Bug 1651748
| Summary: | unable to use CAC in PIV-II mode | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Scott Poore <spoore> | ||||
| Component: | opensc | Assignee: | Jakub Jelen <jjelen> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Asha Akkiangady <aakkiang> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 8.0 | CC: | nmavrogi, spoore | ||||
| Target Milestone: | rc | Keywords: | Regression | ||||
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | opensc-0.19.0-4.el8 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-06-14 01:11:05 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
*** Bug 1642192 has been marked as a duplicate of this bug. *** FYI, This is what I see on RHEL7.5 with opensc-0.16.0-8.20170227git777e2a3.el7.x86_64
::
[root@rhel7-2 ~]# pkcs11-tool --test --login
Using slot 0 with a present token (0x0)
Logging in to "FLUORINE.JANE.F.2001441054".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
ERR: C_GenerateRandom failed: CKR_DATA_INVALID (0x20)
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only for RSA)
testing key 0 (PIV AUTH key)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
SHA256-RSA-PKCS: OK
testing key 1 (2048 bits, label=SIGN key) with 1 signature mechanism
error: PKCS11 function C_Sign failed: rv = CKR_USER_NOT_LOGGED_IN (0x101)
Aborting.
RSA-X-509: [root@rhel7-2 ~]#
So not sure if this really showing much of what's wrong. I'll attach a debug log file from the RHEL8 test.
Created attachment 1507448 [details]
opensc debug log
The PIV detection has changed recently. Can you try the workaround proposed in the upstream issue, replacing the ATR with the ATR of your card? You can get ATR of your card by running: opensc-tool --atr https://github.com/OpenSC/OpenSC/issues/1531#issuecomment-438367593 Unfortunately, I do not have such card that would reproduce the same issue (I have only older cards from 2012, which are not detected in PIV driver at all). For the record, cross-posting the answers to my questions: * The card ATR is 3b:7d:96:00:00:80:31:80:65:b0:83:11:17:d6:83:00:90:00, the same as in the OpenSC issue mentioned in the comment #4. * The workaround proposed in the comment #4 works also for your card. This is something that we can either ship by default or find a way how to fix this card in OpenSC. I will update once we will have something from the upstream. I attached the upstream PR: https://github.com/OpenSC/OpenSC/pull/1549 It still needs some cleanup, but otherwise we verified with Scott it worked for the affected card. I will build the new package early next week after the the review comments in upstream will get resolved. Verified.
Version ::
opensc-0.19.0-4.el8.x86_64
Results ::
[root@rhel8-2 tmp]# pkcs11-tool --test --login
Using slot 0 with a present token (0x0)
Logging in to "FLUORINE.JANE.F.2001441054".
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
seeding (C_SeedRandom) not supported
ERR: C_GenerateRandom failed: CKR_FUNCTION_NOT_SUPPORTED (0x54)
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only for RSA)
testing key 0 (PIV AUTH key)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
SHA256-RSA-PKCS: OK
testing key 1 (2048 bits, label=SIGN key) with 1 signature mechanism
Logging in to "FLUORINE.JANE.F.2001441054".
Please enter context specific PIN:
RSA-X-509: OK
testing key 2 (2048 bits, label=KEY MAN key) with 1 signature mechanism -- can't be used to sign/verify, skipping
Verify (currently only for RSA)
testing key 0 (PIV AUTH key)
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
testing key 1 (SIGN key) with 1 mechanism
Logging in to "FLUORINE.JANE.F.2001441054".
Please enter context specific PIN:
RSA-X-509: OK
testing key 2 (KEY MAN key) with 1 mechanism -- can't be used to sign/verify, skipping
Unwrap: not implemented
Decryption (currently only for RSA)
testing key 0 (PIV AUTH key)
RSA-X-509: OK
RSA-PKCS: OK
testing key 1 (SIGN key)
RSA-X-509: Logging in to "FLUORINE.JANE.F.2001441054".
Please enter context specific PIN:
OK
RSA-PKCS: Logging in to "FLUORINE.JANE.F.2001441054".
Please enter context specific PIN:
OK
testing key 2 (KEY MAN key)
RSA-X-509: OK
RSA-PKCS: OK
1 errors
|
Description of problem: I'm trying to use a CAC that previously has worked with PIV-II and cac drivers in opensc. Now I can use it without a problem with the cac driver but, not with PIV-II. [root@rhel8-2 ~]# cat /etc/opensc-x86_64.conf app default { # debug = 3; # debug_file = /tmp/opensc-debug.txt; framework pkcs15 { # use_file_caching = true; } reader_driver pcsc { # The pinpad is disabled by default, # because of many broken readers out there enable_pinpad = false; } # card_drivers = cac, internal; card_drivers = PIV-II, cac; } [root@rhel8-2 ~]# pkcs11-tool --test --login Using slot 0 with a present token (0x0) Logging in to "FLUORINE.JANE.F.2001441054". Please enter User PIN: C_SeedRandom() and C_GenerateRandom(): seeding (C_SeedRandom) not supported ERR: C_GenerateRandom failed: CKR_DATA_INVALID (0x20) Digests: all 4 digest functions seem to work MD5: OK SHA-1: OK RIPEMD160: OK Signatures (currently only for RSA) testing key 0 (PIV AUTH key) error: PKCS11 function C_SignFinal failed: rv = CKR_USER_NOT_LOGGED_IN (0x101) Aborting. Version-Release number of selected component (if applicable): opensc-0.19.0-3.el8.x86_64 How reproducible: always Steps to Reproduce: 1. dnf -y install pcsc-lite opensc 2. systemctl start pcscd 3. connect card reader and insert CAC 4. pkcs11-tool --test --login Actual results: Fails as shown above. Expected results: No failure and card can be used as normal. Additional info: