The Side Channel

« first day (1772 days earlier) ← previous day next day → last day (3200 days later) »

SEJPM

13:34

@Biv congratulations on the privilege to edit without approval now :)

6 hours later…

Meta Crypto SE

19:19

Q: Deleting user's name

I'm so sorry for this post, but I think this is necessary. Although this site is designed for research, some users misuse it. These users choose a name for its profile that is a vilification. For example this user select the "kire khar" as her/his profiles name. This name is so bad that I think...

2 hours later…

e-sushi

21:03

@Biv Yeah, congrats from my side too… though, I have to admit I’ll miss giving your edits a “green light”. ;)

Biv

21:49

@SEJPM @e-sushi Thx a lot =D I didn't expect it to be noticed. :D Well I don't know if I "donate" some points if I will be require to be on approval again. :)

1 hour later…

diagprov

23:02

@SEJPM @fgrieu might need you guys to give me some ideas here. I compiled the PKCS#11 module for my IDPrime MD 840. Now using it:

`% pkcs11-tool --module /usr/lib64/libgtop11dotnet.so -L 16-05-20 1:01
Available slots:
Slot 0 (0x0): Gemalto PC Twin Reader (9BA34642) 00 00
(token not recognized)
`

How do I do multiline code blocks again?

anyway basically ^

their "user cert tool" on windows won't accept NIST-P521 private keys in a pfx (not supported) or RSA 4096 (not supported)

any magic commands I should be running?

SEJPM

@diagprov what "user cert tool"? (IDGo 800?)

diagprov

yep. Let's forget that, as honestly if I can't get the pkcs#11 libraries working on Linux I don't care

I suspect I can use it to push a 2048 bit key to the card

which is fine and dandy but not quite what I had hoped for

SEJPM

I know the bear did it somehow at some point in time. On the details you have to ask him. I suspect though he actually did this with APDU commands :/

diagprov

I think he used the .net variant

In which case there's a question of whether the MD versions actually support what they claim to

SEJPM

You might wanna ask on the opensc developer mailing list if you suspect this to be a pkcs11-tool issue

diagprov

23:10

I suspect it's their custom pkcs11 module

Since it doesn't even compile out of the box, without me adding in the headers they missed

tl;dr their software is a load of [CENSORED]

SEJPM

if you think their software sucks you could also try and ping out loudly at Gemalto

or request the most recent version of the PKCS library for linux from them

diagprov

I think the problem is really that they don't care about end users cause there's no need to. Which is a fair enough stance.

Their minidriver works (evidently), so you can sign people up on the cards using Active Directory enrollment. Job done.

SEJPM

In the end they produce their stuff for enterprise customer

diagprov

yeah indeed. It's a shame nobody produces this kind of thing for end users

SEJPM

which have enough money for HSMs on their servers and give every mortal user Windows

diagprov

23:18

but apart from openpgp cards, I've never seen anything close to usable for end users

SEJPM

define "usable"

diagprov

usable for end users. I plug it in. I ask to generate a key and or push one. It does it.

SEJPM

the YubiKey NEO may fit this category (depending on your use-case) as does much of the stuff supported by OpenSC natively (imagine this to be right above your latest post)

diagprov

haha but what cards supported by opensc natively?

That support 4096-bit rsa

Yubikey would work yes, for 2048 bit RSA

I think the closest card is actually going to be the ACOS5-64. There's a development branch of OpenSC right now working on support. The thing is I don't want to pay $60 for their SDK if their pkcs11 libraries turn out to be as bad as Gemalto's one

SEJPM

the YubiKey 4 apparently supports 384-bit ECC and 4096-bit RSA

question now is: can you actually use a yubikey 4 like a normal PKCS#11 / CSP smartcard?

diagprov

23:23

I must try and see if I can push the 4096 bit key to it

SEJPM

sheet claiming RSA-4096 support: yubico.com/products/yubikey-hardware

diagprov

yeah well, I can tell you it does not accept 4096 bit pgp keys

hold on, testing pkcs11

Meta Crypto SE

Q: Merging an unregistered account

Yesterday, I had a question and wanted to post it on Cryptography Stack Exchange. However, my VPN was down at that time, so I cannot log in with my existing account. I had no choice but to ask that question as an unregistered guest. When asked to provide an email address, I typed the one used to ...

support user-accounts

diagprov

yubico-piv-tool: failed to connect to reader

SEJPM

@diagprov so you can't actually use a yubikey 4 as a smartcard?

diagprov

23:33

well that's yubikey's official tool. I asked to use slot 9a and to import a key

following this

Q: uploading pkcs12 to yubikey piv slot

i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 keystore (private key + self signed cert) to sign jar files (android apk) via other slot on yubikey piv ...

encryption yubikey pkcs11 pkcs12

SEJPM

is your yubikey enabled for piv use?

diagprov

If I understand correctly, you need to order several thousand to get them with symantec PIV certificates

otherwise, I have no idea

how do I tell?

SEJPM

@diagprov rumors say there should be an option in your yubikey configuration tool to enable or disable up to three different modes of operation of yubikeys

diagprov

Just tried to load a 2048-bit self-signed key with the cert tool. Asked for user pin (so cert tool is probably checking key sizes, there's hope), but then it gave me an error message and now Windows refuses to recognize the smart card reader

I stand by my assertion that their software is crap

Honestly at this stage I think it might be worth a) buying programmable smart cards, b) writing a pkcs15/pkcs11 set of extensions and on card apps myself and then c) using them

I will brand them "cards that actually work"

SEJPM

@diagprov may I ask you what do you actually want to do and how much money do you have for it and what do you need?

diagprov

23:43

I want to store a 4096-bit key on a smart card, or a 521-bit key on a smart card.

Actually, tbh, it's not that important, it's just the gemalto cards showed a lot of promise

I'll ask The Bear

About APDU

and introduce Gemalto's tool to IDA :)

I hear rumours their on card filesystem matches the minidriver spec exactly, so...

SEJPM

@diagprov I'm not sure if you're allowed to say this out loudly :)

diagprov

Actually I am. Reverse engineering law in switzerland says you may reverse engineer stuff for compatibility reasons with your own kit

their stuff objectively does not work on any hardware I have

SEJPM

@fgrieu did you ever work with Athena's IDProtect Laser smart cards?

diagprov

and if they work with Linux/opensc please shout

As I would much rather spend money buying a couple of cards than time trying to work out how to get these cards working

SEJPM

@diagprov well, they claim Linux compatibility with their client application...

and you can get the cards at cryptoshop (along with the application)

and they claim 521 bit ECC (FP) support (proprietary algorithms)

diagprov

23:50

yeah it looks like the ASE versions work with opensc too, apparently

SEJPM

the only card I can confirm to work with opensc is the smartcard-hsm, but it "only" supports 2048-bit RSA, no openpgp (AFAICT) and "only" 320-bit FP ECC

the laser version has FIPS certification though...

@diagprov the documentation on the OpenSC wiki sucks for them

diagprov

I think basically any choice here is going to suck

It's not the end of the world

I figured this would be the case

but it's still not what I hoped for

ho hum

SEJPM

@diagprov developers.yubico.com/libu2f-host/Mode_switch_YubiKey.html

diagprov

that's nice and clear