Opensc: Minidriver is not loaded for Gnuk smart card

[me21]

Problem Description

I have a problem similar to https://github.com/OpenSC/OpenSC/issues/160, but in the current OpenSC version (0.20.0). My Gnuk device uses stable 1.0 firmware version. The driver for Gnuk smart card is not installed. My OS is Windows 7 x64. OpenSC framework is installed and there is corresponding entry under Calais\SmartCards registry path. ATR bytes are correct (I compared the output of certutil -scinfo with registry contents). What am I missing?

Steps to reproduce

I installed the OpenSC framework and plugged in my Gnuk token. The smart card is not recognized, Windows tried to install the driver from Windows Update but failed.

Logs

This looks like some OS configuration issue to me, but I could collect some logs if needed.

[frankmorgner]

opensc recognizes your card? opensc-tool -n -a?

For OpenSC, you need to install the installer distributed on Github, we're not listed in the update store.

[me21]

opensc-tool says

Using reader with a card: VMware Virtual USB CCID 0
3b:da:11:ff:81:b1:fe:55:1f:03:00:31:84:73:80:01:80:00:90:00:e4
Gnuk v1.0.x (OpenPGP v2.0) (FFFE 52FF6F06)

Yes, I took the installer from Github.

[frankmorgner]

does your token have any keys on it?

pkcs15-tool --short -D

[me21]

Using reader with a card: VMware Virtual USB CCID 0
PKCS#15 Card [OpenPGP card]:
        Version        : 0
        Serial number  : fffe52ff6f06
        Manufacturer ID: OpenPGP project
        Language       :
        Flags          : PRN generation, EID compliant
Card has 3 Authentication object(s).
        PIN  ID:02  Ref:0x02  AuthID:03  Path:3f00  Tries:3  User PIN
        PIN  ID:01  Ref:0x01  AuthID:03  Path:3f00  Tries:3  User PIN (sig)
        PIN  ID:03  Ref:0x03  Path:3f00  Tries:3  Admin PIN
Card has 3 Private key(s).
        RSA[2048]  ID:01  Ref:0x00  AuthID:01
             Signature key      [0x20C, sign, signRecover, nonRepudiation]
        RSA[2048]  ID:02  Ref:0x01  AuthID:02
             Encryption key     [0x22, decrypt, unwrap]
        RSA[2048]  ID:03  Ref:0x02  AuthID:02
             Authentication key [0x222, decrypt, unwrap, nonRepudiation]
Card has 3 Public key(s).
        RSA[2048]  01  Ref:0x00  Signature key      [0xC0, verify, verifyRecover
]
        RSA[2048]  02  Ref:0x00  Encryption key     [0x11, encrypt, wrap]
        RSA[2048]  03  Ref:0x00  Authentication key [0x51, encrypt, wrap, verify
]
Card has 0 Certificate(s).
Card has 0 Data object(s).

[frankmorgner]

in order to use your card for the typical minidriver use cases, you need a certificate...

what's the output of

set OPENSC_DEBUG=3
certutil -scinfo

[me21]

I will prepare a certificate and upload it to the card. Then I will post the output of the commands you've given.
But is the driver installation issue related to the absence of the certificate?

[me21]

OK, new output from pkcs15-tool --short -D after uploading the certificate:

Using reader with a card: VMware Virtual USB CCID 0
PKCS#15 Card [OpenPGP card]:
        Version        : 0
        Serial number  : fffe52ff6f06
        Manufacturer ID: OpenPGP project
        Language       :
        Flags          : PRN generation, EID compliant
Card has 3 Authentication object(s).
        PIN  ID:02  Ref:0x02  AuthID:03  Path:3f00  Tries:3  User PIN
        PIN  ID:01  Ref:0x01  AuthID:03  Path:3f00  Tries:3  User PIN (sig)
        PIN  ID:03  Ref:0x03  Path:3f00  Tries:3  Admin PIN
Card has 3 Private key(s).
        RSA[2048]  ID:01  Ref:0x00  AuthID:01
             Signature key      [0x20C, sign, signRecover, nonRepudiation]
        RSA[2048]  ID:02  Ref:0x01  AuthID:02
             Encryption key     [0x22, decrypt, unwrap]
        RSA[2048]  ID:03  Ref:0x02  AuthID:02
             Authentication key [0x222, decrypt, unwrap, nonRepudiation]
Card has 3 Public key(s).
        RSA[2048]  01  Ref:0x00  Signature key      [0xC0, verify, verifyRecover
]
        RSA[2048]  02  Ref:0x00  Encryption key     [0x11, encrypt, wrap]
        RSA[2048]  03  Ref:0x00  Authentication key [0x51, encrypt, wrap, verify
]
Card has 1 Certificate(s).
        Path:3f007f21  ID:03
Card has 0 Data object(s).

