Bug 5158 - some smart cards cannot authenticate
Summary: some smart cards cannot authenticate
Status: CLOSED FIXED
Alias: None
Product: ThinLinc
Classification: Unclassified
Component: Client (show other bugs)
Version: trunk
Hardware: PC Unknown
: P2 Normal
Target Milestone: 4.3.0
Assignee: Pierre Ossman
URL:
Keywords: hean01_tester, prosaic
Depends on:
Blocks:
 
Reported: 2014-05-22 11:20 CEST by Pierre Ossman
Modified: 2014-10-08 09:24 CEST (History)
1 user (show)

See Also:
Acceptance Criteria:


Attachments

Description Pierre Ossman cendio 2014-05-22 11:20:15 CEST
Reported on issue 15230 about Portuguese eID. ThinLinc would fail to authenticate with those cards with this in the log:

2014-05-19T15:58:31: Signature operation failed (112)

112 is CKR_MECHANISM_INVALID, meaning that the algorithm we needed for signing isn't available. This is also confirmed by pkcs11-tool:

Supported mechanisms:
  SHA-1, digest
  SHA256, digest
  SHA384, digest
  SHA512, digest
  MD5, digest
  RIPEMD160, digest
  GOSTR3411, digest
  RSA-PKCS, keySize={512,2048}, hw, decrypt, sign, verify
  RSA-PKCS-KEY-PAIR-GEN, keySize={512,2048}, generate_key_pair

The one we need is SHA1-RSA-PKCS. Comparison with a "good" card:

Supported mechanisms:
  SHA-1, digest
  SHA256, digest
  SHA384, digest
  SHA512, digest
  MD5, digest
  RIPEMD160, digest
  GOSTR3411, digest
  RSA-X-509, keySize={512,2048}, hw, decrypt, sign, verify
  RSA-PKCS, keySize={512,2048}, hw, decrypt, sign, verify
  SHA1-RSA-PKCS, keySize={512,2048}, sign, verify
  SHA256-RSA-PKCS, keySize={512,2048}, sign, verify
  MD5-RSA-PKCS, keySize={512,2048}, sign, verify
  RIPEMD160-RSA-PKCS, keySize={512,2048}, sign, verify
  RSA-PKCS-KEY-PAIR-GEN, keySize={512,2048}, generate_key_pair

After some digging around it turns out that OpenSC is mishandling hash algorithms. The lower layers report what hashes are supported in hardware. This then influences the reported hashes, even though all the hashes in the upper layer are done in software. I.e. looking at those hardware flags is entirely pointless and even damaging.
Comment 1 Pierre Ossman cendio 2014-05-22 11:21:00 CEST
This fix has been confirmed to solve the issue, and it's been sent upstream:

https://github.com/OpenSC/OpenSC/pull/241
Comment 2 Pierre Ossman cendio 2014-05-22 11:22:31 CEST
Side note: Our cards can't do these hashes in hardware either. But there are several instances of hacky workarounds in the current code. The reason our cards happen to work is because they support RSA-X-509, which entirely unrelated fixes up the hash flags.
Comment 3 Pierre Ossman cendio 2014-06-19 13:30:06 CEST
r29088.
Comment 4 Henrik Andersson cendio 2014-10-08 09:24:06 CEST
Tested a bunch of cards using ThinLinc client build 4480, works as expected.

Note You need to log in before you can comment on or make changes to this bug.