{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/786","repository_url":"https://api.github.com/repos/OpenSC/OpenSC","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/786/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/786/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/786/events","html_url":"https://github.com/OpenSC/OpenSC/issues/786","id":158536861,"number":786,"title":"Tokend unable to reconnect to PIV card after private key operation","user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-05T04:27:47Z","updated_at":"2016-06-05T12:08:28Z","closed_at":null,"body":"### Expected behaviour\r\n\r\nMac OS X native applications (Apple Mail, Keychain Access) should be able to use the token after OpenSC command line tool completes its work and releases the token.\r\n\r\n### Actual behaviour\r\n\r\nIf the operation performed involved private key (signature, decryption, or on-token key derivation), subsequent attempts by Tokend to unlock the token fail. Observed with Yubikey and CAC.\r\n\r\n### Steps to reproduce\r\n\r\n1. Build and install the current *master* of OpenSC.\r\n2. Insert a token (RSA or ECC, doesn't matter).\r\n3. Perform a private key operation using, e.g., `pkcs11-tool` or `openssl -engine pkcs11 <whatever>`\r\n4. Attempt to unlock the token using Keychain Access (or Apple Mail). Observe failure to unlock the token.\r\n\r\n### Logs\r\n\r\nGood log, showing that after public key was accessed, the token stays operational, and Keychain Access has no difficulty unlocking it. This log was obtain by running `openssl pkeyutl -engine pkcs11 -derive -keyform PEM -inkey e256.priv.pem -peerform engine -peerkey \"pkcs11:object=KEY%20MAN%20pubkey;object-type=public\" -hexdump`, followed by Keychain \"Unlock\" command:\r\n[opensc-derive-good.txt](https://github.com/OpenSC/OpenSC/files/299187/opensc-derive-good.txt)\r\n\r\nBad log, showing that after private key operation was performed on the token, Keychain Access fails to unlock it. This log was obtained by running `pkcs11-tool -l --derive -m ECDH1-COFACTOR-DERIVE -d 03 -i e256.pub.der`, followed by Keychain \"Unlock\" command:\r\n[opensc-derive-bad.txt](https://github.com/OpenSC/OpenSC/files/299188/opensc-derive-bad.txt)\r\n\r\nExcerpt from the good log:\r\n```\r\n. . . . . \r\n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs15-pubkey.c:757:sc_pkcs15_encode_pubkey_ec: returning with: 0 (Success)\r\n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140436191600000: CKA_EC_POINT = 044104A5E2B8F6763FCA7C4018CDF6135AB2EBDD45979D06B8BD1B186F3CD97C\r\n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7fb9d94336d0, hObject=0x7fb9d9505d80) = CKR_OK\r\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\r\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:154:pinStatus: In OpenSCToken::pinStatus for pinNum (1)\r\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:161:pinStatus: In OpenSCToken::pinStatus blocked\r\n0x7fff78711000 23:48:41.030 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:490:getOwner: In OpenSCToken::getOwner()\r\n0x7fff78711000 23:48:41.030 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\r\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:177:verifyPIN: In OpenSCToken::verifyPIN(1)\r\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:223:_verifyPIN: In OpenSCToken::_verifyPIN(), PIN num is: 1\r\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:237:_verifyPIN:   sc_pkcs15_get_objects(pin_id=01): 2\r\n0x7fff78711000 23:48:44.056 [tokend] pkcs15-pin.c:295:sc_pkcs15_verify_pin: called\r\n0x7fff78711000 23:48:44.056 [tokend] pkcs15-pin.c:296:sc_pkcs15_verify_pin: PIN(type:0;method:1;len:)\r\n0x7fff78711000 23:48:44.056 [tokend] card.c:394:sc_lock: called\r\n0x7fff78711000 23:48:44.056 [tokend] reader-pcsc.c:547:pcsc_lock: called\r\n0x7fff78711000 23:48:44.057 [tokend] sec.c:159:sc_pin_cmd: called\r\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:550:sc_transmit_apdu: called\r\n0x7fff78711000 23:48:44.057 [tokend] card.c:394:sc_lock: called\r\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:517:sc_transmit: called\r\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:371:sc_single_transmit: called\r\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:376:sc_single_transmit: CLA:0, INS:20, P1:0, P2:80, data(8) 0x7fff5e5c1010\r\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:269:pcsc_transmit: reader 'Yubico Yubikey NEO OTP+U2F+CCID'\r\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:270:pcsc_transmit:\r\nOutgoing APDU (13 bytes):\r\n00 20 00 80 08 31 32 33 34 35 36 37 38 . ...12345678\r\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:199:pcsc_internal_transmit: called\r\n0x7fff78711000 23:48:44.089 [tokend] reader-pcsc.c:279:pcsc_transmit:\r\nIncoming APDU (2 bytes):\r\n90 00 ..