Updated Italian CNS to support IDEMIA (Oberthur) tokens #2483

3v1n0 · 2022-01-12T03:27:39Z

Added missing bits to support new Italian CNS cards provided by Idemia that have use now some less-standard mechanisms.

Checklist

PKCS#11 module is tested

Fixes #2445

src/libopensc/card-itacns.c

frankmorgner · 2022-01-15T22:04:49Z

Please check out frankmorgner@662d2a9 ... this may help you simplify the card matching process...

src/libopensc/card-itacns.c

xhanulik

Some minor inconsistency in indentation

src/libopensc/card-itacns.c

Fale · 2022-04-18T12:02:58Z

Any news on this? I've received one of those cards and I would be glad if it would be supported!

rghe · 2022-05-08T16:07:58Z

BTW I've built and tested this change both with an older italian CNS (AC 2014) and a brand new ACe 2021.
Everything worked: pkcs11-test, logging on regional and government sites

Jakuje · 2022-08-16T16:04:29Z

@3v1n0 did you get back to the review comments? This looks like it works ok for several users so it would be great to have this in the coming release.

dengert · 2022-08-16T20:33:39Z

Comments the use of the ATR and mask:

  "3b:8b:80:01:00:31:c1:64:00:00:00:00:00:00:00:00",
  "ff:ff:ff:ff:ff:ff:ff:ff:00:00:00:00:00:00:00:00",

This Only supports NFC, and is very generic, and could be mistaken for some other card. Can this card be used in a normal contact reader? If so it would have a different ATR.

I see you have figured out how to use already parsed ATR to get at the history bytes: card->reader->atr_info.hist_bytes_len
and removed much local parsing, but the original card had only 4 bytes of history and the new one has 11 from the b in 8b.
Whats in these bytes? Have you looked at using: https://smartcard-atr.apdu.fr/ with the ATR? I do not recall seeing in any of the comments what the ATR is.

... and modify internal data only during initialization

There's no need to use custom values, while in this way we can expose such information to the card users

Gemalto was added in the last reference of CNS – Carta Nazionale dei Servizi Functional Specification [1], while Oberthur is now named IDEMIA. [1] https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/cns_functional_specification_1.1.6_02042011.pdf

In case a card has some contents in the fetched path, but that's not an X.509 certificate, we're accepting it anyways until it's actually going to be used, and so will be listed as an available object. Instead ensure whether this is valid through openssl before adding it.

Some cards can generate very small random numbers, so perform the action multiple times to get up to the requested value. This is handled by OpenSC, when the returned size is just less than expected.

New Idemia / Oberthur cards have been provided to people and they use a slightly different protocol, as per the reverse engineering of the new protocol, I've adapted the missing bits. Main key points: - Certificate path is 140090012002 - Public key path is 11001102 - The certificate has a size of 2048 - Private key path is 14009002 - The random number generator can only provide up to 32 bytes, so we just request multiple chunks in case a bigger number is requested. Also, official driver uses chained APDU commands to handle signing operations, however the card also supports extended APDU, so we can just use that instead of using chained commands (that would require some adjustments on the main library) Fixes: OpenSC#2445

When using the card with a NFC reader the ATR is different, so we need to use hard matching.

3v1n0 · 2022-11-13T04:17:58Z

Sorry, took a while to update this, but comments should be handled now.

3v1n0 · 2022-11-13T04:34:17Z

This Only supports NFC, and is very generic, and could be mistaken for some other card. Can this card be used in a normal contact reader? If so it would have a different ATR.

Yes, it can be used both in a physical and NFC reader.

I see you have figured out how to use already parsed ATR to get at the history bytes: card->reader->atr_info.hist_bytes_len and removed much local parsing, but the original card had only 4 bytes of history and the new one has 11 from the b in 8b. Whats in these bytes? Have you looked at using: https://smartcard-atr.apdu.fr/ with the ATR? I do not recall seeing in any of the comments what the ATR is.

The ATR of the card I'm using here is 3B:8B:80:01:00:31:C1:64:08:92:33:54:00:90:00:F3, and I'm not aware if there are others. I'm quite sure this is the only one available for now.

But I didn't want to be too strict with it, in case some other card may change it.

Jakuje

except for the minor comments inline, looks good.

src/libopensc/pkcs15-itacns.c

Jakuje · 2022-11-14T09:40:35Z

src/libopensc/card-itacns.c

+itacns_get_challenge(sc_card_t *card, u8 *rnd, size_t len)
+{
+	if (card->type == SC_CARD_TYPE_ITACNS_CNS_IDEMIA_2021)
+		len = MIN (0x20, len);


nit: using decimal representation in this context might be more readable than hexadecimal.

frankmorgner

Overall the code looks good. If you address the comments posted in the previous reviews, then I think we can move forward.

frankmorgner

I think the comments are really just nits. We should merge this PR as is and move on.

3v1n0 force-pushed the itacns-idemia-2021 branch 2 times, most recently from 0ca0c92 to 1aab1b9 Compare January 12, 2022 18:22

frankmorgner requested changes Jan 14, 2022

View reviewed changes

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

3v1n0 force-pushed the itacns-idemia-2021 branch 2 times, most recently from 49f1154 to 167dc9f Compare January 14, 2022 19:08

frankmorgner requested changes Jan 14, 2022

View reviewed changes

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

3v1n0 force-pushed the itacns-idemia-2021 branch 3 times, most recently from c1d5a4f to c0821d5 Compare January 15, 2022 00:45

3v1n0 force-pushed the itacns-idemia-2021 branch from c0821d5 to a90abd4 Compare January 16, 2022 00:25

Jakuje reviewed Jan 16, 2022

View reviewed changes

src/libopensc/card-itacns.c Show resolved Hide resolved

frankmorgner reviewed Jan 17, 2022

View reviewed changes

src/libopensc/card-itacns.c Show resolved Hide resolved

xhanulik reviewed Feb 1, 2022

View reviewed changes

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

src/libopensc/card-itacns.c Outdated Show resolved Hide resolved

frankmorgner and others added 7 commits November 13, 2022 05:14

itacns: simplify ATR matching

f12c766

... and modify internal data only during initialization

card-itacns: Use generic card fields to store hw and fw versions

0ab6233

There's no need to use custom values, while in this way we can expose such information to the card users

card-itacns: Support creating random numbers in smaller chunks

3365f3a

Some cards can generate very small random numbers, so perform the action multiple times to get up to the requested value. This is handled by OpenSC, when the returned size is just less than expected.

card-itacns: Add NFC ATR for Idemia CNS

1708c06

When using the card with a NFC reader the ATR is different, so we need to use hard matching.

3v1n0 force-pushed the itacns-idemia-2021 branch from a90abd4 to 1708c06 Compare November 13, 2022 04:17

Jakuje reviewed Nov 18, 2022

View reviewed changes

frankmorgner requested changes Jan 19, 2023

View reviewed changes

frankmorgner approved these changes Feb 24, 2023

View reviewed changes

frankmorgner merged commit 47ac091 into OpenSC:master Apr 13, 2023

dengert mentioned this pull request Apr 27, 2023

with the new opensc 0.23.0 version in Debian testing/sid I am unable to use the new Italian CNS #2763

Closed

xhanulik mentioned this pull request Jul 3, 2023

New release 0.24.0 #2792

Closed

Updated Italian CNS to support IDEMIA (Oberthur) tokens #2483

Updated Italian CNS to support IDEMIA (Oberthur) tokens #2483

Uh oh!

Conversation

3v1n0 commented Jan 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

frankmorgner commented Jan 15, 2022

Uh oh!

Uh oh!

Uh oh!

xhanulik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Fale commented Apr 18, 2022

Uh oh!

rghe commented May 8, 2022

Uh oh!

Jakuje commented Aug 16, 2022

Uh oh!

dengert commented Aug 16, 2022

Uh oh!

3v1n0 commented Nov 13, 2022

Uh oh!

3v1n0 commented Nov 13, 2022

Uh oh!

Jakuje left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Jakuje Nov 14, 2022

Choose a reason for hiding this comment

Uh oh!

frankmorgner left a comment

Choose a reason for hiding this comment

Uh oh!

frankmorgner left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

3v1n0 commented Jan 12, 2022 •

edited

Loading