<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
On Oct 25, 2015, at 5:42 , <a href="mailto:david.lloyd@fsmail.net" class="">david.lloyd@fsmail.net</a> wrote:<br class="">
<div>
<blockquote type="cite" class="">In particular, I have been looking at <a href="https://github.com/Yubico/yubico-piv-tool/blob/master/tool/yubico-piv-tool.c" class="">
https://github.com/Yubico/yubico-piv-tool/blob/master/tool/yubico-piv-tool.c</a> (line 1346 in the status display). Where it seems to report a missing <br class="">
<div class="">CHUID as an "interesting fact" rather than a corrupt PIV card... Windows uses it to produce a persistent CSP container name, so you end up with weird problems if the CHUID is missing. It
<br class="">
looks like the "-action setchuid" was a bug fix for that. <br class="">
</div>
</blockquote>
<div><br class="">
</div>
Yes, very likely.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">I am thinking that rather than a load of "-action setThisAndThat" options, the piv tool would be better off with an "-action initialize" option that adds all the required PIV files. Where "required" from where I am sitting is CCC and CHUID --
PIV experts can feel free to add more.<br class="">
</div>
</blockquote>
<div><br class="">
</div>
So far it seems that CCC and CHUID is what’s necessary and sufficient for minimal PIV compliance.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">I am also probably going to propose these patches for the PIV tool:<br class="">
(1) reword the status() function to indicate that a missing CCC or CHUID is a somewhat serious problem.<br class="">
</div>
</blockquote>
<div><br class="">
</div>
No, not a problem - just inability to work as a PIV.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class=""> (2) an isInitialized() method that checks to see whether the Yubikey is completely blank (i.e. - returns true if there </div>
</blockquote>
<blockquote type="cite" class="">
<div class="">is one of: a certificate, or a CCC, or a CHUID). <br class="">
</div>
</blockquote>
<div><br class="">
</div>
Not sure. Probably not helpful. We need to know for <u class="">each</u> of those whether they are on the card:</div>
<div>
<ul class="MailOutline">
<li class="">presence of key pairs</li><li class="">presence of CHUID</li><li class="">presence of CCC</li></ul>
<div class=""><br class="">
</div>
<div class="">A card without key pairs can be provisioned with keys, eventually.</div>
<div class=""><br class="">
</div>
<div class="">A card without CHUID and CCC cannot be used as a PIV card, and must have those objects written to it.</div>
<div class=""><br class="">
</div>
<blockquote type="cite" class="">
<div class=""> (3) make the tool to complain a bit if you try to do other things while isInitialized() returns false<br class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>Maybe.</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">Whether we go for a Smart Card Services patch, or a yubico-piv-tool patch (or ideally both), is probably something that you guys and the Yubico engineers need to discuss. The patch for SCS is at least relatively "low risk", given that I have
only needed to add an: if (xxx) {currentBehaviour} else {do something new}. <br class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>Maybe...</div>
<br class="">
<blockquote type="cite" class="">
<div class="">P.S. Is there a good tool in OpenSC that checks to see if a card PIV is ok? i.e. something that can use for PIV card compliance unit testing?<br class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>None, to the best of my knowledge. Today you find that it is really-really not PIV-ok when “true” PIV like PIV.tokend or PKard.tokend refuse to work with it.</div>
<div><br class="">
</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<blockquote type="cite" class="">Subject: Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]<br class="">
<br class="">
It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it.
<br class="">
<br class="">
In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly.<br class="">
<br class="">
One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package.
<br class="">
</blockquote>
</div>
</blockquote>
</div>
<br class="">
<div apple-content-edited="true" class="">
<div style="orphans: 2; widows: 2;" class="">--</div>
<div style="orphans: 2; widows: 2;" class="">Uri Blumenthal</div>
<div style="orphans: 2; widows: 2;" class=""><a href="mailto:uri@mit.edu" class="">uri@mit.edu</a></div>
</div>
<br class="">
</body>
</html>