Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for GET DATA with odd instruction #62

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

sosthene-nitrokey
Copy link
Collaborator

@sosthene-nitrokey sosthene-nitrokey commented Sep 30, 2022

I'm not sure I got it right. The documentation is unclear and gnuk doesn't support it.

Maybe it should actually be handled by the card or in APDU dispatch because if I understand correctly the information matters to be able to correctly SELECT the openpgp application.

@sosthene-nitrokey sosthene-nitrokey mentioned this pull request Oct 4, 2022
23 tasks
@sosthene-nitrokey
Copy link
Collaborator Author

I also dived a bit deeper into the historical bytes and fixed the Options struct

Copy link
Member

@robin-nitrokey robin-nitrokey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the card indicates DO handling for EF.DIR, then it should support the GET DATA com-
mand for reading all DOs in the EF at once ('00CB 2F00 02 5C00 00') directly after a reset.

I think this is not true for our implementation because apdu-dispatch requires a SELECT before allowing the GET DATA command. From my understanding, we would have to add support for the EF (and maybe MF?) to apdu-dispatch. What do you think?

src/card.rs Outdated
/// Is command chaining supported before the Card recieves the commands
pub chaining_supported: bool,

/// Are exterded length supported
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/exterded/extended/

Comment on lines 586 to 590
00
31 F5
73 C0 01 E0
00
9000
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add comments naming the components?

@sosthene-nitrokey
Copy link
Collaborator Author

If the card indicates DO handling for EF.DIR, then it should support the GET DATA com-
mand for reading all DOs in the EF at once ('00CB 2F00 02 5C00 00') directly after a reset.

I think this is not true for our implementation because apdu-dispatch requires a SELECT before allowing the GET DATA command. From my understanding, we would have to add support for the EF (and maybe MF?) to apdu-dispatch. What do you think?

That would seem right. Do other applications also have data in the EF.DIR and ATR? I guess apdu_dispatch would need to merge the data for each application.

@sosthene-nitrokey
Copy link
Collaborator Author

Looking at the fido implementation it doesn't seem to require it.

@sosthene-nitrokey
Copy link
Collaborator Author

Achim Pietig (Author of the spec) has given some clarifications regarding this feature: 

The files EF.DIR and EF.ATR are optional – in my implementations I added them as example how to read data objects from such files. I think there is no need to implement GET DATA with ODD INS, because I don’t know any implementation on such a card. In addition all relevant information of the ATR is present in the OpenPGP app itself.

But as @daringer found out the EF.DIR might be relevant for interoperability with other software:

❯ pkcs11-tool -k --key-type EC:curve25519
Using slot 0 with a present token (0x0)
error: Generate EC key mechanism 1056 not supported
Aborting.
[opensc-pkcs11] card.c:1614:sc_card_sm_check: called
[opensc-pkcs11] card.c:1619:sc_card_sm_check: returning with: 0 (Success)
[opensc-pkcs11] card.c:397:sc_connect_card: returning with: 0 (Success)
[opensc-pkcs11] slot.c:285:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Connected SC card 0x5594ab16b590
[opensc-pkcs11] dir.c:171:sc_enum_apps: called
[opensc-pkcs11] card.c:853:sc_select_file: called; type=2, path=3f002f00
[opensc-pkcs11] card-openpgp.c:1442:pgp_select_file: called
[opensc-pkcs11] card-openpgp.c:1496:pgp_select_file: returning with: -1201 (File not found)
[opensc-pkcs11] card.c:875:sc_select_file: 'SELECT' error: -1201 (File not found)
[opensc-pkcs11] dir.c:180:sc_enum_apps: Cannot select **EF.DIR** file: -1201 (File not found)
[opensc-pkcs11] slot.c:292:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detecting Framework. 0 on-card applications
[opensc-pkcs11] slot.c:293:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: generic application <none>
[opensc-pkcs11] slot.c:307:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Detected framework 0. Creating tokens.
[opensc-pkcs11] slot.c:322:card_detect: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00: Try to bind 'generic' token.
[opensc-pkcs11] framework-pkcs15.c:321:pkcs15_bind: Bind PKCS#15 '<anonymous>' application
[opensc-pkcs11] pkcs15.c:1230:sc_pkcs15_bind: called
[opensc-pkcs11] pkcs15.c:1231:sc_pkcs15_bind: application(aid:'empty')
[opensc-pkcs11] pkcs15.c:1266:sc_pkcs15_bind: PKCS#15 options: use_file_cache=0 use_pin_cache=1 pin_cache_counter=10 pin_cache_ignore_user_consent=0 private_certificate=0
[opensc-pkcs11] card.c:473:sc_lock: called
[opensc-pkcs11] reader-pcsc.c:688:pcsc_lock: called

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants