- SmartcardServices-Users - lists.macosforge.org

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by Beck, Keith M CDR NAVSEA, AEGISTECHREP 26 Oct '15

26 Oct '15

By definition, there are 7 mandatory objects to be a PIV (Card Capability Container (CCC) and Card Holder Unique Identifier (CHUID) are two of the seven). If you don't have all seven, you have the risk that the card will fail something that is expected as a core capability of all PIV cards. SP 800-73-4, page 28 has the list of mandatory, conditional, and optional card application data objects. http://csrc.nist.gov/groups/SNS/piv/standards.html Keith ---------------------------------------------------------------------- Date: Sun, 25 Oct 2015 10:42:51 +0100 From: david.lloyd(a)fsmail.net To: Uri Blumenthal <uri(a)mit.edu> Cc: Shawn Geddis <geddis(a)icloud.com>, SmartCard Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] Message-ID: <17361481.1771445766171121.JavaMail.www@wwinf3714> Content-Type: text/plain; charset=UTF-8 ... I am thinking that rather than a load of "-action setThisAndThat" options, the piv tool would be better off with an "-action initialize" option that adds all the required PIV files. Where "required" from where I am sitting is CCC and CHUID -- PIV experts can feel free to add more. ... Regards, David L P.S. Is there a good tool in OpenSC that checks to see if a card PIV is ok? i.e. something that can use for PIV card compliance unit testing? > Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] > > It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it. > > In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly. > > One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package.

1 0

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 26 Oct '15

26 Oct '15

Hi, I have raised an issue against the Yubico-Piv-tool https://github.com/Yubico/yubico-piv-tool/issues/33 - looking at the posts it seems like the consensus is to "Add an initialize parameter that sets everything up". There is no need for error detection or PIV specification compliance testing at this stage, although it would obviously be a nice-to-have feature for OpenSC in future. I have also tried to raise a ticket against SmartcardServices/tokend, but it looks as though although the website is now back up, the "New Ticket" feature is still broken. My text is below - I have highlighted a list of potential issues with the patch that should be reviewed be the PIV/TokenD experts although I don't think any of them are particularly important. Title: PIVToken.cpp needs to be more flexible if the CCC is not on a PIV Card [Yubikey NEO] The Yubikey NEO PIV tool is not including the "Card Capability Container" file, which is in violation of the PIV specification. This causes the PIV.tokend tool to fail as the PIVToken::probe() function (line 265) assumes that it can access this to structure to generate the Unique name (PIV-<hexstring>) based on the card identifier. Current behaviour: the function uses GetDataCore() that throws an exception when the file is missing, causing Probe() to fail and the card is ignored. Proposed behaviour: In the case that the CCC is not available the code uses the CHUID to generate a unique name. This is actually what Windows appears to do in its PIV driver. I am able to compile and test any code changes. I also have access to the NIST PIV card set for regression (if needed). Here is my proposed patch. Note that: (1) although the CCC object is cached, it does not appear to be used anywhere else in the code. Basic functionality in Safari has been confirmed. (2) existing cards with a CCC have unchanged behaviour (beyond the extra step of checking for the CCC first). (3) an alternative is to catch the exception when the CCC is missing, rather than to probe for it (4) the patch does not parse the CHUID to extract the GUID, it uses the whole file as a hex string. This needs to be checked as the FASN would be revealed. A SHA512 may be an alternative to writing a parser. (5) If both CCC and CHUID are missing the card will not work (similar to Windows), it would be possible to hardcode a "PIV-Unknown" UID in this case. if (!identify()) doDisconnect = true; else { #ifndef _USEFALLBACKTOKENUID const size_t sz = sizeof(oidCardCapabilityContainer); if (getDataExists(oidCardCapabilityContainer, sz, sDescripCardCapabilityContainer)) { secdebug( "probe", "Look up Card Capability Container"); byte_string cccOid((const unsigned char *)oidCardCapabilityContainer, oidCardCapabilityContainer + sizeof(oidCardCapabilityContainer)); byte_string cccdata; /* Since probe is called before establish, securityd has not passed us the cache directory yet, so we don't try to cache anything right now */ const bool allowCaching = false; getDataCore(cccOid, "CCC", false, allowCaching, cccdata); PIVCCC ccc(cccdata); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", ccc.hexidentifier().c_str()); } else { secdebug( "probe", "Look up CHUID"); byte_string chuidOid((const unsigned char *)oidCardHolderUniqueIdentifier, oidCardHolderUniqueIdentifier + sizeof(oidCardHolderUniqueIdentifier)); byte_string chuidData; const bool allowCaching = false; getDataCore(chuidOid, "CHUID", false, allowCaching, chuidData); CssmData data; data.Data = &chuidData[0]; data.Length = MAX(chuidData.size(), TOKEND_MAX_UID/2 - 6); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", data.toHex().c_str()); } secdebug( "probe", "tokenUid is %s", tokenUid); #else There is a discussion of the tokens issue here: https://lists.macosforge.org/pipermail/smartcardservices-users/2015-October… I have also opened an issue against the Yubikey PIV tool here:https://github.com/Yubico/yubico-piv-tool/issues/33 The general sentiment is (1) that the Yubikey PIV tool should have an "initialize" option that installs all the mandatory files for novice users. (2) As the tokend code is only using this for a card identifier, it would be highly desirable for it to be more flexible in the case that the file is missing. Regards, David L

