Important!

Blog moved to https://blog.apdu.fr/

I moved my blog from https://ludovicrousseau.blogspot.com/ to https://blog.apdu.fr/ . Why? I wanted to move away from Blogger (owne...

Tuesday, March 14, 2017

ATR statistics: TC2 - Specific to T=0

Article from the series "ATR statistics"

TC2 - Specific to T=0

If present in the Answer-to-Reset, the interface byte TC2 encodes the waiting time integer WI over the eight bits, except the value '00' reserved for future use. If TC2 is absent, then the default value is WI = 10.

TC2#%

188991.17 %
0x0A472.27 %
0xFF200.97 %
0x10190.92 %
0x14180.87 %
0x0F140.68 %
0x96110.53 %
0x20100.48 %
0x8090.43 %
0x6050.24 %
0x1840.19 %
0x1E40.19 %
0x2A30.14 %
0x7830.14 %
0x0020.10 %
0x2320.10 %
0x3220.10 %
0x3E20.10 %
0xF020.10 %
0x0910.05 %
0x1C10.05 %
0x2810.05 %
0x6410.05 %
0xFA10.05 %
0xFE10.05 %



TC2 is only for T=0 cards.
It is surprising that 47 cards declare TC2=0x0A knowing that this is the default value.
It is also surprising that 2 cards (3B 95 15 40 00 68 01 02 00 00 and 3B A7 00 40 00 80 65 A2 08 00 00 00) are using the reserved value 0.

PC/SC sample in Smart Card Connector on Chromebook

To continue the list of PC/SC wrappers initiated in 2010 with "PC/SC sample in different languages" I now present a sample in Smart Card Connector on Chromebook (or Chrome browser).

Smart Card Connector

Smart Card Connector is a Chrome extension developed by Google and available at https://chrome.google.com/webstore/detail/smart-card-connector/khpfeaanjngmcnplbdlpegiifgpfgdco.

It allows to use the PC/SC API from a JavaScript application in a Chromebook. The project is a port of pcsc-lite, libccid and libusb to ChromeOS and is available at chromeos_smart_card_connector under the Apache v2 license.

I do not have a Chromebook myself but it is possible to use the Chrome browser instead (with some limitations).

Installation

Go to https://chrome.google.com/webstore/detail/smart-card-connector/khpfeaanjngmcnplbdlpegiifgpfgdco and select "Add to Chrome".

You should see the "Smart Card Connector" application in your chrome://apps/.

If you click on the application icon you should see something like:

Since the "Smart Card Connector" application completely replaces pcsc-lite and the CCID driver the normal pcsc-lite provided by the system must be stopped. See "Troubleshooting Apps under desktop OSes" to know how to stop pcscd.

Sample application

I created a simple test application for ChromeOS. The application is available from google-smart-card-client-library-hello-world.

You need to fetch a client library google-smart-card-client-library.js from Google and also jQuery. Just follow the Building instructions.

My sample application is greatly inspired from the Hello World Chrome application and Example JavaScript Smart Card Client app. My contribution is (mainly) the last 4 JavaScript functions.

Sample source code

I only provide the source code for the file pcsc_appli.js.


/** @license
 * Copyright 2017 Google Inc. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/**
 * @fileoverview Entry point of the Smart Card Client App background script (see
 * <https://developer.chrome.com/apps/event_pages>).
 */

/**
 * Client title for the connection to the server App.
 *
 * Currently this is only used for the debug logs produced by the server App.
 * @const
 */
var CLIENT_TITLE = 'example_js_client_app';

/**
 * Context for talking to the Smart Card Connector app for making PC/SC API
 * requests.
 * @type {GoogleSmartCard.PcscLiteClient.Context}
 */
var apiContext = null;

/**
 * Object that allows to make PC/SC API requests to the Smart Card Connector
 * app.
 * @type {GoogleSmartCard.PcscLiteClient.API}
 */
var api = null;

var API = GoogleSmartCard.PcscLiteClient.API;


/**
 * PC/SC-Lite SCard context.
 * @type {int}
 */
var sCardContext = null;

function initialize() {
  myLog('Establishing connection to the Connector app...');
  console.log('Establishing connection to the Connector app...');
  apiContext = new GoogleSmartCard.PcscLiteClient.Context(CLIENT_TITLE);
  apiContext.addOnInitializedCallback(onInitializationSucceeded);
  apiContext.addOnDisposeCallback(contextDisposedListener);
  apiContext.initialize();
}

function onInitializationSucceeded(constructedApi) {
  myLog('Successfully connected to the Connector app');
  console.log('Successfully connected to the Connector app');
  api = constructedApi;
  establishContext();
}

function establishContext() {
  myLog('Establishing PC/SC-Lite context...');
  console.log('Establishing PC/SC-Lite context...');
  api.SCardEstablishContext(
      GoogleSmartCard.PcscLiteClient.API.SCARD_SCOPE_SYSTEM, null, null).then(
      function(result) {
        result.get(onContextEstablished, onPcscLiteError);
      }, onRequestFailed);
}

