Subject: [Pam_PKCS11] LDAP mapper - msg#00050

Previous Message by Date: click to view message preview

Re: PKCS#15: max_pin_length

Addendum. Unforunately, it's more worse. I wrote that up to 16 character pins are usable. That is true for the pin only. If I use a more than 8 character pin for storing of data, I got an error: max_pin_length in pkcs15.profile and in cardos.profile for example 15 (or 16). pkcs15-init --erase-card --create-pkcs15 --no-so-pin pkcs15-init --store-pin --auth-id 01 --label "Hans User" --pin USERPIN --puk "" pkcs15-init --store-data data.txt --label DATA --auth-id 01 --pin USERPIN sec.c:201:sc_pin_cmd: returning with: Invalid arguments Failed to verify user PIN (ref=0x1) Failed to store data object: Invalid arguments The same procedure with max_pin_length 8 is successful without any messages. Mike. -- View this message in context: http://www.nabble.com/PKCS-15%3A-max_pin_length-tf3605656.html#a10092089 Sent from the OpenSC - User mailing list archive at Nabble.com.

Next Message by Date: click to view message preview

Re: PKCS#15: data file with pin protected read access, howto?

This is a multi-part message in MIME format. Michael Roehner wrote: I tried the patch. Now I'm able to read the data with: pkcs15-tool --read-data-object DATA I have to enter the pin and the data file is read. BUT pkcs15-tool --read-data-object DATA --pin USERPIN fails furthermore. The --pin argument is ignored. ack, next try ;-) Nils Index: src/tools/pkcs15-tool.c =================================================================== --- src/tools/pkcs15-tool.c (Revision 3148) +++ src/tools/pkcs15-tool.c (Arbeitskopie) @@ -324,16 +324,22 @@ if (verbose) printf("Reading data object with label '%s'\n", opt_data); - r = sc_pkcs15_read_data_object(p15card, cinfo, &data_object); - if (r) { - fprintf(stderr, "Data object read failed: %s\n", sc_strerror(r)); - if (r == SC_ERROR_FILE_NOT_FOUND) - continue; /* DEE emulation may say there is a file */ + r = authenticate(objs[i]); + if (r >= 0) { + r = sc_pkcs15_read_data_object(p15card, cinfo, &data_object); + if (r) { + fprintf(stderr, "Data object read failed: %s\n", sc_strerror(r)); + if (r == SC_ERROR_FILE_NOT_FOUND) + continue; /* DEE emulation may say there is a file */ + return 1; + } + r = print_data_object("Data Object", data_object->data, data_object->data_len); + sc_pkcs15_free_data_object(data_object); + return r; + } else { + fprintf(stderr, "Authentication error: %s\n", sc_strerror(r)); return 1; } - r = print_data_object("Data Object", data_object->data, data_object->data_len); - sc_pkcs15_free_data_object(data_object); - return r; } fprintf(stderr, "Data object with label '%s' not found.\n", opt_data); return 2; @@ -353,7 +359,6 @@ for (i = 0; i < count; i++) { int idx; struct sc_pkcs15_data_info *cinfo = (struct sc_pkcs15_data_info *) objs[i]->data; - struct sc_pkcs15_data *data_object; printf("Reading data object <%i>\n", i); printf("applicationName: %s\n", cinfo->app_label); @@ -369,16 +374,20 @@ printf("\n"); } else printf("NONE\n"); - printf("Path : %s\n", sc_print_path(&cinfo->path)); - r = sc_pkcs15_read_data_object(p15card, cinfo, &data_object); - if (r) { - fprintf(stderr, "Data object read failed: %s\n", sc_strerror(r)); - if (r == SC_ERROR_FILE_NOT_FOUND) - continue; /* DEE emulation may say there is a file */ - return 1; + printf("Path: %s\n", sc_print_path(&cinfo->path)); + printf("Auth ID: %s\n", sc_pkcs15_print_id(&objs[i]->auth_id)); + if (objs[i]->auth_id.len == 0) { + struct sc_pkcs15_data *data_object; + r = sc_pkcs15_read_data_object(p15card, cinfo, &data_object); + if (r) { + fprintf(stderr, "Data object read failed: %s\n", sc_strerror(r)); + if (r == SC_ERROR_FILE_NOT_FOUND) + continue; /* DEE emulation may say there is a file */ + return 1; + } + r = list_data_object("Data Object", data_object->data, data_object->data_len); + sc_pkcs15_free_data_object(data_object); } - r = list_data_object("Data Object", data_object->data, data_object->data_len); - sc_pkcs15_free_data_object(data_object); } return 0; } @@ -854,7 +863,10 @@ return r; pin_info = (sc_pkcs15_pin_info_t *) pin_obj->data; - pin = get_pin("Please enter PIN", pin_obj); + if (opt_pin != NULL) + pin = opt_pin; + else + pin = get_pin("Please enter PIN", pin_obj); return sc_pkcs15_verify_pin(p15card, pin_info, pin, pin? strlen((char *) pin) : 0);

Previous Message by Thread: click to view message preview

PKCS#15: max_pin_length

I'am using OpenSC 0.11.2-rc1 with Siemens CardOS M4.01a. In cardos.profile I increased max_pin_length to 32. But pkcs15-init --store-pin do a PUT DATA OCI with pin length 16 (--pin arg < 16 chars, 0 padded up to 16 chars) without any message. If --pin arg is > 16 chars, an error message is shown: "invalid pin length: nn (max 16)". pkcs15-tool --change-pin do a CHANGE REFERENCE DATA with right two 32 byte keys and therefore must fail. If I change max_pin_length to 16, all is ok. Is 16 a defined maximum somewhere in the specs? Then ALL the tools shall warn about this even --pin arg is < 16 chars. Otherwise it seems to be an error. Mike. -- View this message in context: http://www.nabble.com/PKCS-15%3A-max_pin_length-tf3605656.html#a10073568 Sent from the OpenSC - User mailing list archive at Nabble.com.

Next Message by Thread: click to view message preview

unsupported card driver default

 Hello;   Thank you for answering my question before. Now, I have an other problem; I am using a smarcard wich has SMARTCOS as operating system. In the opensc.conf file a set of card drivers has been defined. My question is : What are changes that i can make to deal about SMARTCOS card, it has the following ATR : 3B 8C 40 FA 80 81 05 52 01 01 A0 00 00 01 50 01; I can do some changes, but I am not sure that all the required updates are taken into account. Best regards Be smarter than spam. See how smart SpamGuard is at giving junk email the boot with the All-new Yahoo! Mail