Nabble - MuscleCard

Re: pkcs11?

2009-12-05T10:16:25Z

On Thu, Dec 03, 2009 at 10:13:40PM +0000, João Poupino wrote:
>> Errors:
>> % openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
>> engine "pkcs11" set.
>> [opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
>> [opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
>> Login failed
>
> 0x9C02 is "Auth Failed". Are you sure you have entered the correct PIN?

I finally got this running. Looks like I had some mismatching versions
(some packages recompiled from debian testing running on debian stable).
After downgrading all pcscd and opensc related packages to debian stable
again, everything is working using pkcs15-tool, pkcs15-init, and the
pkcs11 library from opensc. Note that I did *not* have to initialize
using muscleTool, this isn't necessary (and still doesn't work).

I've summarized everything (building java applet, uploading to card,
generating keys + certs and using that for openvpn authentication) on my
blog at http://blog.runtux.com/2009/12/05/150/
I hereby grant permission to reuse this documentation for enhancing
documentation of the packages involved under any open source license
necessary.

I still get an error when first generating a 2048 bit key, then
reinitialize with pkcs15-init -E, then try to generate a 1024 bit
key, summarized at
http://blog.runtux.com/2009/12/05/150/#some-notes-on-key-sizes and
already reported as a bug for debian
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559471
This also fails with the same error the other way round (first 1024 then
2048 bit key).
It also seems that the old version of opensc on debian *can* generate
2048 bit keys but *can't* use these for generating certificates and
signatures (these were fixed in later versions of opensc than the one
shipping with debian stable aka lenny).

When testing uploading of applets I discovered a bug in the hello world
upload script for my card and reported this to gpshell. It's scheduled
for inclusion into the next release of gpshell:
https://sourceforge.net/tracker/?func=detail&atid=755201&aid=2908789&group_id=143343

I'll report my changes to the cross-JVM-build process of the MCardApplet
once my registration for allioth worked. Seems like I can't do anonymous
bug-reports at allioth. I've summarized the changes I made in the
above-cited blog post. This is essential for people trying to build the
applet under Linux, because the old java and javac executables from
an ancient version of java development environment do no longer run on
modern systems due to library incompatibilities.

Thanks to everybody for helping me to get this running!

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:29:31Z

On Thu, Dec 03, 2009 at 10:13:40PM +0000, João Poupino wrote:
>
> 0x9C02 is "Auth Failed". Are you sure you have entered the correct PIN?

It didn't ask for a PIN.

> Try this, just to be sure: set all PINs (including the ones in
> pkcs15-init) to 00000000. Then try the same operation. If it works, I
> think I know the solution.
All keys are set to 00000000 anyway...
I've also tried to directly specify the key on the openssl command line:

% openssl req -passin pass:00000000 -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
engine "pkcs11" set.
[opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
[opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
Login failed
PKCS11_get_private_key returned NULL
unable to load Private Key
714:error:80005005:Vendor defined:PKCS11_login:General Error:p11_slot.c:145:
714:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:114:

But another poster on the list claimed that I had to format the
token first using muscleTool. So far I haven't been able to do that.
Strange that the pkcs15-init works without formatting, though.

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:22:33Z

On Thu, Dec 03, 2009 at 10:49:25PM +0100, Ludovic Rousseau wrote:
> You could also use the bundleTool command to add the card ATR to the
> correct Info.plist file. That should be easier than doing it by hand.

Now I'm getting
muscleTool > tokens
1. MuscleCard Applet

ListTokens Success.
muscleTool > format 1
ERR: EstablishConnection Failed ! (0x9C52 Token is unsupported)

Looks like I'm giving up for today :)
Maybe debian stable is just too old.

Thanks, Ralf

--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:16:50Z

On Thu, Dec 03, 2009 at 10:49:25PM +0100, Ludovic Rousseau wrote:
> You could also use the bundleTool command to add the card ATR to the
> correct Info.plist file. That should be easier than doing it by hand.

Ah, found the tool. This worked, I'm now seeing a token.
What magic does that tool weave in addition to putting a entry into
the plist?

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:16:11Z

Just my 2 cents, muscleTool on debian does not like my muscle applet cards too. they have the a0 000000 0101 aid.

My solution to on card cryptography was to buy some cryptoflex which are realy pkcs15 cards :( too bad.

Seb

On Thu, Dec 3, 2009 at 11:13 PM, João Poupino <joao.poupino@...> wrote:

Hi,

Ralf Schlatterbeck wrote:

I now have successfully built and loaded the muscle applet onto my
Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)

Good to hear :)

I can -- using opensc tools -- build a pkcs15 structure on the card,
erase, initalize, set an ID and generate a key. But when I try to
use the card with pkcs11 and openssl I'm getting errors (see below).
I'm using the opensc-pkcs11 library.

Should I use another pkcs11 lib that is more specific to muscle?

Or any hints on what might be wrong with my configuration/card/etc?

Working:
pkcs15-init -E --create-pkcs15 --no-so-pin
pkcs15-init --store-pin --auth-id 01 --label "User Name"
pkcs15-tool --list-pins
pkcs15-init --generate-key rsa/1024 --auth-id 01
#(or alternatively a 2048 bit key)
pkcs15-tool --list-keys
pkcs15-tool --list-public-keys

Errors:
% openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
engine "pkcs11" set.
[opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
[opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
Login failed

0x9C02 is "Auth Failed". Are you sure you have entered the correct PIN?

Try this, just to be sure: set all PINs (including the ones in pkcs15-init) to 00000000. Then try the same operation. If it works, I think I know the solution.

<snip>

João

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:13:40Z

Hi,

Ralf Schlatterbeck wrote:
> I now have successfully built and loaded the muscle applet onto my
> Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)

Good to hear :)

>
> I can -- using opensc tools -- build a pkcs15 structure on the card,
> erase, initalize, set an ID and generate a key. But when I try to
> use the card with pkcs11 and openssl I'm getting errors (see below).
> I'm using the opensc-pkcs11 library.
>
> Should I use another pkcs11 lib that is more specific to muscle?
>
> Or any hints on what might be wrong with my configuration/card/etc?
>
> Working:
> pkcs15-init -E --create-pkcs15 --no-so-pin
> pkcs15-init --store-pin --auth-id 01 --label "User Name"
> pkcs15-tool --list-pins
> pkcs15-init --generate-key rsa/1024 --auth-id 01
> #(or alternatively a 2048 bit key)
> pkcs15-tool --list-keys
> pkcs15-tool --list-public-keys
>
> Errors:
> % openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
> engine "pkcs11" set.
> [opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
> [opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
> Login failed

0x9C02 is "Auth Failed". Are you sure you have entered the correct PIN?

Try this, just to be sure: set all PINs (including the ones in
pkcs15-init) to 00000000. Then try the same operation. If it works, I
think I know the solution.

