October 2015 - SmartcardServices-Users

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 25 Oct '15

25 Oct '15

Hi, Yes. I have been reading through the Yubico PIV tools code as well (although I have not yet tried to add the CCC file).... In particular, I have been looking at https://github.com/Yubico/yubico-piv-tool/blob/master/tool/yubico-piv-tool.c (line 1346 in the status display). Where it seems to report a missing CHUID as an "interesting fact" rather than a corrupt PIV card... Windows uses it to produce a persistent CSP container name, so you end up with weird problems if the CHUID is missing. It looks like the "-action setchuid" was a bug fix for that. I am thinking that rather than a load of "-action setThisAndThat" options, the piv tool would be better off with an "-action initialize" option that adds all the required PIV files. Where "required" from where I am sitting is CCC and CHUID -- PIV experts can feel free to add more. I am also probably going to propose these patches for the PIV tool: (1) reword the status() function to indicate that a missing CCC or CHUID is a somewhat serious problem. (2) an isInitialized() method that checks to see whether the Yubikey is completely blank (i.e. - returns true if there is one of: a certificate, or a CCC, or a CHUID). (3) make the tool to complain a bit if you try to do other things while isInitialized() returns false Whether we go for a Smart Card Services patch, or a yubico-piv-tool patch (or ideally both), is probably something that you guys and the Yubico engineers need to discuss. The patch for SCS is at least relatively "low risk", given that I have only needed to add an: if (xxx) {currentBehaviour} else {do something new}. Regards, David L P.S. Is there a good tool in OpenSC that checks to see if a card PIV is ok? i.e. something that can use for PIV card compliance unit testing? > Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] > > It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it. > > In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly. > > One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package.

2 1

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 25 Oct '15

25 Oct '15

Hi Shawn, Thanks! I’m in contact with an engineer from Yubico, so I’ll raise a bug next week when they have had a chance to look at it. It could just be a bug in their PIV provisioning tools. At the very least they shouldn’t be returning "Status: OK" if mandatory files are missing. In any case, my current patch is to probe for the existence of the CCC, and if that isn’t found, use a HEX string derived from the CHUID instead (PIV cards missing both probably won’t work anywhere!). const size_t sz = sizeof(oidCardCapabilityContainer); if (getDataExists(oidCardCapabilityContainer, sz, sDescripCardCapabilityContainer)) { secdebug( "probe", "Look up Card Capability Container"); byte_string cccOid((const unsigned char *)oidCardCapabilityContainer, oidCardCapabilityContainer + sizeof(oidCardCapabilityContainer)); byte_string cccdata; /* Since probe is called before establish, securityd has not passed us the cache directory yet, so we don't try to cache anything right now */ const bool allowCaching = false; getDataCore(cccOid, "CCC", false, allowCaching, cccdata); PIVCCC ccc(cccdata); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", ccc.hexidentifier().c_str()); } else { secdebug( "probe", "Look up CHUID"); byte_string chuidOid((const unsigned char *)oidCardHolderUniqueIdentifier, oidCardHolderUniqueIdentifier + sizeof(oidCardHolderUniqueIdentifier)); byte_string chuidData; const bool allowCaching = false; getDataCore(chuidOid, "CHUID", false, allowCaching, chuidData); CssmData data; data.Data = &chuidData[0]; data.Length = MAX(chuidData.size(), TOKEND_MAX_UID/2 - 6); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", data.toHex().c_str()); } You also have a couple of “warnings as errors” fixes: this one at least is genuine in PIVToken::getDataExists if(rx & 0xFF00 == SCARD_BYTES_LEFT_IN_SW2) return true; /* More bytes left */ should be: if((rx & 0xFF00) == SCARD_BYTES_LEFT_IN_SW2) return true; /* More bytes left */ Just as a note: http://smartcardservices.macosforge.org seems to be down at the moment. Could you point me at your issue tracking web-page? Regards, David L > Cc: "SmartCard Services-Users" <smartcardservices-users(a)lists.macosforge.org> > Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] > > David, > If you haven’t already, can you submit a tick4et for this and I’ll see what I can do. > > - Shawn

