CryptoCertum 3.6 card support

Offen
  • Stimmt etwas nicht?
#3,498 12 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 6 Tagen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
48/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Ruhig
Tech-Stack
c
Bereich
security

Rechercherichtung

Start by reading card-starcos.c and comparing its existing Starcos 3.5 ATR and eSign AID handling with the ATR and AIDs in this issue. Re-run the reported pkcs15-tool command with the explicit Starcos driver and AID as a baseline. Done means OpenSC recognizes the CryptoCertum 3.6 card and can handle the reported eSign application.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Input needed Wishlist

Hi, I have a CryptoCertum 3.6 card from Certum that doesn't seem to be recognized by OpenSC 0.26.1.

The ATR of the card is 3b 7f 96 00 00 80 31 80 58 43 65 72 74 75 6d 30 31 82 90 00.

The card has two "profiles" in the Certum terminology:

  • The "Secure profile":
    • Pin locked, it requires a PUK provided bu Certum to unlock
    • Apparently preloaded with 5 RSA 3072 and 5 ECC P-384 keys (according to the data displayed by the Certum diagnostic tool)
    • As I understand this profile is expected to handle eIDAS qualified certificates
  • The "Common profile":
    • Not initialized when received, the PIN/PUK can be set freely upon initialization
    • Certificates and privates keys can be imported from a PKCS#12 file. I haven't figured out how to generate a key pair.

The PIN/PUK of the two profiles are independent so I guess each profile is mapped to a different application on the card.

I traced the USB packets with USBPcap and Wireshark when running the Certum diagnostic tool and signing with signtool (using a key loaded on the common profile). This revealed two application AIDs:

  • a0 00 00 01 67 45 53 49 47 4e (eGK-ESIGN)
  • a0 00 00 01 67 45 53 49 47 4f (eSign) -> this one was selected when signing with signtool

I assume it's a Starcos card. OpenSC supports the version 3.5, but card-starcos.c doesn't list the ATR for the 3.6 card and checks a different AID for the eSign application (a0 00 00 02 45 53 69 67 6e).

I ran pkcs15-tool with the driver and AID set explicitely but it didn't work:

$ OPENSC_DRIVER=starcos pkcs15-tool --dump --aid a000000167455349474f
Using reader with a card: ACS ACR40U ICC Reader 0
Connecting to card in reader ACS ACR40U ICC Reader 0...
Failed to connect to card: Card is invalid or cannot be handled

Please let me know if I can provide any relevant information.

Vorherrschende Sprache
C
Sterne
3.1k
Forks
858
Ø Merge
7 T. 18 Std.
Gemergte PRs (30 T.)
27

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus OpenSC/OpenSC

Alle Issues in OpenSC/OpenSC

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.