<snip>

João
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T14:10:15Z

On Thu, Dec 03, 2009 at 10:49:25PM +0100, Ludovic Rousseau wrote:
>
> You could also use the bundleTool command to add the card ATR to the
> correct Info.plist file. That should be easier than doing it by hand.

OK, I've checked, the card identifies as 3b:95:95:40:ff:ae:01:03:00:00
(using cardos-info from opensc). This is listed in
http://ludovic.rousseau.free.fr/softwares/pcsc-tools/smartcard_list.txt

I've put this ID into
/usr/lib/pcsc/services/mscMuscleCard.bundle/Contents/Info.plist
on a debian lenny machine -- doesn't change anything (after restarting
pcscd). Do I have to recompile something (and wasn't one of the ideas
behind using java on smartcards to be able to use unchanged middleware
on the host)?

Thanks, Ralf

--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: applet download for Gemalto TOP IM FIPS CY2

2009-12-03T14:10:09Z

Hi,

nvdatalimit is not the applet size. It's a mean to say to the card, "my applet won't exceed nvcodelimit bytes, so reject the load operation if I'm lying"

The same applies for nvdatalimit: "hello card, me, nice applet, I promise that I will not use more than nvdatalimit bytes of eeprom for my persistent objects, please check I'm not lying".

My experience is that for all normal "experimentation" situations the -nv*limit option are 100% useless.
In your own testing card, who cares if your applet uses 1.2 k of ram instead of 1.1 k? or 18574 bytes of eeprom instead of 18543?

This is only putting additional complexity to a somewhat complex situation. It's sufficiently complicated to deal with SCP version, option, keys, auth level, card manager AID (a sort of "myth", the card manager is very often default selected so you don't need to select it if you don't know what "privilege 04" means and your card is not a SIM+javacard that could have a default selected SIM applet), ...

I guess these options were invented when company A owns a card, accept to load the applet of company B provided it does not consume all the space A could use in the future (and pays for the space it intends to use).

Just don't use these 'limit' args, they are not needed for a successful loading.

But don't forget the Trusted Labs captransf.jar if you want to load anything on a cyberflex like card.

Regards,
Sebastien.

On Thu, Dec 3, 2009 at 7:03 PM, emanuele gringeri <eerbalibera@...> wrote:

Ralf Schlatterbeck ha scritto:

> Answering my own mail:
>
> On Thu, Dec 03, 2009 at 02:06:15PM +0100, Ralf Schlatterbeck wrote:
>
>> Just got my Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>>
>> But downloading the MCardApplet -- both my homegrown one and one
>> downloaded from
>> http://www.opensc-project.org/opensc/attachment/wiki/Cyberflex/CardEdgeII.ijc
>> leads the following error after issuing the install_for_install command:
>>
> [...]
>
> I've done a little investigation into the magic numbers used by
> gpshell. Looks like I can find out the argument to the first select command:
>
> select -AID a000000003000000
>
> by doing:
> enable_trace
> establish_context
> card_connect
> open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
> get_status -element 80
>
> this gives me the following output (in addition to some debug output):
> List of applets (AID state privileges)
> a000000003000000 7 0
>
> The other two AIDs seem to be dependent on the applet used (the applet codes
> the applet ID internally). I came to this conclusion by changing the IDs
> in the hello world downloader and seeing it fail.
>
> Then I looked into the download script for the hello world applet.
> When unpacking the HelloWorld.cap.transf or HelloWorld.cap file with unzip
> I'm getting several .cap files. The Applet.cap contains the following
> (in hex):
>
> 000000 03 00 0e 01 0a a0 00 00 00 62 03 01 0c 01 01 00
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 000010 14
> 000011
>
> Now compare this with the Applet IDs used for downloading, citing
> from helloInstallCyberflexAccess64k.txt from the gpshell distribution:
>
> install_for_install -instParam 00 -priv 02 -AID a00000006203010c0101 -pkgAID a00000006203010c01 -instAID a00000006203010c0101 -nvDataLimit 500
> ^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^
>
> with that info I was able to find out the correct downloading script for
> my homegrown applet, note the commented-out commands which use the wrong
> applet ID (see below). My applet seems to use the AID a00000000101
>
> Now my question:
> - Is there some documentation on these magic numbers?
> - Seems in all docs the MCardApplet uses the other ID I tried first
> so something in my build-process probably doesn't correctly set
> the applet ID. How should I change that?
>
> # gpshell script for loading applet into card:
> enable_trace
> establish_context
> card_connect
> select -AID a000000003000000
> open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
> delete -AID a00000000101
> delete -AID a000000001
> delete -AID a0000003230101
> delete -AID a00000032301
> #install_for_load -pkgAID a00000032301 -nvCodeLimit 16000 -sdAID a000000003000000
> install_for_load -pkgAID a000000001 -nvCodeLimit 16000 -sdAID a000000003000000
> load -file CardEdgeCflex.ijc
> #install_for_install -instParam 00 -priv 02 -AID a0000003230101 -pkgAID a00000032301 -instAID a0000003230101 -nvDataLimit 16000
> install_for_install -instParam 00 -priv 02 -AID a00000000101 -pkgAID a000000001 -instAID a00000000101 -nvDataLimit 32000
> get_status -element 20
> card_disconnect
> release_context
>
>
> Thanks, Ralf
>

I have been able to load the my homemade applet with the following script:

mode_201

enable_trace
establish_context
card_connect
select -AID a0000000030000

open_sc -security 0 -keyind 0 -keyver 0 -mac_key
404142434445464748494a4b4c4d4e4f -enc_key

404142434445464748494a4b4c4d4e4f // Open secure channel
install_for_load -pkgAID a000000001 -nvCodeLimit 19300
load -file CardEdgeCflex.ijc

install_for_install -instParam 00 -priv 02 -AID a00000000101 -pkgAID

a000000001 -instAID a00000000101 -nvDataLimit 13400
card_disconnect
release_context

You have to use the AID that you use in common.xml when you did compile
the applet with ant.

1. nvCodeLimit is the applet size.
2. nvDataLimit is the size of memory that u want to use for ur private
objctes... I guess ..

cheers.

PS for gpshell is better use the gpshell ML.

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T13:49:25Z

2009/12/3 emanuele gringeri <eerbalibera@...>:

> Ralf Schlatterbeck ha scritto:
>> On Thu, Dec 03, 2009 at 09:29:13PM +0100, emanuele gringeri wrote:
>> Hmm, doesn't seem to work, the muscleTool (version: 2.1.0 from debian lenny)
>> when trying to query with "tokens" :
>>
>> muscleTool > tokens
>> No Valid Tokens Found
>>
>> Does this expect a certain applet ID for the muscle applet?
>>
> Yes it does. Take a look at
> /usr/local/pcsc/services/mscMuscleCard.bundle/Contents/Info.plist

You could also use the bundleTool command to add the card ATR to the
correct Info.plist file. That should be easier than doing it by hand.

