{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570/events","html_url":"https://github.com/OpenSC/OpenSC/issues/570","id":109496244,"number":570,"title":"OpenSC.tokend does not unlock smartcard (PIV, Mac OS X Yosemite)","user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":102,"created_at":"2015-10-02T13:59:58Z","updated_at":"2015-11-26T02:24:27Z","closed_at":null,"body":"Using the current/latest OpenSC.tokend from Github, and RSA-2048 keys/certs on the latest NEO (PIV applet 0.1.3). And a current-issue CAC.\r\n\r\nAll the OpenSC utilities seem to work fine, and as expected. The only problem is with OpenSC.tokend. It is unable to unlock the card, though \r\n1. when tokend sends the Unlock command (with the PIN), the card returns Success, and\r\n2. tokend seems to be able to retrieve certificates correctly, as evidenced by Keychain Access and Thunderbird applications that see those certificates.\r\n\r\nI assume the successful unlock is not communicated because (a) Keychain Access does not change the card status from \"locked\" to \"unlocked\" upon receiving the correct PIN, and (b) Thunderbird keeps asking for the PIN over and over again - as if the unlock fails.\r\n\r\nOpenSC.tokend also seems to fail to read the ATR to determine the correct card type, based on these entries in the opensc-debug.log (log shows both CAC on SCR3310 reader, and Yubikey NEO that is its own reader):\r\n```\r\n0x7fff7e07b300 14:31:32.140733193388825 [tokend] reader-pcsc.c:288:refresh_attributes: Yubico Yubikey NEO OTP+\r\nU2F+CCID check\r\n0x7fff7e07b300 14:31:32.140733193388826 [tokend] reader-pcsc.c:307:refresh_attributes: returning with: 0 (Success)\r\n0x7fff7e07b300 14:31:32.140733193388827 [tokend] reader-pcsc.c:487:pcsc_connect: Initial protocol: T=1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:965:match_atr_table: ATR : 3b:fc:13:00:00:81:31:fe:15:59:75:62:69:6b:65:79:4e:45:4f:72:33:e1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:DD:18:00:81:31:FE:45:80:F9:A0:00:00:00:77:01:00:70:0A:90:00:8B\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:965:match_atr_table: ATR : 3b:fc:13:00:00:81:31:fe:15:59:75:62:69:6b:65:79:4e:45:4f:72:33:e1\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:7F:96:00:00:00:31:B9:64:40:70:14:10:73:94:01:80:82:90:00\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:7F:96:00:00:00:31:B8:64:40:70:14:10:73:94:01:80:82:90:00\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:976:match_atr_table: ATR try : 3B:DF:18:FF:81:91:FE:1F:C3:00:31:B8:64:0C:01:EC:C1:73:94:01:80:82:90:00:B3\r\n0x7fff7e07b300 14:31:32.795 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n........\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:976:match_atr_table: ATR try : 3B:DC:18:FF:81:91:FE:1F:C3:80:73:C8:21:13:66:01:0B:03:52:00:05:38\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:979:match_atr_table: ignored - wrong length\r\n0x7fff7e07b300 14:57:56.140432545677401 [tokend] card.c:226:sc_connect_card: trying driver 'piv'\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:965:match_atr_table: ATR     : 3b:db:96:00:80:1f:03:00:31:c0:64:b0:f3:10:00:07:90:00:80\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card.c:976:match_atr_table: ATR try : 3b:db:96:00:80:1f:03:00:31:c0:64:b0:f3:10:00:07:90:00:80\r\n0x7fff7e07b300 14:57:56.140432545677401 [tokend] card.c:231:sc_connect_card: matched driver 'PIV-II  for multiple cards'\r\n0x7fff7e07b300 14:57:56.089 [tokend] card-piv.c:2842:piv_match_card: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] card-piv.c:720:piv_find_aid: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] card-piv.c:683:piv_select_aid: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] card-piv.c:686:piv_select_aid: Got args: aid=23e5524, aidlen=9, response=5da90000, responselen=261\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:563:sc_transmit_apdu: called\r\n0x7fff7e07b300 14:57:56.089 [tokend] card.c:394:sc_lock: called\r\n0x7fff7e07b300 14:57:56.317106025398361 [tokend] reader-pcsc.c:526:pcsc_lock: called\r\n0x7fff7e07b300 14:57:56.4294967385 [tokend] apdu.c:530:sc_transmit: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:384:sc_single_transmit: called\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:389:sc_single_transmit: CLA:0, INS:A4, P1:4, P2:0, data(9) 0x1023e5524\r\n0x7fff7e07b300 14:57:56.317106025398361 [tokend] reader-pcsc.c:254:pcsc_transmit: reader 'SCR3310 Smart Card Reader'\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] apdu.c:187:sc_apdu_log: \r\nOutgoing APDU data [   14 bytes] =====================================\r\n00 A4 04 00 09 A0 00 00 03 08 00 00 10 00 ..............\r\n======================================================================\r\n0x7fff7e07b300 14:57:56.140733193388121 [tokend] reader-pcsc.c:184:pcsc_internal_transmit: called\r\n0x7fff7e07b300 14:57:56.4294967469 [tokend] apdu.c:187:sc_apdu_log: \r\nIncoming APDU data [    2 bytes] =====================================\r\n61 18 a.