2 1

Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 24 Oct '15

24 Oct '15

Hi, I have been doing a little bit of debugging with the YubiKey Neo PIV card USB dongles on MacOSX (http://www.amazon.com/Yubico-Y-072-YubiKey-NEO/dp/B00LX8KZZ8/ref=sr_1_1? ie=UTF8&qid=1445630304&sr=8-1&keywords=Yubikey+neo). It looks like they aren't 100% PIV compliant, and they are falling over in PIVToken.cpp::probe()... byte_string cccOid((const unsigned char *)oidCardCapabilityContainer, oidCardCapabilityContainer + sizeof(oidCardCapabilityContainer)); byte_string cccdata; getDataCore(cccOid, "CCC", false, true, cccdata); PIVCCC ccc(cccdata); They do not return the CardCapabilityContainer here (although interestingly enough the other ADPU calls do return certificates at this point!). You can reproduce this by running opensc-explorer and issuing: apdu 0 cb 3f ff 5 5c 3 5f c1 7 This returns 0x6a82 (file not found). This call, however: apdu 0 cb 3f ff 5 5c 3 5f c1 5 Returns the X509 certificate correctly. If I disable the probe call to GetDataCore for the CardCapabilityContainer, the device works correctly in Safari. I have reported the issue to Yubico, but I am interested to see if you have any recommendations as to how to patch this in TokenD. You have a "GetDataExists" method in there which would prevent the exception. I guess that you need a unique ID for the smart card in probe though (would the CHUID be an alternative choice - that works?) Let me know what you thing! DDD

2 1

OS X 10.11: add CCID-compliant device support
by Мироненко Евгений 15 Oct '15

15 Oct '15

Hi all, I wonder what is the best way to make CCID-compliant device work on OS X 10.11. The device is normally supported by libccid.dylib, but not listed in Info.plist. In pre-el-capitan era I used to patch Info.plist and add device description there. Now with SIP enabled patching cannot be performed. Is there any way of extending the list of devices supported by ifd-ccid.bundle? Or is putting another (custom) ifd-ccid.bundle to "/usr/local/libexec/..." the only thing I can do? Providing device support is expected to be performed during installation process on end-user machine, so disabling SIP is not the answer. Regards, Eugene Mironenko

2 1

Installer for OS X 10.11 crashes
by Maurice McNeil 13 Oct '15

13 Oct '15

Same problem as Nate describes Date: Mon, 12 Oct 2015 15:05:33 -0600 From: Nate Irwin <nate_irwin(a)nps.gov <mailto:nate_irwin@nps.gov>> To: "Burgin, Thomas (NIH/CIT) [C]" <thomas.burgin(a)nih.gov <mailto:thomas.burgin@nih.gov>> Cc: Smart Card Services-Users <smartcardservices-users(a)lists.macosforge.org <mailto:smartcardservices-users@lists.macosforge.org>>, "Shawn A. Geddis" <geddis(a)apple.com <mailto:geddis@apple.com>> Subject: Re: [SmartcardServices-Users] Installer for OS X 10.11 crashing Message-ID: <36221D25-4507-4D62-A5F9-519E76B408F3(a)nps.gov <mailto:36221D25-4507-4D62-A5F9-519E76B408F3@nps.gov>> Content-Type: text/plain; charset="utf-8" Law Number XIII: There are many highly successful businesses in the United States. There are also many highly paid executives. The policy is not to intermingle the two.

1 1

Installer for OS X 10.11 crashing
by Nate Irwin 12 Oct '15

12 Oct '15

Hello, I was happy to see a new installer for 10.11 posted, but I can’t get it to complete without crashing. I’ve tried downloading multiple times, clearing cache, etc. Any suggestions? I can post the crash report if it would be helpful. Nate Irwin

3 3

Initialize smartcard
by Jorgensen, Will A 12 Oct '15

12 Oct '15

I’m working on getting Gemalto IDPrime .NET cards working with their IDBridge K30 token card reader. As far as I can tell, the reader is working. I am able to read other smart cards, just not the Gemalto card. When connecting the Gemalto card I see APDU logs attempting to read data from the card however I’m getting a generic file not found error message. I believe the issue is that the smart card itself is not in PKCS11 format. It was initialized on a windows computer running Verasec k2 tool (http://versatilesecurity.com/versatilesecurity-vsec-cms-k.php) I have confirmed that the card cannot be read by other systems (linux) that are working correctly with other pkcs11 cards. What I don’t know how to do is initialize the card and upload certificates so that it conforms to pkcs11. Is there a way to do this from the Mac? I know how to request the certificates from the PKI on the Mac, just don’t know how to get the key pair onto the smart card. Any help you can offer would be appreciated.