Bye

--
Dr. Ludovic Rousseau
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T13:45:37Z

On Thu, Dec 03, 2009 at 10:11:16PM +0100, emanuele gringeri wrote:
> Ralf Schlatterbeck ha scritto:
> > Hmm, doesn't seem to work, the muscleTool (version: 2.1.0 from debian lenny)
> > when trying to query with "tokens" :
> >
> > muscleTool > tokens
> > No Valid Tokens Found
> >
> > Does this expect a certain applet ID for the muscle applet?

> Yes it does. Take a look at
> /usr/local/pcsc/services/mscMuscleCard.bundle/Contents/Info.plist

> > I've built the MCard applet with AID A0:00:00:00:01:01

Looks like it's the same:
<key>spDefaultApplication</key>
<string>A00000000101</string>

Note that I can see the card with other (pkcs15, some pkcs11) tools
but obviously not with muscleTool

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T13:08:34Z

Ralf Schlatterbeck ha scritto:

> On Thu, Dec 03, 2009 at 09:29:13PM +0100, emanuele gringeri wrote:
>
>> Ralf Schlatterbeck ha scritto:
>>
>>> On Thu, Dec 03, 2009 at 07:53:58PM +0100, emanuele gringeri wrote:
>>>
>>>
>>>> Ralf Schlatterbeck ha scritto:
>>>>
>>>>
>>>>> I now have successfully built and loaded the muscle applet onto my
>>>>> Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>>>>>
>>>>>
>>>> Did u format the applet?
>>>>
>>>>
>>> What do you mean?
>>> - I'm loading the applet to the card using gpshell
>>> - then I'm setting the pin to all zeros using opensc-tool:
>>> - Then I'm formatting the card with pkcs15-init -E --create-pkcs15 --no-so-pin
>>>
>>> Is that what you mean by formatting? Or am I missing something?
>>>
>>>
>> you missing something . Download and install muscletools, and then go
>> trought the format phase.
>>
>
> Hmm, doesn't seem to work, the muscleTool (version: 2.1.0 from debian lenny)
> when trying to query with "tokens" :
>
> muscleTool > tokens
> No Valid Tokens Found
>
> Does this expect a certain applet ID for the muscle applet?
>

Yes it does. Take a look at
/usr/local/pcsc/services/mscMuscleCard.bundle/Contents/Info.plist

> I've built the MCard applet with AID A0:00:00:00:01:01
> If I change the ID to A0:00:00:03:23:01 as commented-out in
> the ant build file of the applet, pkcs15 is no longer working
> and the card isn't recognized at all.
>
>
>> One question . What 's reader do u use?
>>
>
> Gemalto USB Shell V2 (GemPC Key) (for ID-000 SIM smartcards)
>
> Thanks, Ralf
>

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T13:02:34Z

On Thu, Dec 03, 2009 at 09:29:13PM +0100, emanuele gringeri wrote:

> Ralf Schlatterbeck ha scritto:
> > On Thu, Dec 03, 2009 at 07:53:58PM +0100, emanuele gringeri wrote:
> >
> >> Ralf Schlatterbeck ha scritto:
> >>
> >>> I now have successfully built and loaded the muscle applet onto my
> >>> Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
> >>>
> >> Did u format the applet?
> >>
> > What do you mean?
> > - I'm loading the applet to the card using gpshell
> > - then I'm setting the pin to all zeros using opensc-tool:
> > - Then I'm formatting the card with pkcs15-init -E --create-pkcs15 --no-so-pin
> >
> > Is that what you mean by formatting? Or am I missing something?
> >
> you missing something . Download and install muscletools, and then go
> trought the format phase.

Hmm, doesn't seem to work, the muscleTool (version: 2.1.0 from debian lenny)
when trying to query with "tokens" :

muscleTool > tokens
No Valid Tokens Found

Does this expect a certain applet ID for the muscle applet?
I've built the MCard applet with AID A0:00:00:00:01:01
If I change the ID to A0:00:00:03:23:01 as commented-out in
the ant build file of the applet, pkcs15 is no longer working
and the card isn't recognized at all.

> One question . What 's reader do u use?

Gemalto USB Shell V2 (GemPC Key) (for ID-000 SIM smartcards)

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T12:27:39Z

Ralf Schlatterbeck ha scritto:

> On Thu, Dec 03, 2009 at 07:53:58PM +0100, emanuele gringeri wrote:
>
>> Ralf Schlatterbeck ha scritto:
>>
>>> I now have successfully built and loaded the muscle applet onto my
>>> Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>>>
>>> I can -- using opensc tools -- build a pkcs15 structure on the card,
>>> erase, initalize, set an ID and generate a key. But when I try to
>>> use the card with pkcs11 and openssl I'm getting errors (see below).
>>> I'm using the opensc-pkcs11 library.
>>>
>> Did u format the applet?
>>
> What do you mean?
> - I'm loading the applet to the card using gpshell
> - then I'm setting the pin to all zeros using opensc-tool:
> opensc-tool -s 00:A4:04:00:06:A0:00:00:00:01:01 -s
> B0:2A:00:00:38:08:4D:75:73:63:6C:65:30:30:04:01:08:30:30:30:30:30:30:30:30:08:30:30:30:30:30:30:30:30:05:02:08:30:30:30:30:30:30:30:30:08:30:30:30:30:30:30:30:30:00:00:17:70:00:02:01
> - Then I'm formatting the card with pkcs15-init -E --create-pkcs15 --no-so-pin
>
> Is that what you mean by formatting? Or am I missing something?
>
> Thanks, Ralf
>
>

you missing something . Download and install muscletools, and then go
trought the format phase.
One question . What 's reader do u use?
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T11:34:19Z

On Thu, Dec 03, 2009 at 07:53:58PM +0100, emanuele gringeri wrote:

> Ralf Schlatterbeck ha scritto:
> > I now have successfully built and loaded the muscle applet onto my
> > Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
> >
> > I can -- using opensc tools -- build a pkcs15 structure on the card,
> > erase, initalize, set an ID and generate a key. But when I try to
> > use the card with pkcs11 and openssl I'm getting errors (see below).
> > I'm using the opensc-pkcs11 library.
>
> Did u format the applet?

What do you mean?
- I'm loading the applet to the card using gpshell
- then I'm setting the pin to all zeros using opensc-tool:
opensc-tool -s 00:A4:04:00:06:A0:00:00:00:01:01 -s
B0:2A:00:00:38:08:4D:75:73:63:6C:65:30:30:04:01:08:30:30:30:30:30:30:30:30:08:30:30:30:30:30:30:30:30:05:02:08:30:30:30:30:30:30:30:30:08:30:30:30:30:30:30:30:30:00:00:17:70:00:02:01
- Then I'm formatting the card with pkcs15-init -E --create-pkcs15 --no-so-pin

Is that what you mean by formatting? Or am I missing something?

Thanks, Ralf

--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: pkcs11?