\r\n.......\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] apdu.c:187:sc_apdu_log:\r\nIncoming APDU data [    2 bytes] =====================================\r\n6A 80 j.\r\n======================================================================\r\n0x7fff7e07b300 15:45:26.140733193388869 [tokend] apdu.c:399:sc_single_transmit: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.120259085125 [tokend] apdu.c:552:sc_transmit: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.-4294966459 [tokend] card.c:434:sc_unlock: called\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:496:piv_general_io: DEE r=0 apdu.resplen=0 sw1=6a sw2=80\r\n0x7fff7e07b300 15:45:26.317106025399109 [tokend] iso7816.c:121:iso7816_check_sw: Incorrect parameters in the data field\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:508:piv_general_io: Card returned error\r\n0x7fff7e07b300 15:45:26.140733193388869 [tokend] card.c:434:sc_unlock: called\r\n0x7fff7e07b300 15:45:26.837 [tokend] reader-pcsc.c:566:pcsc_unlock: called\r\n0x7fff7e07b300 15:45:26.837 [tokend] card-piv.c:558:piv_general_io: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] card-piv.c:933:piv_get_data: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.4294968133 [tokend] card-piv.c:1014:piv_get_cached_data: returning with: -1205 (Incorrect parameters in APDU)\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:2576:piv_process_discovery: returning with: 0 (Success)\r\n0x7fff7e07b300 15:45:26.140243567117125 [tokend] card-piv.c:2919:piv_init: returning with: 0 (Success)\r\n......\r\n\r\nI have the entire log, but Github refuses to attach it. Will happily email or post anywhere you can use it.\r\n\r\nHere are the keys:\r\n\r\n$ pkcs15-tool -k\r\nUsing reader with a card: Yubico Yubikey NEO OTP+U2F+CCID\r\nPrivate RSA Key [PIV AUTH key]\r\nObject Flags : [0x1], private\r\nUsage : [0x2E], decrypt, sign, signRecover, unwrap\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 154 (0x9A)\r\nNative : yes\r\nAuth ID : 01\r\nID : 01\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [SIGN key]\r\nObject Flags : [0x1], private\r\nUsage : [0x20E], decrypt, sign, signRecover, nonRepudiation\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 156 (0x9C)\r\nNative : yes\r\nAuth ID : 01\r\nID : 02\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [KEY MAN key]\r\nObject Flags : [0x1], private\r\nUsage : [0x22], decrypt, unwrap\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 157 (0x9D)\r\nNative : yes\r\nAuth ID : 01\r\nID : 03\r\nMD:guid : 0x'30...000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n\r\nPrivate RSA Key [CARD AUTH key]\r\nObject Flags : [0x0]\r\nUsage : [0xC], sign, signRecover\r\nAccess Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local\r\nModLength : 2048\r\nKey ref : 158 (0x9E)\r\nNative : yes\r\nID : 04\r\nMD:guid : 0x'30...0000000'\r\n:cmap flags : 0x0\r\n:sign : 0\r\n:key-exchange: 0\r\n```"},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/159784399","html_url":"https://github.com/OpenSC/OpenSC/issues/570#issuecomment-159784399","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/570","id":159784399,"user":{"login":"dengert","id":865329,"avatar_url":"https://avatars.githubusercontent.com/u/865329?v=3","gravatar_id":"","url":"https://api.github.com/users/dengert","html_url":"https://github.com/dengert","followers_url":"https://api.github.com/users/dengert/followers","following_url":"https://api.github.com/users/dengert/following{/other_user}","gists_url":"https://api.github.com/users/dengert/gists{/gist_id}","starred_url":"https://api.github.com/users/dengert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dengert/subscriptions","organizations_url":"https://api.github.com/users/dengert/orgs","repos_url":"https://api.github.com/users/dengert/repos","events_url":"https://api.github.com/users/dengert/events{/privacy}","received_events_url":"https://api.github.com/users/dengert/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T02:24:27Z","updated_at":"2015-11-26T02:24:27Z","body":"We have many arbitrary limits in OpenSC and tokend. The tokend still had 32, OpenSC had changed to 64 long time ago.\nwe should up these limits, when we find them.\n\n\nOn 11/25/2015 6:34 PM, Frank Morgner wrote:\n> regarding the maximum number of |struct sc_pkcs15_object|, I don't quite understand why 32 should not be enough, because in tokend it's always limited to a certain type of object. I think your four\n> certificates should fit into the existing buffer.\n>\n> Yes, there might be a different theoretical limit as pointed out by @dengert <https://github.com/dengert> , but I've never seen those in action...\n>\n> —\n> Reply to this email directly or view it on GitHub <https://github.com/OpenSC/OpenSC/issues/570#issuecomment-159765849>.\n>\n\n-- \n\n  Douglas E. Engert  <DEEngert@gmail.com>\n\n"}}