2 1

com.apple.ctkpcscd - refresh /usr/local/libexec/SmartCardServices/drivers
by Lamb, John (NIH/NCI) [C] 08 Oct '15

08 Oct '15

All, 1. In OS X 10.11; I was wondering if there was a way to gracefully refresh com.apple.ctkpcscd (child process of securityd, seems to be a framework launched by /System/Library/LaunchDaemons/ctkd.plist) to detect new drivers in /usr/local/libexec/SmartCardServices/drivers to avoid needing a restart. A launchctl unload/load doesn’t do the trick, and (i know this is dumb, but i was exploring the behavior) a killall securityd doesn’t either. 2. Is there an equivalent mechanism in OS X 10.7->10.10? If there isn’t a public way to do this, we’ll deal with the restart happily. Thanks! John Lamb (Contractor) SRA International National Cancer Institute Center for Biomedical Informatics and Information Technology 9609 Medical Center Drive Rockville, MD 20850 lambje2(a)mail.nih.gov<http://lambje2@mail.nih.gov>

2 1

CAC with OS X Yosemite
by William Guthrie (wiguthri) 02 Oct '15

02 Oct '15

I've downloaded and installed the latest tokenend for OS X Yosemite. Does anyone have any documentation on what configuration is required to get CAC login working on OS X Yosemite. I've been using an old document from Apple from 2006 but it is out of date in parts and I cannot find anything more recent. I want to be able to login to the machine with a CAC card and also to leverage that card for applications on the machine which support SAML SSO authentication. Thanks in advance for any assistance. Regards William,

1 0

Re: [SmartcardServices-Users] [SmartcardServices-Dev] Signed Installer posted for OS X El Capitan v10.11
by Shawn Geddis 01 Oct '15

01 Oct '15

On Oct 1, 2015, at 11:44 AM, Thomas Harning Jr. <harningt(a)gmail.com> wrote: > > Thanks. Is there any documentation available that shows where the new tokend installations should go? > > Does this installation location happen to work for older OSX versions, or is the location only scanned by OSX 10.11? If this location is only for newer versions of OSX, this complicates things for users that install an application on 10.10 or earlier and come to OSX 10.11 to discover their TokenD was obliterated. > > Smart card development for OSX seems to be a particularly dark art. By chance are there any samples of TokenD modules written using Apple's new blessed token API - the asynchronous nature of the new API seems to be in conflict with TokenD API specifications. Thomas, • The Installer Download Page, the Installer and the man page for SmartCardServices notes the new tokend installation path for OS X El Capitan v10.11. • The Path [/Library/Security/tokend/ ] is new for OS X El Capitan v10.11 and higher and is not supported on older versions of OS X v10.x. • Location of Tokend bundles does not affect use by Applications, since this is completely abstracted away. • There currently is no code samples or reference implementations for CryptoTokenKit Clients from Apple nor yet from the project here. • TokenD API specifications ? There never was any API specification to Apple’s knowledge. What reference are you making ? See man page for SmartCardServices…. $ man SmartCardServices SMARTCARDSERVICES(7) BSD Miscellaneous Information Manual SMARTCARDSERVICES(7) NAME SmartCardServices -- overview of smart card support DESCRIPTION SmartCardServices is a set of components which add native support for smart cards to OS X. Supported smart cards appear as separate keychains. A Tokend module for each smart card you wish to use must be installed in /Library/Security/tokend USB SMART CARD READER DRIVERS OS X has built-in support for USB CCID class-compliant smart card read- ers. For other readers, install the reader driver in /usr/local/libexec/SmartCardServices/drivers. Each driver is a bundle. The bundle contains an XML file Info.plist which contains the device's USB vendor ID and product ID. For detailed description of the plist for- mat and how to write a reader driver, see http://pcsclite.alioth.debian.org/api/group__IFDHandler.html SMART CARD APDU LOGGING It is possible to turn on logging for smart cards. Logging is turned on by setting the global preference: sudo defaults write /Library/Preferences/com.apple.security.smartcard Logging -bool yes After a smart card reader is connected (or after reboot) all operations including contents of sent and received APDU messages are then logged into the system log. Logging uses the facility com.apple.security.smart- card.log so it is possible to set up filtering of these logs into custom targets (see asl.conf(5)) To avoid security risks that could occur if logging is turned on indefi- nitely, the logging setting is one-shot - it must be turned on by the command above to start logging again with a new reader. This includes unplugging and replugging the same reader. SEE ALSO sc_auth(8), defaults(1), asl.conf(5), ssh-keychain(8) Mac OS X August 5, 2014 Mac OS X - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0