2009-12-03T10:52:27Z

Ralf Schlatterbeck ha scritto:

> I now have successfully built and loaded the muscle applet onto my
> Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>
> I can -- using opensc tools -- build a pkcs15 structure on the card,
> erase, initalize, set an ID and generate a key. But when I try to
> use the card with pkcs11 and openssl I'm getting errors (see below).
> I'm using the opensc-pkcs11 library.
>
> Should I use another pkcs11 lib that is more specific to muscle?
>
> Or any hints on what might be wrong with my configuration/card/etc?
>
> Working:
> pkcs15-init -E --create-pkcs15 --no-so-pin
> pkcs15-init --store-pin --auth-id 01 --label "User Name"
> pkcs15-tool --list-pins
> pkcs15-init --generate-key rsa/1024 --auth-id 01
> #(or alternatively a 2048 bit key)
> pkcs15-tool --list-keys
> pkcs15-tool --list-public-keys
>
> Errors:
> % openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
> engine "pkcs11" set.
> [opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
> [opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
> Login failed
> PKCS11_get_private_key returned NULL
> unable to load Private Key
> 18987:error:80005005:Vendor defined:PKCS11_login:General Error:p11_slot.c:145:
> 18987:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:114:
>
> pkcs11-tool in testing mode looks good, note that I don't think
> I've compiled in the MD5 stuff in the MCardApplet.
>
> % pkcs11-tool -l -t
> Please enter User PIN:
> C_SeedRandom() and C_GenerateRandom():
> not implemented
> Digests:
> all 4 digest functions seem to work
> MD5: OK
> SHA-1: OK
> RIPEMD160: OK
> Signatures (currently only RSA signatures)
> testing key 0 (Private Key)
> all 4 signature functions seem to work
> testing signature mechanisms:
> RSA-X-509: OK
> RSA-PKCS: OK
> SHA1-RSA-PKCS: OK
> MD5-RSA-PKCS: OK
> RIPEMD160-RSA-PKCS: OK
> Verify (currently only for RSA):
> testing key 0 (Private Key)
> RSA-X-509: OK
> RSA-PKCS: OK
> SHA1-RSA-PKCS: OK
> MD5-RSA-PKCS: OK
> RIPEMD160-RSA-PKCS: OK
> Key unwrap (RSA)
> testing key 0 (Private Key) -- can't be used to unwrap, skipping
> Decryption (RSA)
> testing key 0 (Private Key) -- can't be used to decrypt, skipping
> Testing card detection
> Please press return to continue, x to exit:
> Available slots:
> Slot 0 Gemplus GemPC Key 00 00
> token label: MUSCLE (Ralf Schlatterbeck)
> token manuf: Identity Alliance
> token model: PKCS #15 SCard
> token flags: rng, login required, PIN initialized, token initialized
> serial num : 0000
> [...]
>
> Thanks, Ralf
>

Did u format the applet?

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

pkcs11?

2009-12-03T10:47:00Z

I now have successfully built and loaded the muscle applet onto my
Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)

I can -- using opensc tools -- build a pkcs15 structure on the card,
erase, initalize, set an ID and generate a key. But when I try to
use the card with pkcs11 and openssl I'm getting errors (see below).
I'm using the opensc-pkcs11 library.

Should I use another pkcs11 lib that is more specific to muscle?

Or any hints on what might be wrong with my configuration/card/etc?

Working:
pkcs15-init -E --create-pkcs15 --no-so-pin
pkcs15-init --store-pin --auth-id 01 --label "User Name"
pkcs15-tool --list-pins
pkcs15-init --generate-key rsa/1024 --auth-id 01
#(or alternatively a 2048 bit key)
pkcs15-tool --list-keys
pkcs15-tool --list-public-keys

Errors:
% openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf -engine pkcs11 -keyform engine -key 0:45 -sha1
engine "pkcs11" set.
[opensc-pkcs11] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=02
[opensc-pkcs11] sec.c:201:sc_pin_cmd: returning with: Card command failed
Login failed
PKCS11_get_private_key returned NULL
unable to load Private Key
18987:error:80005005:Vendor defined:PKCS11_login:General Error:p11_slot.c:145:
18987:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:114:

pkcs11-tool in testing mode looks good, note that I don't think
I've compiled in the MD5 stuff in the MCardApplet.

% pkcs11-tool -l -t
Please enter User PIN:
C_SeedRandom() and C_GenerateRandom():
not implemented
Digests:
all 4 digest functions seem to work
MD5: OK
SHA-1: OK
RIPEMD160: OK
Signatures (currently only RSA signatures)
testing key 0 (Private Key)
all 4 signature functions seem to work
testing signature mechanisms:
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
Verify (currently only for RSA):
testing key 0 (Private Key)
RSA-X-509: OK
RSA-PKCS: OK
SHA1-RSA-PKCS: OK
MD5-RSA-PKCS: OK
RIPEMD160-RSA-PKCS: OK
Key unwrap (RSA)
testing key 0 (Private Key) -- can't be used to unwrap, skipping
Decryption (RSA)
testing key 0 (Private Key) -- can't be used to decrypt, skipping
Testing card detection
Please press return to continue, x to exit:
Available slots:
Slot 0 Gemplus GemPC Key 00 00
token label: MUSCLE (Ralf Schlatterbeck)
token manuf: Identity Alliance
token model: PKCS #15 SCard
token flags: rng, login required, PIN initialized, token initialized
serial num : 0000
[...]

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: applet download for Gemalto TOP IM FIPS CY2

2009-12-03T10:03:01Z

Ralf Schlatterbeck ha scritto:

> Answering my own mail:
>
> On Thu, Dec 03, 2009 at 02:06:15PM +0100, Ralf Schlatterbeck wrote:
>
>> Just got my Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>>
>> But downloading the MCardApplet -- both my homegrown one and one
>> downloaded from
>> http://www.opensc-project.org/opensc/attachment/wiki/Cyberflex/CardEdgeII.ijc
>> leads the following error after issuing the install_for_install command:
>>
> [...]
>
> I've done a little investigation into the magic numbers used by
> gpshell. Looks like I can find out the argument to the first select command:
>
> select -AID a000000003000000
>
> by doing:
> enable_trace
> establish_context
> card_connect
> open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
> get_status -element 80
>
> this gives me the following output (in addition to some debug output):
> List of applets (AID state privileges)
> a000000003000000 7 0
>
> The other two AIDs seem to be dependent on the applet used (the applet codes
> the applet ID internally). I came to this conclusion by changing the IDs
> in the hello world downloader and seeing it fail.
>
> Then I looked into the download script for the hello world applet.
> When unpacking the HelloWorld.cap.transf or HelloWorld.cap file with unzip
> I'm getting several .cap files. The Applet.cap contains the following
> (in hex):
>
> 000000 03 00 0e 01 0a a0 00 00 00 62 03 01 0c 01 01 00
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 000010 14
> 000011
>
> Now compare this with the Applet IDs used for downloading, citing
> from helloInstallCyberflexAccess64k.txt from the gpshell distribution:
>
> install_for_install -instParam 00 -priv 02 -AID a00000006203010c0101 -pkgAID a00000006203010c01 -instAID a00000006203010c0101 -nvDataLimit 500
> ^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^
>
> with that info I was able to find out the correct downloading script for
> my homegrown applet, note the commented-out commands which use the wrong
> applet ID (see below). My applet seems to use the AID a00000000101
>
> Now my question:
> - Is there some documentation on these magic numbers?
> - Seems in all docs the MCardApplet uses the other ID I tried first
> so something in my build-process probably doesn't correctly set
> the applet ID. How should I change that?
>
> # gpshell script for loading applet into card:
> enable_trace
> establish_context
> card_connect
> select -AID a000000003000000
> open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
> delete -AID a00000000101
> delete -AID a000000001
> delete -AID a0000003230101
> delete -AID a00000032301
> #install_for_load -pkgAID a00000032301 -nvCodeLimit 16000 -sdAID a000000003000000
> install_for_load -pkgAID a000000001 -nvCodeLimit 16000 -sdAID a000000003000000
> load -file CardEdgeCflex.ijc
> #install_for_install -instParam 00 -priv 02 -AID a0000003230101 -pkgAID a00000032301 -instAID a0000003230101 -nvDataLimit 16000
> install_for_install -instParam 00 -priv 02 -AID a00000000101 -pkgAID a000000001 -instAID a00000000101 -nvDataLimit 32000
> get_status -element 20
> card_disconnect
> release_context
>
>
> Thanks, Ralf
>

I have been able to load the my homemade applet with the following script:

mode_201
enable_trace
establish_context
card_connect
select -AID a0000000030000
open_sc -security 0 -keyind 0 -keyver 0 -mac_key
404142434445464748494a4b4c4d4e4f -enc_key
404142434445464748494a4b4c4d4e4f // Open secure channel
install_for_load -pkgAID a000000001 -nvCodeLimit 19300
load -file CardEdgeCflex.ijc
install_for_install -instParam 00 -priv 02 -AID a00000000101 -pkgAID
a000000001 -instAID a00000000101 -nvDataLimit 13400
card_disconnect
release_context

You have to use the AID that you use in common.xml when you did compile
the applet with ant.

1. nvCodeLimit is the applet size.
2. nvDataLimit is the size of memory that u want to use for ur private
objctes... I guess ..

cheers.

PS for gpshell is better use the gpshell ML.
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: applet download for Gemalto TOP IM FIPS CY2

2009-12-03T09:18:38Z

Answering my own mail:

On Thu, Dec 03, 2009 at 02:06:15PM +0100, Ralf Schlatterbeck wrote:
> Just got my Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
>
> But downloading the MCardApplet -- both my homegrown one and one
> downloaded from
> http://www.opensc-project.org/opensc/attachment/wiki/Cyberflex/CardEdgeII.ijc
> leads the following error after issuing the install_for_install command:
[...]

I've done a little investigation into the magic numbers used by
gpshell. Looks like I can find out the argument to the first select command:

select -AID a000000003000000

by doing:
enable_trace
establish_context
card_connect
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
get_status -element 80

this gives me the following output (in addition to some debug output):
List of applets (AID state privileges)
a000000003000000 7 0

The other two AIDs seem to be dependent on the applet used (the applet codes
the applet ID internally). I came to this conclusion by changing the IDs
in the hello world downloader and seeing it fail.

Then I looked into the download script for the hello world applet.
When unpacking the HelloWorld.cap.transf or HelloWorld.cap file with unzip
I'm getting several .cap files. The Applet.cap contains the following
(in hex):

000000 03 00 0e 01 0a a0 00 00 00 62 03 01 0c 01 01 00
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
000010 14
000011

Now compare this with the Applet IDs used for downloading, citing
from helloInstallCyberflexAccess64k.txt from the gpshell distribution:

install_for_install -instParam 00 -priv 02 -AID a00000006203010c0101 -pkgAID a00000006203010c01 -instAID a00000006203010c0101 -nvDataLimit 500
^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^

with that info I was able to find out the correct downloading script for
my homegrown applet, note the commented-out commands which use the wrong
applet ID (see below). My applet seems to use the AID a00000000101

Now my question:
- Is there some documentation on these magic numbers?
- Seems in all docs the MCardApplet uses the other ID I tried first
so something in my build-process probably doesn't correctly set
the applet ID. How should I change that?

# gpshell script for loading applet into card:
enable_trace
establish_context
card_connect
select -AID a000000003000000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
delete -AID a00000000101
delete -AID a000000001
delete -AID a0000003230101
delete -AID a00000032301
#install_for_load -pkgAID a00000032301 -nvCodeLimit 16000 -sdAID a000000003000000
install_for_load -pkgAID a000000001 -nvCodeLimit 16000 -sdAID a000000003000000
load -file CardEdgeCflex.ijc
#install_for_install -instParam 00 -priv 02 -AID a0000003230101 -pkgAID a00000032301 -instAID a0000003230101 -nvDataLimit 16000
install_for_install -instParam 00 -priv 02 -AID a00000000101 -pkgAID a000000001 -instAID a00000000101 -nvDataLimit 32000
get_status -element 20
card_disconnect
release_context

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

applet download for Gemalto TOP IM FIPS CY2

2009-12-03T05:06:15Z

Just got my Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2)
in the mail.

I can successfully download the helloworld applet to the card using the
following commands with gpshell:
mode_201
enable_trace
establish_context
card_connect
select -AID a000000003000000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f // Open secure channel
delete -AID a00000006203010c0101
delete -AID a00000006203010c01
install_for_load -pkgAID a00000006203010c01 -nvCodeLimit 500 -sdAID A000000003000000
load -file HelloWorld.cap.transf
install_for_install -instParam 00 -priv 02 -AID a00000006203010c0101 -pkgAID a00000006203010c01 -instAID a00000006203010c0101 -nvDataLimit 500
card_disconnect
release_context

Note that I had to correct a wrapped line and the -AID parameter to
install_for_install compared to the helloInstallCyberflexAccess64k.txt
that comes with gpshell.

Anything I can do with the HelloWorld applet to test if I can run it?

