Bug 1696238

Jakub Any updates here!

Attached 
1. output of # pkcs11-tool -O
2. Secure log in /var/log/secure
3. Messages log in /var/log/messages When Yubikey is plugged in to machine

# pkcs11-tool --pin 123456 --test
No slots.
# pkcs11-tool --pin 177181 --test
Using slot 0 with a present token (0x0)
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (PIV AUTH key) 
error: PKCS11 function C_SignFinal failed: rv = CKR_DATA_INVALID (0x20)
Aborting.

I am not sure if I already proposed to test more recent OpenSC (to be shipped with RHEL 7.7):

https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=868732

Also I do not see here information what version and type of yubikey is customer using.

Lets provide also a opensc debug log from the test in previous comment:

OPENSC_DEBUG=9 pkcs11-tool --pin 177181 --test &> /tmp/opensc.log

And the yubikey version/type? I am personally using Yubikey 4 without any problems.

cu has multiple keys they are working with:

~We have YubiKey 4, 5, 5c, and 5c Fips edition to test with.

Is there anything else you would need?

All of the above yubikeys show the same issues as in this bug report or is it just one of them?

Is there some other application running that might poll the smart card status during the tests?

cu got back with this:

We experienced the same issue with all 3 versions of the yubikey. However, I have no idea if another program is conflicting with our configuration.

OK, so lets try the following:

 * modify /etc/opensc.conf to contain the following in the "app default" block:

    debug = 3;
    debug_file = /tmp/opensc-debug.txt;

* Restart system
* Retry the test (assuming the 177181 is the pin for the yubikey):

    $ pkcs11-tool --pin 177181 --test &> /tmp/opensc-pkcs11-tool--test.log

* Attach the /tmp/opensc-debug.log
* Attach a new sosreport

Hello,
I am sorry for a delay. I just tried my yubikey with the latest RHEL7 (beta) machine and it looks like it is still working as expected.

The error message comes from the card. How was the card provisioned? How was the key generated and certificate loaded to the yubikey? From the description, the certificate and public key look fine. Is it still the same certificate and key on all the testing cards or did you try different ones?

What version of pcsc-lite and pcsc-lite-ccid is used? Can you try to install these version from RHEL 7.7 beta too?

Also please retry with modified option disconnect_action=leave in the opensc.conf, which should address possible concurrency issues.

Hello,

Thanks for the update.

> What version of pcsc-lite and pcsc-lite-ccid is used?

pcsc-lite-1.8.8-8.el7.x86_64                                Tue Dec 11 14:12:56 2018
pcsc-lite-ccid-1.4.10-14.el7.x86_64                         Tue Dec 11 14:12:56 2018
pcsc-lite-libs-1.8.8-8.el7.x86_64                           Tue Dec 11 11:52:59 2018

> Is it still the same certificate and key on all the testing cards or did you try different ones?

I believe they are using the same certs for testing purposes and from them:

~We have YubiKey 4, 5, 5c, and 5c Fips edition to test with.

> Can you try to install these version from RHEL 7.7 beta too?

Is there certain packages you want them to try? I can ask if they'll make a beta test machine.

I'm requesting they try with your disconnect option.

(In reply to joel from comment #18)
> I believe they are using the same certs for testing purposes and from them:

Please, clarify how the yubikeys were provisioned and keys generated and whether it is one testing or more keys. If it is still the same key, if they can try to generate different.

> > Can you try to install these version from RHEL 7.7 beta too?
> 
> Is there certain packages you want them to try? I can ask if they'll make a
> beta test machine.

Trying complete beta would be best, otherwise I would be interested in pcsc-lite, pcsc-lite-ccid, opensc at least.

> I'm requesting they try with your disconnect option.

Thank you.