Support for IDPrime MD 830, 930 and 940 cards #2666
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
Author
|
Added reading of cmap file, which contains records holding private key container names and index of corresponding certificates. It is used for the detection of CA certificates on the card. For IDPrime 940, there is also a second PIN (Digital Signature PIN) used for accessing CC certificates on the card. File |
Jakuje
reviewed
Feb 9, 2023
This was referenced Mar 3, 2023
xhanulik
force-pushed
the
idprime
branch
2 times, most recently
from
51b87d4 to
84642ac
Compare
3 tasks
Jakuje
approved these changes
Apr 12, 2023
frankmorgner
requested changes
Apr 13, 2023
`kxc` and `ksc` objects denote certificates. Certificate objects can be standalone - then we expect that they have public and private keys on the card, or there can be `priprk` and `pubksc` denoting corresponding private a public keys.
Cmap file contains records denoting container name and the record index corresponds to the index of certificate.
IDPrime 940 uses digital signature pin for accessing CC certificates
File 0x0005 on IDPrime 940 contains 8 bytes records, which probably denote key reference and PIN index associated with certificate index.
Jakuje
reviewed
May 4, 2023
frankmorgner
requested changes
May 26, 2023
Member
frankmorgner
left a comment
frankmorgner
left a comment
There was a problem hiding this comment.
Please look at @Jakuje comment about the possible memory leak, thank you.
To indicate that the returned memory does not need to be free'd.
frankmorgner
approved these changes
Jun 5, 2023
Member
|
Thank you! |
1 task
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Driver
card-idprime.cdoes not support some of the IDPrime cards - MD 830, 930 and 940.The main problem is not matching key references that are assigned during the processing of the index file. The key references were recently set according to the OS version. However, some of the tested cards shared the same OS version but different key references of the private keys. The card matching is now done via ATR for particular card types, and the key reference offsets are distinguished according to
card->type.The
idprime_process_index()function for processing the0x0101file adds the found certificate objects to the card. The index file contains entries which (probably) differ as the certificates were imported to the card with different tools. The entries can bekscorkxcalone - card should have corresponding private and public keyksc/kxcwithpubkxs/pubkxc- certificate is missing corresponding private key (CA certificates)priprk,ksc/kxcandpubkxs/pubkxc- card should have the corresponding private and public keyEach certificate entry contains an index and the offset used for getting the private key reference.
Certificates that are missing a private key on the card are also added to the card but with some dummy key reference, which is then processed in
sc_pkcs15emu_idprime_init(), where only the public key is added.IDPrime 930 and 940 cards can work with 4096b RSA keys, which is added to the card initialization.
Cards also support EC keys and certificates - the
sc_pkcs15emu_idprime_init()is extended by adding EC keys to the card. When signing with ECDSA keys, the data for signature needs to be padded (probably to some multiple of 8 bytes) before sending to the card.The changes were tested with cards
There are still some issues which need to be addressed
idprime_process_index()) of EC keys may differ from the key references of RSA key