card. With its one set of problems.

dengert on 31 Mar 2020

🚀1

Fixed by #1987, now in master.