Output from set OPENSC_DEBUG=3 certutil -scinfo:

Диспетчер ресурсов смарт-карт (Microsoft) работает.
Текущее состояние устройства/карты:
Устройства чтения: 1
  0: VMware Virtual USB CCID 0
--- Устройство чтения: VMware Virtual USB CCID 0
--- Состояние: SCARD_STATE_PRESENT | SCARD_STATE_UNPOWERED
--- Состояние: Карта доступна для использования.
---   Карта:
---    ATR:
        3b da 11 ff 81 b1 fe 55  1f 03 00 31 84 73 80 01   ;......U...1.s..
        80 00 90 00 e4                                     .....


=======================================================
Анализ карты в устройстве чтения: VMware Virtual USB CCID 0
SCardGetCardTypeProviderName: Не удается найти указанный файл. 0x2 (WIN32: 2)
Не удается получить имя поставщика для SCardGetCardTypeProviderName: Не удается
найти указанный файл. 0x2 (WIN32: 2)
Не удается получить имя поставщика для
--------------===========================--------------

Готово.
CertUtil: -SCInfo команда НЕ ВЫПОЛНЕНА: 0x2 (WIN32: 2)
CertUtil: Не удается найти указанный файл.

Which is translated via Google Translate to:

The Microsoft Smart Card Resource Manager is running.
Current state of device / card:
Readers: 1
  0: VMware Virtual USB CCID 0
--- Reader: VMware Virtual USB CCID 0
--- State: SCARD_STATE_PRESENT | SCARD_STATE_UNPOWERED
--- Condition: The card is available for use.
--- Map:
--- ATR:
        3b da 11 ff 81 b1 fe 55 1f 03 00 31 84 73 80 01; ...... U ... 1.s ..
        80 00 90 00 e4 .....


================================================== =====
Card Analysis in Reader: VMware Virtual USB CCID 0
SCardGetCardTypeProviderName: The specified file cannot be found. 0x2 (WIN32: 2)
Cannot get provider name for SCardGetCardTypeProviderName: Unable
find the specified file. 0x2 (WIN32: 2)
Can't get vendor name for
-------------- =========================== --------- -----

Done.
CertUtil: -SCInfo command NOT EXECUTED: 0x2 (WIN32: 2)
CertUtil: The specified file cannot be found.

[frankmorgner]

can you paste the registry contents of Calais\SmartCards for this ATR? It's possible that there are multiple matching entries (not only from OpenSC!). Please check whether the referenced OpenSC-DLL is present on your hard driver.

[me21]

I have found only one match. The DLL file is present.

SmartCards.txt

[dengert]

"ATR"    =hex:3b,da,11,ff,81,b1,fe,55,1f,03,00,31,84,73,80,01,80,00,90,00,e4
"ATRMask"=hex:ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,ff,ff,00

Last byte of mask does not look correct. Should be ff or E4.

[me21]

Both these variants cause no card detected at all. With last byte equal to 00, Windows at least recognizes the card and tries to install a driver, but fails.

[me21]

In Windows System Event Log, there are the following events:

Last byte of ATRMask is FF:
Source is Smart Card Service, event code 610: Smart card reader "VMware Virtual USB CCID 0" rejected IOCTL 0x313520: Invalid function .. If the error persists, the smart card or smart card reader may not be working properly.
Source is WudfUsbccidDrv, event code 6: Invalid data. Name: VendorIoctl, Value: 0x313520

With last byte of ATRMask equal to 00, there are no such messages.

[me21]

I've managed to generate debug log, here it is:
opensc-debug.zip

[me21]

Oh, I've noticed that OpenSC tools actually do work with the card, even though it isn't shown in the Windows Device Manager! So it's now down to displaying problem.
To sum up, the last byte of ATRMask for Gnuk should be updated to FF.