But downloading the MCardApplet -- both my homegrown one and one
downloaded from
http://www.opensc-project.org/opensc/attachment/wiki/Cyberflex/CardEdgeII.ijc

leads the following error after issuing the install_for_install command:

install_for_install -instParam 00 -priv 02 -AID A0000003230101 -pkgAID A00000032301 -instAID A0000003230101 -nvDataLimit 32000
Command --> 80E60C002406A0000003230107A000000323010107A0000003230101010209C90100EF04C8027D000000
Wrapped command --> 84E60C002C06A0000003230107A000000323010107A0000003230101010209C90100EF04C8027D00006A2C1038B01593C000
Response <-- 6A80
install_for_install_and_make_selectable() returns 0x80206A80 (6A80: Wrong data / Incorrect values in command data.)

the full gpshell-script I'm using is:
enable_trace
establish_context
card_connect
select -AID a000000003000000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f
delete -AID a0000003230101
delete -AID a00000032301
install_for_load -pkgAID a00000032301 -nvCodeLimit 16000 -sdAID a000000003000000
load -file CardEdgeCflex.ijc
install_for_install -instParam 00 -priv 02 -AID a0000003230101 -pkgAID a00000032301 -instAID a0000003230101 -nvDataLimit 16000
get_status -element 20
card_disconnect
release_context

Any ideas?

Thanks, Ralf

--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: Fwd: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T03:57:55Z

On Thu, Dec 03, 2009 at 12:31:47PM +0100, emanuele wrote:
> >But you *did* modify the path-settings in common.xml?
>
> yes.. I mean .. it s a thesis project If I don't go trough any strange
> modifications there s no fun..
:-)
Thanks for clarifying. My point was that the build-files as-is haven't been
run on Linux...

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Fwd: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T03:31:47Z

>But you *did* modify the path-settings in common.xml?

yes.. I mean .. it s a thesis project If I don't go trough any strange modifications there s no fun..

On Thu, Dec 3, 2009 at 11:37 AM, Ralf Schlatterbeck <rsc@...> wrote:

On Thu, Dec 03, 2009 at 10:07:00AM +0100, erbalibera erbalibera wrote:
>
> which version of JC API did u use?
> In my common.xml I ve
>
> source="1.2"
> target="1.1"
> in the <target depends="precompile" name="compile">,
OK, I currently have
target="${VM_VERSION}"
source="${VM_VERSION}">
and VM_VERSION=1.2 in Cflex.properties. The build instructions in INSTALL say I'll
have to use jdk1.2.2 and my guess was that this is target version 1.2?

> and with this source/target combination I was able to compile without any
> issue.

Thanks for the suggestion: I'm now using target="1.1" and the conversion works!

BUILD SUCCESSFUL
Total time: 3 seconds

I'll wrap up what I've done and post a summary. Probably *after* I've tried to run
this on the card, though.

Thanks to you all.

> >Seems the whole stuff has never been built on Linux
>

> I ve built ( and loaded it) the applet for a Cyberflex smart card, JC/OP
> 2.1.1/2.0.1 under linux gentoo.
> 'Hope this helps.

But you *did* modify the path-settings in common.xml?

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

--

Emanuele Gringeri
Student of Computer Engineer
University of Pisa
Be my mirror, my sword and shield

--

Emanuele Gringeri
Student of Computer Engineer
University of Pisa
Be my mirror, my sword and shield

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T02:37:37Z

On Thu, Dec 03, 2009 at 10:07:00AM +0100, erbalibera erbalibera wrote:
>
> which version of JC API did u use?
> In my common.xml I ve
>
> source="1.2"
> target="1.1"
> in the <target depends="precompile" name="compile">,
OK, I currently have
target="${VM_VERSION}"
source="${VM_VERSION}">
and VM_VERSION=1.2 in Cflex.properties. The build instructions in INSTALL say I'll
have to use jdk1.2.2 and my guess was that this is target version 1.2?

> and with this source/target combination I was able to compile without any
> issue.

Thanks for the suggestion: I'm now using target="1.1" and the conversion works!

BUILD SUCCESSFUL
Total time: 3 seconds

I'll wrap up what I've done and post a summary. Probably *after* I've tried to run
this on the card, though.

Thanks to you all.

> >Seems the whole stuff has never been built on Linux
>
> I ve built ( and loaded it) the applet for a Cyberflex smart card, JC/OP
> 2.1.1/2.0.1 under linux gentoo.
> 'Hope this helps.

But you *did* modify the path-settings in common.xml?

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T01:31:00Z

Ralf Schlatterbeck wrote:
> On Wed, Dec 02, 2009 at 05:51:15PM +0000, João Poupino wrote:
>> Ralf Schlatterbeck wrote:
> So basically the gpshell commands are magic to me, I'm following recipes
> so far. Any pointers on some good documentations that lets me cook my
> own recipes?

I must apologize. I've just now realized the script I've referred in my
previous post, uses the manager AID of the etoken 72K card and contains
settings that are probably problematic with the Cyberflex 64K. I've
never worked with that card before, but I'm aware it has some
peculiarities, e.g. the applet needs to be "pre-prepared" for loading.
It's probably best you ignore my script altogether.

Regarding a reference, the README file, that comes with the GPShell
source, should get you started. It also has a bunch of example scripts.

I think there was a project that consisted of a collection of scripts
that automated a series of tasks just like the one you want to do. Maybe
someone on the list can provide a link?

João
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T01:27:09Z

Ralf Schlatterbeck wrote:
> So how do you guys build that applet? Don't tell me I've to run windows to do it?
> Can't it be built using some newer version of the SDK?
>
Hi.

To install muclecard applet into this Gemalto card I used scripts and
pre-compiled applet from

http://www.openscdp.org/scripts/download.html

and Eclipse with Smart Card Scripting Environment for Eclipse (SSE4E)
plugin:

http://www.openscdp.org/sse4e/index.html

regards Toomas Nurmoja

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T01:07:00Z

Hi Ralf,

which version of JC API did u use?
In my common.xml I ve

             source="1.2"
             target="1.1"

in the <target depends="precompile" name="compile">,
and with this source/target combination I was able to compile without any issue.
>Seems the whole stuff has never been built on Linux

I ve built ( and loaded it) the applet for a Cyberflex smart card, JC/OP 2.1.1/2.0.1 under linux gentoo.
'Hope this helps.

-eg

On Thu, Dec 3, 2009 at 9:35 AM, Tommaso Cucinotta <tommaso.cucinotta@...> wrote:

Ralf Schlatterbeck wrote:

- Seems the whole stuff has never been built on Linux, all the path
names used backslashes for filenames -- that seems to be ok for java,
but not for the classfile converter. I've converted all to forward
slashes.

We use to build the Applet on Linux, and load it via gpshell, as we recently modified it to support an extended ACL model and other things. However, I don't have details at hand right now. I hope my student (in cc) will provide you soon with some more info.

T.

--
Tommaso Cucinotta, Computer Engineering PhD, Researcher
ReTiS Lab, Scuola Superiore Sant'Anna, Pisa, Italy
Tel +39 050 882 024, Fax +39 050 882 003
http://retis.sssup.it/people/tommaso

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T00:49:31Z

On Thu, Dec 03, 2009 at 09:35:52AM +0100, Tommaso Cucinotta wrote:

> Ralf Schlatterbeck wrote:
>> - Seems the whole stuff has never been built on Linux, all the path
>> names used backslashes for filenames -- that seems to be ok for java,
>> but not for the classfile converter. I've converted all to forward
>> slashes.
>>
> We use to build the Applet on Linux, and load it via gpshell, as we
> recently modified it to support an extended ACL model and other things.
> However, I don't have details at hand right now. I hope my student (in
> cc) will provide you soon with some more info.