/** @param {int} establishedSCardContext PC/SC-Lite SCard context. */
function onContextEstablished(establishedSCardContext) {
  myLog('Established PC/SC-Lite context ' + establishedSCardContext);
  console.log('Established PC/SC-Lite context ' + establishedSCardContext);
  sCardContext = establishedSCardContext;
  listReaders();
}

function listReaders() {
  myLog('Obtaining list of PC/SC-lite readers...');
  console.log('Obtaining list of PC/SC-lite readers...');
  api.SCardListReaders(sCardContext, null).then(function(result) {
    result.get(onReadersListed, onPcscLiteError);
  }, onRequestFailed);
}

/** @param {!Array.<string>} readers List of reader names. */
function onReadersListed(readers) {
  myLog('List of PC/SC-Lite readers: ' + readers);
  console.log('List of PC/SC-Lite readers: ' + readers);

    // Use the 1st reader
    reader = readers[0];
    myLog('Using reader: ' + reader);

    myCode(reader);
}

function contextDisposedListener() {
  myLog('Connection to the server app was shut down');
  console.warn('Connection to the server app was shut down');
  sCardContext = null;
  api = null;
  apiContext = null;
}

/** @param {int} errorCode PC/SC-Lite error code. */
function onPcscLiteError(errorCode) {
  myLog('PC/SC-Lite request failed with error code ' + errorCode);
  console.warn('PC/SC-Lite request failed with error code ' + errorCode);
}

/** @param {*} error The exception that happened during the request. */
function onRequestFailed(error) {
  myLog('Failed to perform request to the Smart Card Connector app: ' +
               error);
  console.warn('Failed to perform request to the Smart Card Connector app: ' +
               error);
}


function myLog(text)
{
    $("#logs").append($("<li>").text(text));
}

function myCode(readerName)
{
    myLog('Connect to the reader: ' + readerName);
    api.SCardConnect(sCardContext,
        readerName,
        API.SCARD_SHARE_SHARED,
        API.SCARD_PROTOCOL_ANY).then(function(result) {
            result.get(onConnected, onPcscLiteError);
    }, onRequestFailed);
}

function onConnected(cardHandle, protocol)
{
    APDU_SELECT = [0x00, 0xA4, 0x04, 0x00, 0x0A, 0xA0, 0x00, 0x00, 0x00,
        0x62, 0x03, 0x01, 0x0C, 0x06, 0x01];

    myLog('Sending ' + dump(APDU_SELECT));
    api.SCardTransmit(
      cardHandle,
      protocol == API.SCARD_PROTOCOL_T0 ?
          API.SCARD_PCI_T0 : API.SCARD_PCI_T1,
      APDU_SELECT).then(function(result) {
        result.get(function (ioRecvPci, response) {
            myLog('response: ' + dump(response));

            // get the 2 last bytes
            sw = response.slice(-2);
            if (sw[0] == 0x90 && sw[1] == 0x00)
            {
                APDU_COMMAND = [0x00, 0x00, 0x00, 0x00];
                myLog('Sending ' + dump(APDU_COMMAND));
                api.SCardTransmit(
                    cardHandle,
                    protocol == API.SCARD_PROTOCOL_T0 ?
                    API.SCARD_PCI_T0 : API.SCARD_PCI_T1,
                    APDU_COMMAND).then(function(result) {
                        result.get(function(ioRecvPci, response) {
                            myLog('response: ' + dump(response));

                            // get the 2 last bytes
                            sw = response.slice(-2);
                            if (sw[0] == 0x90 && sw[1] == 0x00)
                            {
                                // convert to an ASCII string
                                result = "";
                                for (var i = 0; i < response.length; i++)
                                {
                                    result += String.fromCharCode(response[i]);
                                }
                                myLog('response: ' + result);
                            }
                        }, onPcscLiteError);
                    }, onRequestFailed);
            }
            }, onPcscLiteError);
      }, onRequestFailed);
}


function dump(bytes)
{
    return (bytes.map(function (x) {
        return ('00' + x.toString(16).toUpperCase()).substr(-2)
    })).join(" ");
}

window.onload = initialize;

Remarks

This API is very verbose and low level. You can compare it to the node-pcsclite project API, also in JavaScript, I used in a previous article "PCSC sample in JavaScript (Node.js)".