[me21]

I've proceeded to setting up EIDAuthenticate to log into Windows using smart card, but when I enter PIN on the login screen, I get a notification that there's an error in communication with the smart card.
Should I open new issue about that here, or go to EIDAuthenticate support first?

[frankmorgner]

I think eidauthenticate uses the pkcs11 module, right? If so, try pkcs11-tool --login --test

[frankmorgner]

please give me a quick feedback if https://github.com/OpenSC/OpenSC/pull/2159 fixes your problem then we can include it in the upcoming release. Note that you can get MSIs by navigating to the AppVeyor build artifacts

[me21]

I think eidauthenticate uses the pkcs11 module, right? If so, try pkcs11-tool --login --test

Using slot 0 with a present token (0x0)
Logging in to "OpenPGP card (User PIN)".
Please enter User PIN: C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (Encryption key)  -- can't be used for signature, skipping
  testing key 1 (Authentication key)
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
  testing key 1 (Authentication key) with 1 mechanism
    RSA-PKCS: OK
Verify (currently only for RSA)
  testing key 0 (Encryption key) -- can't be used to sign/verify, skipping
  testing key 1 (Authentication key) with 1 mechanism
    RSA-PKCS: OK
Decryption (currently only for RSA)
  testing key 0 (Encryption key)
    RSA-PKCS: OK
  testing key 1 (Authentication key)
    RSA-PKCS: error: PKCS11 function C_Decrypt failed: rv = CKR_GENERAL_ERROR (0
x5)
Aborting.

[frankmorgner]

Since you've put the certificate on the card afterwards, this could have to do with the certificate that's not correctly associated with the token. you could try to re-initialize the token (without the certificate). Can you generate a log of pkcs11-tool?

[me21]

Should I re-initialize the token, NOT put the certificate on it, and run pkcs11-tool again? Or re-initialize the token and put the certificate on it immediately?

you can get MSIs by navigating to the AppVeyor build artifacts

I couldn't find full win64 installer in the artifacts. However, one build job has failed. Is it possible to rerun it?

[frankmorgner]

Please try without the certificate to exclude any mistakes with that.

try https://ci.appveyor.com/project/LudovicRousseau/opensc/builds/36418909/job/yas6w3m5crwqqjmm/artifacts

[dengert]

Also see if Windows has cached a copy of the certificate with the problem, and remove it.
control panel ->internet options->content->certificates->personal

[dengert]

Have not used Windows 7 in years, but you may need both 32 and 64 bit versions of OpenSC.
try
https://ci.appveyor.com/project/LudovicRousseau/opensc/builds/36418909/job/mqbb10lcboe646m9/artifacts

[me21]

It's the same output without certificate (I've also deleted a copy of the certificate in Windows certificate store).

[frankmorgner]

OK, this looks more complicated thatn I've originally thought...

please generate a debug log with the modified version of opensc above

set OPENSC_DEBUG=3
pkcs11-tool --test --login

[me21]

By the way, the modified version works out of the box regarding the card detection. No more manual registry editing is needed.

[frankmorgner]

... but both certutil and pkcs11-tool don't work?!

[me21]

opensc-debug-certutil.zip
opensc-debug-pkcs11.zip

No, certutil -scinfo works when the minidriver is installed:

The Microsoft Smart Card Resource Manager is running.
Current state of device / card:
Readers: 1
  0: VMware Virtual USB CCID 0
--- Reader: VMware Virtual USB CCID 0
--- State: SCARD_STATE_PRESENT
--- Condition: The card is available for use.
--- Card: Gnuk v1.0.x (OpenPGP v2.0), OpenPGP
--- ATR:
        3b da 11 ff 81 b1 fe 55 1f 03 00 31 84 73 80 01; ...... U ... 1.s ..
        80 00 90 00 e4 .....