1 0

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 25 Oct '15

25 Oct '15

Hi, Yes. I have been reading through the Yubico PIV tools code as well (although I have not yet tried to add the CCC file).... In particular, I have been looking at https://github.com/Yubico/yubico-piv-tool/blob/master/tool/yubico-piv-tool.c (line 1346 in the status display). Where it seems to report a missing CHUID as an "interesting fact" rather than a corrupt PIV card... Windows uses it to produce a persistent CSP container name, so you end up with weird problems if the CHUID is missing. It looks like the "-action setchuid" was a bug fix for that. I am thinking that rather than a load of "-action setThisAndThat" options, the piv tool would be better off with an "-action initialize" option that adds all the required PIV files. Where "required" from where I am sitting is CCC and CHUID -- PIV experts can feel free to add more. I am also probably going to propose these patches for the PIV tool: (1) reword the status() function to indicate that a missing CCC or CHUID is a somewhat serious problem. (2) an isInitialized() method that checks to see whether the Yubikey is completely blank (i.e. - returns true if there is one of: a certificate, or a CCC, or a CHUID). (3) make the tool to complain a bit if you try to do other things while isInitialized() returns false Whether we go for a Smart Card Services patch, or a yubico-piv-tool patch (or ideally both), is probably something that you guys and the Yubico engineers need to discuss. The patch for SCS is at least relatively "low risk", given that I have only needed to add an: if (xxx) {currentBehaviour} else {do something new}. Regards, David L P.S. Is there a good tool in OpenSC that checks to see if a card PIV is ok? i.e. something that can use for PIV card compliance unit testing? > Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] > > It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it. > > In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly. > > One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package.

2 1

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 25 Oct '15

25 Oct '15

Hi Shawn, Thanks! I’m in contact with an engineer from Yubico, so I’ll raise a bug next week when they have had a chance to look at it. It could just be a bug in their PIV provisioning tools. At the very least they shouldn’t be returning "Status: OK" if mandatory files are missing. In any case, my current patch is to probe for the existence of the CCC, and if that isn’t found, use a HEX string derived from the CHUID instead (PIV cards missing both probably won’t work anywhere!). const size_t sz = sizeof(oidCardCapabilityContainer); if (getDataExists(oidCardCapabilityContainer, sz, sDescripCardCapabilityContainer)) { secdebug( "probe", "Look up Card Capability Container"); byte_string cccOid((const unsigned char *)oidCardCapabilityContainer, oidCardCapabilityContainer + sizeof(oidCardCapabilityContainer)); byte_string cccdata; /* Since probe is called before establish, securityd has not passed us the cache directory yet, so we don't try to cache anything right now */ const bool allowCaching = false; getDataCore(cccOid, "CCC", false, allowCaching, cccdata); PIVCCC ccc(cccdata); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", ccc.hexidentifier().c_str()); } else { secdebug( "probe", "Look up CHUID"); byte_string chuidOid((const unsigned char *)oidCardHolderUniqueIdentifier, oidCardHolderUniqueIdentifier + sizeof(oidCardHolderUniqueIdentifier)); byte_string chuidData; const bool allowCaching = false; getDataCore(chuidOid, "CHUID", false, allowCaching, chuidData); CssmData data; data.Data = &chuidData[0]; data.Length = MAX(chuidData.size(), TOKEND_MAX_UID/2 - 6); snprintf(tokenUid, TOKEND_MAX_UID, "PIV-%s", data.toHex().c_str()); } You also have a couple of “warnings as errors” fixes: this one at least is genuine in PIVToken::getDataExists if(rx & 0xFF00 == SCARD_BYTES_LEFT_IN_SW2) return true; /* More bytes left */ should be: if((rx & 0xFF00) == SCARD_BYTES_LEFT_IN_SW2) return true; /* More bytes left */ Just as a note: http://smartcardservices.macosforge.org seems to be down at the moment. Could you point me at your issue tracking web-page? Regards, David L > Cc: "SmartCard Services-Users" <smartcardservices-users(a)lists.macosforge.org> > Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo] > > David, > If you haven’t already, can you submit a tick4et for this and I’ll see what I can do. > > - Shawn