The API uses a lot of call back functions. But that is not surprising for a JavaScript code.

Installation

To install the application in Chrome go to chrome://extensions/ and click on the "Load non packaged extension" button (label translated from French so the real English text may be different) and select the root directory of the sample application.

You should then see a new "Hello World PC/SC" extension in the list. Click on the "Run" link to start the extension. A new window should be created as displayed in the Output section bellow.

Output

Conclusion

This API is useful mainly/only on Chromebook computers. I guess it is the only smart card interface for this kind of computer.

If you know a PC/SC wrapper that is not yet in my list then please contact me.

Monday, March 6, 2017

macOS Sierra bug: SCardTransmit() silently truncates the card response

This is the first new PC/SC bug I find in macOS Sierra.
I imagine this bug is also present in El Capitan and Yosemite but I have not checked.

SCardTransmit() returns SCARD_S_SUCCESS when it should return SCARD_E_INSUFFICIENT_BUFFER

SCardTransmit() is used to transfer a command to the smart card and get the smart card answer.

If the reception buffer is not large enough to contain the card answer the PC/SC error SCARD_E_INSUFFICIENT_BUFFER should be returned and the expected size indicated in the pcbRecvLength parameter.

Instead, on macOS Sierra, SCARD_S_SUCCESS is returned and the card response is truncated with no indication that something went wrong.

See also

Apple bug report #30868184 "PC/SC SCardTransmit() silently truncates the smart card response".

Sample code

#include <stdio.h>
#include <string.h>

#ifdef __APPLE__
#include <PCSC/winscard.h>
#include <PCSC/wintypes.h>
#else
#include <winscard.h>
#endif

#define CHECK_RV(fct) if (SCARD_S_SUCCESS != rv) { printf(fct"() failed: %s\n", pcsc_stringify_error(rv)); ret = 0; goto error; } else { printf(fct"(): OK\n"); }

int main(void)
{
    int ret = 1;
    SCARDCONTEXT hContext;
    SCARDHANDLE hCard;
    DWORD dwActiveProtocol;
    LONG rv;
    char mszReaders[1024];
    DWORD dwReaders = sizeof(mszReaders);
    SCARD_IO_REQUEST ioRecvPci = *SCARD_PCI_T0; /* use a default value */
    unsigned char bSendBuffer[MAX_BUFFER_SIZE];
    unsigned char bRecvBuffer[MAX_BUFFER_SIZE];
    DWORD send_length, length;

    rv = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &hContext);
    CHECK_RV("SCardEstablishContext");

    rv = SCardListReaders(hContext, NULL, mszReaders, &dwReaders);
    CHECK_RV("SCardListReaders");

    rv = SCardConnect(hContext, mszReaders, SCARD_SHARE_SHARED,
        SCARD_PROTOCOL_T0 | SCARD_PROTOCOL_T1, &hCard,
        &dwActiveProtocol);
    CHECK_RV("SCardConnect");

    send_length = 5;
    /* GET RANDOM for a GPK card */
    memcpy(bSendBuffer, "\x80\x84\x00\x00\x20", send_length);

    /* expected size is 0x20 + 2 = 34 bytes */
    length = 2;
    printf("Given length: %d\n", length);
    rv = SCardTransmit(hCard, SCARD_PCI_T0, bSendBuffer, send_length,
        &ioRecvPci, bRecvBuffer, &length);
    printf("Expected length: %d\n", length);
    if (SCARD_E_INSUFFICIENT_BUFFER == rv)
        printf("test PASS. Insufficient buffer is expected\n");
    else
        printf("test FAIL\n");
    CHECK_RV("SCardTransmit");
    if (SCARD_S_SUCCESS == rv)
    {
        size_t i;

        for (i=0; i<length; i++)
            printf("%02X ", bRecvBuffer[i]);
        printf("\n");
    }

    rv = SCardDisconnect(hCard, SCARD_UNPOWER_CARD);
    CHECK_RV("SCardDisconnect")

    rv = SCardReleaseContext(hContext);
    CHECK_RV("SCardReleaseContext")

error:
    return ret;
}

The program sends a GET RANDOM command to a GPK card (very old card from Gemplus). The card will answer with 32 random bytes + 2 bytes for SW.

You can use any command that sends at least one bye of data instead.