================================================== =====
Card Analysis in Reader: VMware Virtual USB CCID 0

-------------- =========================== --------- -----
================ Certificate 0 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = OpenSC CSP
Key container = e9e39303-ce51-c6b7-72ce-042ed10255d5

Reader AT_SIGNATURE Certificate Not Received: VMware Virtual USB CCI
D 0
Missing AT_KEYEXCHANGE key for reader: VMware Virtual USB CCID 0


-------------- =========================== --------- -----
================ Certificate 1 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = OpenSC CSP
Key container = 027bdac1-e7b5-2c05-f39e-6d620bc297ba [The container used
default]

Missing AT_SIGNATURE key for reader: VMware Virtual USB CCID 0
Reader AT_KEYEXCHANGE certificate not received: VMware Virtual USB C
CID 0

-------------- =========================== --------- -----
================ Certificate 2 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = OpenSC CSP
Key container = 3c952494-438b-41ef-2dcd-221b08051c5c

Missing AT_SIGNATURE key for reader: VMware Virtual USB CCID 0
Reader AT_KEYEXCHANGE certificate not received: VMware Virtual USB C
CID 0

-------------- =========================== --------- -----
================ Certificate 0 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = Microsoft Smart Card Key Storage Provider
Key container = e9e39303-ce51-c6b7-72ce-042ed10255d5

No certificate received for reader: VMware Virtual USB CCID 0

-------------- =========================== --------- -----
================ Certificate 1 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = Microsoft Smart Card Key Storage Provider
Key container = 027bdac1-e7b5-2c05-f39e-6d620bc297ba

No certificate received for reader: VMware Virtual USB CCID 0

-------------- =========================== --------- -----
================ Certificate 2 ================
--- Reader: VMware Virtual USB CCID 0
--- Card: Gnuk v1.0.x (OpenPGP v2.0)
Provider = Microsoft Smart Card Key Storage Provider
Key container = 3c952494-438b-41ef-2dcd-221b08051c5c

No certificate received for reader: VMware Virtual USB CCID 0

-------------- =========================== --------- -----

Done.
CertUtil: -SCInfo - command completed successfully.

Could it be that Gnuk token implementation lacks some required features?

[dengert]

I note from one of you debug logs, your certificate issued on 2020-11-19 13:45:15 UTC does not have a keyUsage, which might be a problem. It is also self signed. So may need to be trusted Root Cert Auth?

Are you sure the public and private keys match?

The Cetutil is complaining there are no certificates.

[dengert]

Do you have a Windows 10? It might work differently then Windows 7.

[me21]

I note from one of you debug logs, your certificate issued on 2020-11-19 13:45:15 UTC does not have a keyUsage, which might be a problem. It is also self signed. So may need to be trusted Root Cert Auth?

Are you sure the public and private keys match?

I was following a tutorial here: https://github.com/djozsef/openpgp-docs/blob/master/Setting%20up%20EIDAuthenticate%20with%20OpenPGP%20card.md. Is it possible that some steps are missing there?
How do I check that public and private keys match? Some days ago, I encrypted/signed a file with this Gnuk token and later decrypted/checked the signature. I did this with Gpg4win software. The procedure was successful, so I guess the keys must match. However, several cycles of keys regeneration have happened since then.

The Cetutil is complaining there are no certificates.

Yes, @frankmorgner asked me to run the commands without a certificate on the card. So I've generated the keys, but didn't generate a certificate.

Do you have a Windows 10? It might work differently then Windows 7.

I can install Windows 10 on a VM, I just had one ready with Windows 7. Perhaps some time next week.

[frankmorgner]

Maybe @alex-nitrokey or @hongquan can have a look since I'm not too familiar with Gnuk

[me21]

Are you sure the public and private keys match?

How do I make sure they match?

[dengert]

pkcs11-tool --test --login tests keys using the public key and private key on card. and both work as expected.
except for which may be expected result, or an error of mismatched public keys.

testing key 1 (Authentication key)
    RSA-PKCS: error: PKCS11 function C_Decrypt failed: rv = CKR_GENERAL_ERROR (0x5)

You said: "OK, new output from pkcs15-tool --short -D after uploading the certificate:"
So you can use pkcs11-tool or pkcs15-tool to get the public key and the certificate and compare the output The RSA modules is in both.

With pkcs11 the cert, public key and private key all have the same ID. Did you load the certificate with the wrong ID.

PKCS11 can work without certificates. Windows expects certificates and stores then in cert store so it can look up a certificate, get the Key container and tell user to insert the card with the matching private key.

[me21]

Okay, I'm stuck.

Here's what I did step by step:

1. I've generated a key and a certificate for my local CA:
   c:\OpenSSL-Win64\bin\openssl genrsa -out ca.key 2048c:\OpenSSL-Win64\bin\openssl req -new -x509 -key ca.key -out ca.crt -days 7300
2. I've imported CA certificate to the trusted root certificates in Windows.
3. I've generated a certificate request using the Authentication key (key number 3) from the Gnuk token:
   gpgsm --armor --output azarubkin.csr --gen-key
4. I've signed & created the certificate with my local CA:
   c:\OpenSSL-Win64\bin\openssl x509 -req -in azarubkin.csr -CA ca.crt -CAkey ca.key -CAserial ca.srl -out azarubkin.crt -days 3650
5. I've converted the certificate to DER format:
   c:\OpenSSL-Win64\bin\openssl x509 -outform der -in azarubkin.crt -out azarubkin.der
6. I've uploaded the certificate to the Gnuk token. I've checked that the public key in the certificate matches the public key #3 from the card (pkcs15-tool --read-public-key 3). It does.
7. I'm attaching the output of certutil -scinfo. It shows no error as far as I can tell. It gets the certificate from the card and builds the certificates trust chain.

However, EIDAuthenticate lets me choose this certificate for associating with current Windows user, but in the end shows that there's some error during the test. And pkcs11-tool --login --test still gives the same error as above (CKR_GENERAL_ERROR during decryption testing for authentication key).

I'm closing this issue because the primary issue with minidriver has been fixed in the new OpenSC version, but if anyone knows why the error happens, I'd be grateful.
certutil-scinfo.txt

[dengert]

EIDAuthenticate - User%20Documentation says:
"Like the Active Directory smart card logon, the certificate MUST have the “Smart card logon EKU” and
provide encryption services. However this behavior can be altered by modifying the security policy"

Google for: openssl smart card login

https://unmitigatedrisk.com/?p=247
https://wiki.samba.org/index.php/Samba_AD_Smart_Card_Login

In one of my test scripts to generate PIV card certificates that will work in AD (I have not used AD in last 6 years) might help too it has sections for authentication, sign and decrypt certificates. "@@string@@" are replaced by sed before calling openssl req -config <path to modified openssl.conf>
genreq.openssl.conf.txt

[me21]

To whom it may concern in the future: the cause for pkcs11-tool --login --test command error was lack of Manage Security Environment command handling in the Gnuk token firmware. I have patched it, added support for that command, and I was able to log into my Windows machine using EIDAuthenticate and the generated certificate stored on the Gnuk token.

[frankmorgner]

would you mind showing us your changes or making a pull request?

[alex-nitrokey]

The fix of commit 98beb86 will break support for Gnuk devices with newer firmware iirc.

The MSE feature should not be used for Gnuk devices anyway, as they do not support it. Consequently, the cause is somewhere else. I am a bit confused, as the MSE is only used for OpenPGP Card >v3 or >v3.3

So knowing what @me21 had done would be appreciated for sure.

I do remember that I had some problem with the test routines for OpenPGP Cards but never had some time to fix it, so maybe I should have a look at it again :thinking:

[Jakuje]

Right. My ATR is 3b:da:11:ff:81:b1:fe:55:1f:03:00:31:84:73:80:01:80:05:90:00:e1 so the above fix is certainly not correct.

[me21]

I've added MSE feature support in Gnuk firmware, setting the reported OpenPGP card version to 3.3. It helped to pass pkcs11-tool --login --test checks and to login to Windows with the certificate on Gnuk token.

Here is the commit in my Gnuk repo fork: https://github.com/me21/gnuk/commit/f8a41013617ad49d4d641b4922cf36669d853691

I'm not ready to submit a pull request, because this commit is between others, for adding USB interrupt endpoint to Gnuk firmware version 1.0 (to insert/remove smart card at will), for adding PlatformIO build system (to be able to easily build the firmware on Windows, but actually PlatformIO is cross-platform), but I would be happy if it proves useful for someone else too.

I know it's most probably a dirty quick fix, because there are many more differences between OpenPGP spec v2 and v3.3, but it works.

Regarding this issue, so ATRMask was indeed correct before the fix - the 4th byte from the end and the last one could change. The question is, why the card reply was not accepted when the last byte of ATRMask was 00?