{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/events","html_url":"https://github.com/OpenSC/OpenSC/issues/570","id":109496244,"number":570,"title":"OpenSC.tokend does not unlock CAC or Yubikey NEO (Mac OS X Yosemite)","user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":49,"created_at":"2015-10-02T13:59:58Z","updated_at":"2015-10-29T04:09:21Z","closed_at":null,"body":"Using the current/latest OpenSC.tokend from Github, and RSA-2048 keys/certs on the latest NEO (PIV applet 0.1.3). And a current-issue CAC.\r\n\r\nAll the OpenSC utilities seem to work fine, and as expected. The only problem is with OpenSC.tokend. It is unable to unlock the card, though \r\n1. when tokend sends the Unlock command (with the PIN), the card returns Success, and\r\n2. tokend seems to be able to retrieve certificates correctly, as evidenced by Keychain Access and Thunderbird applications that see those certificates.\r\n\r\nI assume the successful unlock is not communicated because (a) Keychain Access does not change the card status from \"locked\" to \"unlocked\" upon receiving the correct PIN, and (b) Thunderbird keeps asking for the PIN over and over again - as if the unlock fails.\r\n\r\nOpenSC.tokend also seems to fail to read the ATR to determine the correct card type, based on these entries in the opensc-debug.log (log shows both CAC on SCR3310 reader, and Yubikey NEO that is its own reader):\r\n```\r\n0x7fff7e07b300 14:31:32.140733193388825 [tokend] reader-pcsc.c:288:refresh_attributes: Yubico Yubikey NEO OTP+\r\nU2F+CCID check\r\n0x7fff7e07b300 14:31:32.140733193388826 [tokend] reader-pcsc.c:307:refresh_attributes: returning with: 0 (Success)\r\n0x7fff7e07b300 14:31:32.140733193388827 [tokend] reader-pcsc.c:487:pcsc_connect: Initial protocol: T=1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:965:match_atr_table: ATR : 3b:fc:13:00:00:81:31:fe:15:59:75:62:69:6b:65:79:4e:45:4f:72:33:e1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:DD:18:00:81:31:FE:45:80:F9:A0:00:00:00:77:01:00:70:0A:90:00:8B\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:965:match_atr_table: ATR : 3b:fc:13:00:00:81:31:fe:15:59:75:62:69:6b:65:79:4e:45:4f:72:33:e1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:7F:96:00:00:00:31:B9:64:40:70:14:10:73:94:01:80:82:90:00\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:7F:96:00:00:00:31:B8:64:40:70:14:10:73:94:01:80:82:90:00\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:DF:18:FF:81:91:FE:1F:C3:00:31:B8:64:0C:01:EC:C1:73:94:01:80:82:90:00:B3\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n........\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:976:match_atr_table: ATR try : 3B:DC:18:FF:81:91:FE:1F:C3:80:73:C8:21:13:66:01:0B:03:52:00:05:38\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:57:56.140432545677401 [tokend] card.c:226:sc_connect_card: trying driver 'piv'\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:965:match_atr_table: ATR     : 3b:db:96:00:80:1f:03:00:31:c0:64:b0:f3:10:00:07:90:00:80\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:976:match_atr_table: ATR try : 3b:db:96:00:80:1f:03:00:31:c0:64:b0:f3:10:00:07:90:00:80\r\n0x7fff7e07b300 14:57:56.140432545677401 [tokend] card.c:231:sc_connect_card: matched driver 'PIV-II  for multiple cards'\r\n0x7fff7e07b300 14:57:56.089 [tokend] card-piv.c:2842:piv_match_card: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card-piv.c:720:piv_find_aid: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] card-piv.c:683:piv_select_aid: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] card-piv.c:686:piv_select_aid: Got args: aid=23e5524, aidlen=9, response=5da90000, responselen=261\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:563:sc_transmit_apdu: called\r\n0x7fff7e07b300 14:57:56.089 [tokend] card.c:394:sc_lock: called\r\n0x7fff7e07b300 14:57:56.317106025398361 [tokend] reader-pcsc.c:526:pcsc_lock: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] apdu.c:530:sc_transmit: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:384:sc_single_transmit: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:389:sc_single_transmit: CLA:0, INS:A4, P1:4, P2:0, data(9) 0x1023e5524\r\n0x7fff7e07b300 14:57:56.317106025398361 [tokend] reader-pcsc.c:254:pcsc_transmit: reader 'SCR3310 Smart Card Reader'\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:187:sc_apdu_log: \r\nOutgoing APDU data [   14 bytes] =====================================\r\n00 A4 04 00 09 A0 00 00 03 08 00 00 10 00 ..............\r\n======================================================================\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] reader-pcsc.c:184:pcsc_internal_transmit: called\r\n0x7fff7e07b300 14:57:56.4294967469 [tokend] apdu.c:187:sc_apdu_log: \r\nIncoming APDU data [    2 bytes] =====================================\r\n61 18 a.\r\n.......\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] apdu.c:187:sc_apdu_log:\r\nIncoming APDU data [    2 bytes] =====================================\r\n6A 80 j.\r\n======================================================================\r\n0x7fff7e07b300 15:45:26.140733193388869 [tokend] apdu.c:399:sc_single_transmit: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.120259085125 [tokend] apdu.c:552:sc_transmit: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.