Result (on Sierra)

$ cc -framework PCSC -g -Wall main.c -o main

SCardEstablishContext(): OK
SCardListReaders(): OK
SCardConnect(): OK
Given length: 2
Expected length: 2
test FAIL
SCardTransmit(): OK
5B 8F 
SCardDisconnect(): OK
SCardReleaseContext(): OK

The value "5B 8F" is just the 2 first bytes returned by the card. The other 30 bytes and the status word (SW) are lost.

I note that if I use the values 0 or 1 for length then SCardTransmit() correctly returns SCARD_E_INSUFFICIENT_BUFFER. So the Sierra code has a check to reject a buffer of smaller than 2 bytes. The code should check the given size compared to the real card answer.

Expected result (on Debian)

$ CFLAGS=`pkg-config --cflags libpcsclite` LDFLAGS=`pkg-config --libs libpcsclite` make main
cc -pthread -I/usr/include/PCSC   -lpcsclite   main.c   -o main

SCardEstablishContext(): OK
SCardListReaders(): OK
SCardConnect(): OK
Given length: 2
Expected length: 34
test PASS. Insufficient buffer is expected
SCardTransmit() failed: Insufficient buffer.

On Debian we get the expected SCARD_E_INSUFFICIENT_BUFFER error. And we also get the correct length value to store the complete card answer. Here 34 bytes.

Known workaround

Be sure your reception buffer is large enough to contain the card answer + 2 bytes for SW.

This should be the case for all correctly written application. That explains why nobody found the bug earlier.

I found the problem while playing with a particular PC/SC Unitary Test (for pcsc-lite) on macOS: BufferOverflow_SCardTransmit.c

Friday, February 17, 2017

PySCard 1.9.5 released

I just released a new official version 1.9.5 of pyscard. PySCard is a python module adding smart cards support (PC/SC) to Python.

The PySCard project is available at:

Changes

1.9.5 (Feb 2017)
  • SCardGetStatusChange(): fix a memory leak with Python 3
  • SCardTransmit(): use SCARD_PCI_RAW for undefined protocol
  • Improve epydoc documentation

Saturday, February 11, 2017

New PyKCS11 1.4.1 available

I just released a new version of PyKCS11, a Python wrapper above the PKCS#11 API.

See PyKCS11 introduction for more details about PyKCS11.

Changes:
1.4.1 - February 2017, Ludovic Rousseau
  • fix compilation under Python 3
  • add rsa encryption sample program

Sunday, February 5, 2017

Mostly CCID driver for some Morpho devices

Some devices from Morpho are mostly CCID compliant. The devices are too far from the CCID specification so I do not plan to add support of these devices in my CCID driver.

Patches

Morpho sent me (untested) patches:
These patches for for the CCID driver version 1.4.3 (released in April 2011) and may not apply correctly on the latest CCID driver.

Devices

Morpho devices supported by the patches:
NameVendorIDProductID
MORPHO TOKEN E20x079B0x008F
MORPHO TOKEN EM0x67670x0104
MORPHO TOKEN EM0x1A6F0x0104

The token "MORPHO TOKEN EM" is also known as "Morpho ypsID Key E". This device is in my "Disabled CCID readers" list.

No support from me

I do not support these devices or the patches. Do not request help from me, contact Morpho instead.

I just make the patches public and document them so you may have a chance to use your Morpho token.

Saturday, February 4, 2017

New PyKCS11 1.4.0 available

I just released a new version of PyKCS11, a Python wrapper above the PKCS#11 API.

See PyKCS11 introduction for more details about PyKCS11.

 Changes:
1.4.0 - February 2017, Ludovic Rousseau
  • fix closeAllSessions() and move it from Session to PKCS11Lib
  • add RSAOAEPMechanism to support RSA Encryption
  • add DigestSession which enables multi-part digesting
  • add Elliptic Curve keypair generating mechanism
  • fix bug in Templates using booleans CK_TRUE/CK_FALSE
    Templates are used by generateKey(), generateKeyPair(), findObjects() createObject(), unwrapKey()
  • fix dumpit.py sample for Python 3

I also noticed that I forgot to blog about the previous version: 1.3.3

1.3.3 - November 2016, Ludovic Rousseau
  • PKCS#11 definitions: sync with Cryptoki version 2.40
    • add missing CKM_* and CKP_* defines
  • Add generateKey() with default mechanism CKM_AES_KEY_GEN
  • Make sure the PyKCS11Lib is referenced as long as Session object is live
  • Fix OverflowError on Windows
  • Attribute CKA_WRAP_WITH_TRUSTED is bool
  • samples
    • dumpit: ask to enter the PIN on the pinpad if needed
    • getinfo & dumpit: add --slot= parameter
  • some minor improvements