Great, he probably modified the ant buildfiles like I did. I'd be
very interesting how you do the conversion step to Java Card. Are you
using a new card or are you targeting cards like Cyberflex with an
ancient JVM?

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T00:35:52Z

Ralf Schlatterbeck wrote:
> - Seems the whole stuff has never been built on Linux, all the path
> names used backslashes for filenames -- that seems to be ok for java,
> but not for the classfile converter. I've converted all to forward
> slashes.
>
We use to build the Applet on Linux, and load it via gpshell, as we
recently modified it to support an extended ACL model and other things.
However, I don't have details at hand right now. I hope my student (in
cc) will provide you soon with some more info.

T.

--
Tommaso Cucinotta, Computer Engineering PhD, Researcher
ReTiS Lab, Scuola Superiore Sant'Anna, Pisa, Italy
Tel +39 050 882 024, Fax +39 050 882 003
http://retis.sssup.it/people/tommaso

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-03T00:11:24Z

On Wed, Dec 02, 2009 at 05:51:15PM +0000, João Poupino wrote:
>
> Ralf Schlatterbeck wrote:
>> The card you mention looks very good. Any pointers on the procedure for
>> applet download with gpshell?
>
> Please check this earlier post of mine [1].

OK, I see. I have earlier found this for the Cflex:
http://lists.drizzle.com/pipermail/muscle/2008-February/006968.html
and compare this to the instructions on the opensc wiki:
http://www.opensc-project.org/opensc/wiki/Cyberflex
These differ (and the second one does *not* work, I haven't tried the
first yet, my Cflex card is still in the mail).
So basically the gpshell commands are magic to me, I'm following recipes
so far. Any pointers on some good documentations that lets me cook my
own recipes?

> Is it available in ID000 (SIM) format, too?
>> We plan to use an USB-stick reader for SIM-Format cards...
>
> "SIM cutting service
> We offer a service to cut any smartcard purchased from our store down to
> the size of a SIM card (also sometimes known as a SAM.) for use with any
> SIM style smartcard reader."

Great pointer, thanks. The idea of having this cut out is nice, so far I
was always looking for cards that come in SIM format.

>>> If you want a precompiled applet, you can get it at [2].
>> I've found that. Unfortunately I couldn't find out what version of
>> the applet that is. Any Idea how to find out?
>
> I would guess that it is the latest stable version (0.9.11).

Yes I was *hoping* that, too. What irritated me was the filename (I
would have expected CardEdgeCflex) and that led me to trying to build it
myself to be sure I had a version with the security fixes in.

Thanks, Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T23:59:33Z

On Wed, Dec 02, 2009 at 04:59:08PM -0500, Michael StJohns wrote:
> Mostly, you can use any JDK to do the build, but you need to add the
> target="1.4" or target="1.5" to the "javac" task in the
> buildapplet.xml file Which target depends on which version of the
> javacard SDK you're using. So use the current JDK that comes with
> Ubuntu and it should work fine.

Thanks Mike, that brought me one step further:
- javac now runs through, I was using target=1.2 and had to add
source=1.2, too otherwise I got a warning that the option was added
for me.
- Seems the whole stuff has never been built on Linux, all the path
names used backslashes for filenames -- that seems to be ok for java,
but not for the classfile converter. I've converted all to forward
slashes.
- But now I'm getting an error from the old 2.1.2 classfile converter:
convert:
[java]
[java] Java Card 2.1.2 Class File Converter (version 1.2)
[java] Copyright (c) 2001 Sun Microsystems, Inc. All rights reserved.
[java]
[java] warning: You did not supply export file for the previous minor version of the package
[java] parsing /usr/local/src/unpacked/MCardApplet/Cflex/com/musclecard/CardEdge/CardEdge.class
[java] parsing /usr/local/src/unpacked/MCardApplet/Cflex/com/musclecard/CardEdge/MemoryManager.class
[java] parsing /usr/local/src/unpacked/MCardApplet/Cflex/com/musclecard/CardEdge/ObjectManager.class
[java] error: com.musclecard.CardEdge.CardEdge: unsupported class file format of version 46.0.
[java] error: com.musclecard.CardEdge.MemoryManager: unsupported class file format of version 46.0.
[java] error: com.musclecard.CardEdge.ObjectManager: unsupported class file format of version 46.0.
[java]
[java] conversion completed with 3 errors and 1 warnings.

Isn't it strange that javac -- with a -target option -- produces output
that can't be read by old versions of the java software?? Seems I'll
have to try to find a newer version and see if it can produce
backward-compatible output.

Failing that I'll probably try to get this working with a precompiled
applet...

> At 02:54 PM 12/2/2009, gilles Bernabé wrote:
> >Hi,
> >I have followed this link :[1]
> >and it works well, compilation with "ant" and loading of the".ijc" in
> >the cyberflex but like you said i have been forced to do it under
> >Windows because on my last ubuntu it was too long to find the old
> >libraries compatible with the required JDK, but on windows it's very
> >fast.

Thanks. I was using the same instructions. But when the old javac
segfaulted I tried on Debian etch which also failed. Then before moving
to windows I asked :-)

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T13:59:08Z

Mostly, you can use any JDK to do the build, but you need to add the target="1.4" or target="1.5" to the "javac" task in the buildapplet.xml file Which target depends on which version of the javacard SDK you're using. So use the current JDK that comes with Ubuntu and it should work fine.

Mike

At 02:54 PM 12/2/2009, gilles Bernabé wrote:

Hi,
I have followed this link :[1]
and it works well, compilation with "ant" and loading of the".ijc" in the cyberflex
but like you said i have been forced to do it under Windows because on my last ubuntu it was too long to find the old libraries compatible with the required JDK, but on windows it's very fast.
Gilles

[1] : http://svn.debian.org/viewsvn/muscleplugins/trunk/MCardApplet/INSTALL?revision=283&view=markup

2009/12/2 Ralf Schlatterbeck <rsc@...>

I've recently tried to build the Applet for the Gemalto TOP IM FIPS CY2 (Cyberflex

Access 64k v2) card, -- according to the following post:

http://lists.drizzle.com/pipermail/muscle/2008-February/006960.html

it should be supported but -- I've checked out the latest revision 294 from SVN

svn:// svn.debian.org/muscleplugins/trunk/MCardApplet but failed to build using the

build instructions with the old version of Java SDK that is required by the card:

- On Debian Lenny the java and javac from the sdk just segfault

- On Debian Etch (my second try) there is a shared library inconsistency

no wonder, the java version used is from 2002.

So how do you guys build that applet? Don't tell me I've to run windows to do it?

Can't it be built using some newer version of the SDK?

Failing that (although I'd really like to know how to build it), is there a binary

version for downloading somewhere?

Ralf

--

Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16

Open Source Consulting                  Fax:   +43/2243/26465-23

Reichergasse 131                        www:   http://www.runtux.com

A-3411 Weidling                         email: office@...

osAlliance member                       email: rsc@...

_______________________________________________

Muscle mailing list

Muscle@...

http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T13:59:08Z

Hi,
I have followed this link :[1]
and it works well, compilation with "ant" and loading of the".ijc" in the cyberflex
but like you said i have been forced to do it under Windows because on my last ubuntu it was too long to find the old libraries compatible with the required JDK, but on windows it's very fast.
Gilles

[1] : http://svn.debian.org/viewsvn/muscleplugins/trunk/MCardApplet/INSTALL?revision=283&view=markup

2009/12/2 Ralf Schlatterbeck <rsc@...>

I've recently tried to build the Applet for the Gemalto TOP IM FIPS CY2 (Cyberflex

Access 64k v2) card, -- according to the following post:

http://lists.drizzle.com/pipermail/muscle/2008-February/006960.html

it should be supported but -- I've checked out the latest revision 294 from SVN

svn:// svn.debian.org/muscleplugins/trunk/MCardApplet but failed to build using the

build instructions with the old version of Java SDK that is required by the card:

- On Debian Lenny the java and javac from the sdk just segfault

- On Debian Etch (my second try) there is a shared library inconsistency

no wonder, the java version used is from 2002.

So how do you guys build that applet? Don't tell me I've to run windows to do it?

Can't it be built using some newer version of the SDK?

Failing that (although I'd really like to know how to build it), is there a binary

version for downloading somewhere?

Ralf

--

Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16

Open Source Consulting                  Fax:   +43/2243/26465-23

Reichergasse 131                        www:   http://www.runtux.com

A-3411 Weidling                         email: office@...

osAlliance member                       email: rsc@...

_______________________________________________

Muscle mailing list

Muscle@...

http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T11:54:16Z

Hi,
I have followed this link :[1]
and it works well, compilation with "ant" and loading of the".ijc" in the cyberflex
but like you said i have been forced to do it under Windows because on my last ubuntu it was too long to find the old libraries compatible with the required JDK, but on windows it's very fast.
Gilles

[1] : http://svn.debian.org/viewsvn/muscleplugins/trunk/MCardApplet/INSTALL?revision=283&view=markup

2009/12/2 Ralf Schlatterbeck <rsc@...>

I've recently tried to build the Applet for the Gemalto TOP IM FIPS CY2 (Cyberflex
Access 64k v2) card, -- according to the following post:
http://lists.drizzle.com/pipermail/muscle/2008-February/006960.html
it should be supported but -- I've checked out the latest revision 294 from SVN
svn://svn.debian.org/muscleplugins/trunk/MCardApplet but failed to build using the
build instructions with the old version of Java SDK that is required by the card:
- On Debian Lenny the java and javac from the sdk just segfault
- On Debian Etch (my second try) there is a shared library inconsistency
no wonder, the java version used is from 2002.

So how do you guys build that applet? Don't tell me I've to run windows to do it?
Can't it be built using some newer version of the SDK?

Failing that (although I'd really like to know how to build it), is there a binary
version for downloading somewhere?

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T09:51:15Z

Hi,

Ralf Schlatterbeck wrote:
> The card you mention looks very good. Any pointers on the procedure for
> applet download with gpshell?

Please check this earlier post of mine [1].

Is it available in ID000 (SIM) format, too?
> We plan to use an USB-stick reader for SIM-Format cards...

I'm not sure, but I believe smart card focus provides a "SIM cutting
service" [2]:

"SIM cutting service
We offer a service to cut any smartcard purchased from our store down to
the size of a SIM card (also sometimes known as a SAM.) for use with any
SIM style smartcard reader."

>
>> If you want a precompiled applet, you can get it at [2].
>> [2] http://www.opensc-project.org/opensc/raw-attachment/wiki/Cyberflex/CardEdgeII.ijc
> I've found that. Unfortunately I couldn't find out what version of the applet
> that is. Any Idea how to find out?

I would guess that it is the latest stable version (0.9.11).

>
>> Good luck.
> Thanks!

You're welcome :)
>
> Ralf

João

[1]
http://www.opensc-project.org/pipermail/opensc-user/2009-June/003147.html
[2]
http://www.smartcardfocus.com/shop/ilp/id~82/p/index.shtml?utm_source=IntLi&utm_medium=SiBa&utm_campaign=SCu
_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T09:32:17Z

On Wed, Dec 02, 2009 at 05:14:43PM +0000, João Poupino wrote:

>> svn://svn.debian.org/muscleplugins/trunk/MCardApplet but failed to build using the
>> build instructions with the old version of Java SDK that is required by the card:
>> - On Debian Lenny the java and javac from the sdk just segfault
>> - On Debian Etch (my second try) there is a shared library inconsistency
>> no wonder, the java version used is from 2002.
>
> Unfortunately, I've never compiled the Muscle applet with the older Java
> / Java Card APIs. So, I haven't come across the errors you described.
>
> I have, however, been able to compile the Muscle applet with JDK 1.5 and
> the JC API 2.2.2, with Ubuntu 9.04, for a java 2.2.2 card.

OK, sounds good. The Gemalto was the first tried card I came across..

> Is the Cyberflex 64K a mandatory requirement? You should try more recent
> cards, e.g. [1].
> [1] http://www.smartcardfocus.com/shop/ilp/id~407/p/index.shtml

I have ordered one Cyberflex for testing. So, no, not mandatory.
The card you mention looks very good. Any pointers on the procedure for
applet download with gpshell? Is it available in ID000 (SIM) format, too?
We plan to use an USB-stick reader for SIM-Format cards...

> If you want a precompiled applet, you can get it at [2].
> [2] http://www.opensc-project.org/opensc/raw-attachment/wiki/Cyberflex/CardEdgeII.ijc
I've found that. Unfortunately I couldn't find out what version of the applet
that is. Any Idea how to find out?

> Good luck.
Thanks!

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle

Re: MCardApplet for Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2): how?

2009-12-02T09:21:25Z

On Wed, Dec 02, 2009 at 06:12:17PM +0100, Sébastien Lorquet wrote:
>
> Did you try this?
>
> http://www.linuxnet.com/musclecard/index.html

What specifically do you mean?
- the developer builds lead to a b0rken link
- the stable link for the applet is 0.9.8 which has
in particular an outstanding security fix that is
present in newer versions.

Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting Fax: +43/2243/26465-23
Reichergasse 131 www: http://www.runtux.com
A-3411 Weidling email: office@...
osAlliance member email: rsc@...

_______________________________________________
Muscle mailing list
Muscle@...
http://lists.drizzle.com/mailman/listinfo/muscle