-4294966459 [tokend] card.c:434:sc_unlock: called\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:496:piv_general_io: DEE r=0 apdu.resplen=0 sw1=6a sw2=80\r\n0x7fff7e07b300 15:45:26.317106025399109 [tokend] iso7816.c:121:iso7816_check_sw: Incorrect parameters in the data field\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:508:piv_general_io: Card returned error\r\n0x7fff7e07b300 15:45:26.140733193388869 [tokend] card.c:434:sc_unlock: called\r\n0x7fff7e07b300 15:45:26.837 [tokend] reader-pcsc.c:566:pcsc_unlock: called\r\n0x7fff7e07b300 15:45:26.837 [tokend] card-piv.c:558:piv_general_io: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] card-piv.c:933:piv_get_data: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] card-piv.c:1014:piv_get_cached_data: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:2576:piv_process_discovery: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:2919:piv_init: returning with: 0 (Success)\r\n......\r\n\r\nI have the entire log, but Github refuses to attach it. Will happily email or post anywhere you can use it.\r\n\r\nHere are the keys:\r\n\r\n$ pkcs15-tool -k\r\nUsing reader with a card: Yubico Yubikey NEO OTP+U2F+CCID\r\nPrivate RSA Key [PIV AUTH key]\r\nObject Flags : [0x1], private\r\nUsage : [0x2E], decrypt, sign, signRecover, unwrap\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 154 (0x9A)\r\nNative : yes\r\nAuth ID : 01\r\nID : 01\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [SIGN key]\r\nObject Flags : [0x1], private\r\nUsage : [0x20E], decrypt, sign, signRecover, nonRepudiation\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 156 (0x9C)\r\nNative : yes\r\nAuth ID : 01\r\nID : 02\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [KEY MAN key]\r\nObject Flags : [0x1], private\r\nUsage : [0x22], decrypt, unwrap\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 157 (0x9D)\r\nNative : yes\r\nAuth ID : 01\r\nID : 03\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [CARD AUTH key]\r\nObject Flags : [0x0]\r\nUsage : [0xC], sign, signRecover\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 158 (0x9E)\r\nNative : yes\r\nID : 04\r\nMD:guid : 0x'30...0000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n```"},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/152071450","html_url":"https://github.com/OpenSC/OpenSC/issues/570#issuecomment-152071450","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570","id":152071450,"user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T04:09:21Z","updated_at":"2015-10-29T04:09:21Z","body":"@frankmorgner,\r\n\r\n> Is it possible to reproduce this behaviour (maybe with a different token)? \r\n\r\nYes. I have two tokens, and both behave exactly the same way:\r\n* Each token is recognized, and certificates on it are visible.\r\n* Each token accepts the PIN-Unlock command, and returns `90 00`.\r\n* From the calling application's point of view (e.g. Keychain Access) each token stays locked. The \"Lock\" symbol does not change.\r\n\r\n> What's your setup, what would be the steps for reproducing?\r\n\r\nMy way of reproducing the problem:\r\n1. Remove everything from /Library/Security/tokend.\r\n2. Install OpenSC with OpenSC.tokend (I build it from the source, but using stock OpenSC-0.15.0 gives the same result). Edit `/Library/OpenSC/etc/opensc.conf` to set debug to 3.\r\n3. Insert the token, wait a few seconds.\r\n4. Start Keychain Access, observe that the token is locked, and all the certificates on it are present and visible.\r\n5. Click on the lock symbol to unlock the token.\r\n6. Type the PIN into the pop-up PIN-prompting window.\r\n7. Observe that the PIN is accepted, but the lock symbol does not change, and the card stays locked.\r\n8. Go through the `/tmp/opensc-debug.log` and find that (a) the PIN was correct, (b) it was correctly encoded in the APDU that went out, (c) the card accepted that PIN and replied with `90 00`.\r\n\r\nNow to demonstrate that the problem is indeed with OpenSC.tokend:\r\n1. remove OpenSC.tokend, install a different one, say \r\n   * PKard.tokend http://www.thursby.com/products/pkard-mac (costs $29), or \r\n   * PKCS11.tokend http://militarycac.com/MacVideos.htm#CACKey_packages (freeware, it says CAC, but it works for PIV cards just fine), or \r\n   * PIV.tokend from SmartCardServices http://smartcardservices.macosforge.org/trac/wiki/installers (freeware) , or\r\n   * Centrify Express from http://www.centrify.com/express/smart-card-form/ (free for Federal users). \r\n2. Repeat the above steps, and observe that at (7) the lock symbol changes to \"Unlocked\", and the card is unlocked. \r\n\r\nUsing a different application (not Keychain Access), say Microsoft Outlook 2011, after unlocking the card your outgoing email gets digitally signed. It will prompt for your PIN for every outgoing signed email, and will sign it.\r\n\r\nFor your sequence:\r\n> 1. build OpenSC with MacOSX/build on OS X 10.10\r\n\r\nWorks OK.\r\n\r\n> 2. install from the dmg built\r\n\r\nWorks OK.\r\n\r\n> 3. start safari\r\n\r\nWorks OK.\r\n\r\n> 4. perform client authentication\r\n\r\nStarting...\r\n\r\n> 5. verify PIN\r\n\r\nPIN is accepted, but the token is not unlocked\r\n\r\n> 5. challenge signed OK\r\n\r\nNo, challenge is not signed, authentication does not succeed.\r\n\r\n\r\n@dengert, yes I'm familiar with that site, and the referred document. In fact, used them to generate a minimalistic CCC to get NEO token to work with PKard.tokend (PKCS11.tokend surprisingly did not need it)."}}