2 1

Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 24 Oct '15

24 Oct '15

Hi, I have been doing a little bit of debugging with the YubiKey Neo PIV card USB dongles on MacOSX (http://www.amazon.com/Yubico-Y-072-YubiKey-NEO/dp/B00LX8KZZ8/ref=sr_1_1? ie=UTF8&qid=1445630304&sr=8-1&keywords=Yubikey+neo). It looks like they aren't 100% PIV compliant, and they are falling over in PIVToken.cpp::probe()... byte_string cccOid((const unsigned char *)oidCardCapabilityContainer, oidCardCapabilityContainer + sizeof(oidCardCapabilityContainer)); byte_string cccdata; getDataCore(cccOid, "CCC", false, true, cccdata); PIVCCC ccc(cccdata); They do not return the CardCapabilityContainer here (although interestingly enough the other ADPU calls do return certificates at this point!). You can reproduce this by running opensc-explorer and issuing: apdu 0 cb 3f ff 5 5c 3 5f c1 7 This returns 0x6a82 (file not found). This call, however: apdu 0 cb 3f ff 5 5c 3 5f c1 5 Returns the X509 certificate correctly. If I disable the probe call to GetDataCore for the CardCapabilityContainer, the device works correctly in Safari. I have reported the issue to Yubico, but I am interested to see if you have any recommendations as to how to patch this in TokenD. You have a "GetDataExists" method in there which would prevent the exception. I guess that you need a unique ID for the smart card in probe though (would the CHUID be an alternative choice - that works?) Let me know what you thing! DDD

2 1

OS X 10.11: add CCID-compliant device support
by Мироненко Евгений 15 Oct '15

15 Oct '15

Hi all, I wonder what is the best way to make CCID-compliant device work on OS X 10.11. The device is normally supported by libccid.dylib, but not listed in Info.plist. In pre-el-capitan era I used to patch Info.plist and add device description there. Now with SIP enabled patching cannot be performed. Is there any way of extending the list of devices supported by ifd-ccid.bundle? Or is putting another (custom) ifd-ccid.bundle to "/usr/local/libexec/..." the only thing I can do? Providing device support is expected to be performed during installation process on end-user machine, so disabling SIP is not the answer. Regards, Eugene Mironenko

2 1

Installer for OS X 10.11 crashes
by Maurice McNeil 13 Oct '15

13 Oct '15

Same problem as Nate describes Date: Mon, 12 Oct 2015 15:05:33 -0600 From: Nate Irwin <nate_irwin(a)nps.gov <mailto:nate_irwin@nps.gov>> To: "Burgin, Thomas (NIH/CIT) [C]" <thomas.burgin(a)nih.gov <mailto:thomas.burgin@nih.gov>> Cc: Smart Card Services-Users <smartcardservices-users(a)lists.macosforge.org <mailto:smartcardservices-users@lists.macosforge.org>>, "Shawn A. Geddis" <geddis(a)apple.com <mailto:geddis@apple.com>> Subject: Re: [SmartcardServices-Users] Installer for OS X 10.11 crashing Message-ID: <36221D25-4507-4D62-A5F9-519E76B408F3(a)nps.gov <mailto:36221D25-4507-4D62-A5F9-519E76B408F3@nps.gov>> Content-Type: text/plain; charset="utf-8" Law Number XIII: There are many highly successful businesses in the United States. There are also many highly paid executives. The policy is not to intermingle the two.

1 1

Installer for OS X 10.11 crashing
by Nate Irwin 12 Oct '15

12 Oct '15

Hello, I was happy to see a new installer for 10.11 posted, but I can’t get it to complete without crashing. I’ve tried downloading multiple times, clearing cache, etc. Any suggestions? I can post the crash report if it would be helpful. Nate Irwin

3 3

Initialize smartcard
by Jorgensen, Will A 12 Oct '15

12 Oct '15

I’m working on getting Gemalto IDPrime .NET cards working with their IDBridge K30 token card reader. As far as I can tell, the reader is working. I am able to read other smart cards, just not the Gemalto card. When connecting the Gemalto card I see APDU logs attempting to read data from the card however I’m getting a generic file not found error message. I believe the issue is that the smart card itself is not in PKCS11 format. It was initialized on a windows computer running Verasec k2 tool (http://versatilesecurity.com/versatilesecurity-vsec-cms-k.php) I have confirmed that the card cannot be read by other systems (linux) that are working correctly with other pkcs11 cards. What I don’t know how to do is initialize the card and upload certificates so that it conforms to pkcs11. Is there a way to do this from the Mac? I know how to request the certificates from the PKI on the Mac, just don’t know how to get the key pair onto the smart card. Any help you can offer would be appreciated.

2 1

com.apple.ctkpcscd - refresh /usr/local/libexec/SmartCardServices/drivers
by Lamb, John (NIH/NCI) [C] 08 Oct '15

08 Oct '15

All, 1. In OS X 10.11; I was wondering if there was a way to gracefully refresh com.apple.ctkpcscd (child process of securityd, seems to be a framework launched by /System/Library/LaunchDaemons/ctkd.plist) to detect new drivers in /usr/local/libexec/SmartCardServices/drivers to avoid needing a restart. A launchctl unload/load doesn’t do the trick, and (i know this is dumb, but i was exploring the behavior) a killall securityd doesn’t either. 2. Is there an equivalent mechanism in OS X 10.7->10.10? If there isn’t a public way to do this, we’ll deal with the restart happily. Thanks! John Lamb (Contractor) SRA International National Cancer Institute Center for Biomedical Informatics and Information Technology 9609 Medical Center Drive Rockville, MD 20850 lambje2(a)mail.nih.gov<http://lambje2@mail.nih.gov>

2 1