\r\n. . . . .\r\n0x7fff78711000 23:48:44.090 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:243:_verifyPIN:   In OpenSCToken::verify returned 0 for pin 1\r\n0x7fff78711000 23:48:44.090 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:208:verifyPIN:   PIN verified\r\n. . . . .\r\n```\r\n\r\nExcerpt from the bad log:\r\n```\r\n. . . . .\r\n0x7fff78711000 23:56:07.618 [opensc-pkcs11] framework-pkcs15.c:3719:pkcs15_prkey_derive: Derivation complete. Result 32.\r\n. . . . .\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:147:C_CloseSession: C_CloseSession(0x7ffeb0502130)\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:98:sc_pkcs11_close_session: real C_CloseSession(0x7ffeb0502130)\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs15-pin.c:690:sc_pkcs15_pincache_clear: called\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-global.c:304:C_Finalize: C_Finalize()\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] ctx.c:819:sc_cancel: called\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] reader-pcsc.c:637:pcsc_cancel: called\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:163:card_removed: Yubico Yubikey NEO OTP+U2F+CCID: card removed\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x0)\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:129:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x0) 0\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] framework-pkcs15.c:1364:pkcs15_release_token: pkcs15_release_token() not implemented\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x1)\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:129:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x1) 0\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x2)\r\n. . . . .\r\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] reader-pcsc.c:533:pcsc_disconnect: called\r\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] card.c:357:sc_disconnect_card: returning with: 0 (Success)\r\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] ctx.c:842:sc_release_context: called\r\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] reader-pcsc.c:794:pcsc_finish: called\r\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\r\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:154:pinStatus: In OpenSCToken::pinStatus for pinNum (1)\r\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:161:pinStatus: In OpenSCToken::pinStatus blocked\r\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:177:verifyPIN: In OpenSCToken::verifyPIN(1)\r\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:223:_verifyPIN: In OpenSCToken::_verifyPIN(), PIN num is: 1\r\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:237:_verifyPIN:   sc_pkcs15_get_objects(pin_id=01): 2\r\n0x7fff78711000 23:56:15.034 [tokend] pkcs15-pin.c:295:sc_pkcs15_verify_pin: called\r\n0x7fff78711000 23:56:15.034 [tokend] pkcs15-pin.c:296:sc_pkcs15_verify_pin: PIN(type:0;method:1;len:)\r\n0x7fff78711000 23:56:15.034 [tokend] card.c:394:sc_lock: called\r\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:547:pcsc_lock: called\r\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:440:pcsc_reconnect: Reconnecting to the card...\r\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:303:refresh_attributes: Yubico Yubikey NEO OTP+U2F+CCID check\r\n0x7fff78711000 23:56:15.035 [tokend] reader-pcsc.c:323:refresh_attributes: returning with: 0 (Success)\r\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:547:pcsc_lock: called\r\n0x7fff78711000 23:56:15.036 [tokend] sec.c:159:sc_pin_cmd: called\r\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:550:sc_transmit_apdu: called\r\n0x7fff78711000 23:56:15.036 [tokend] card.c:394:sc_lock: called\r\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:517:sc_transmit: called\r\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:371:sc_single_transmit: called\r\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:376:sc_single_transmit: CLA:0, INS:20, P1:0, P2:80, data(8) 0x7fff53ab8010\r\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:269:pcsc_transmit: reader 'Yubico Yubikey NEO OTP+U2F+CCID'\r\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:270:pcsc_transmit:\r\nOutgoing APDU (13 bytes):\r\n00 20 00 80 08 31 32 33 34 35 36 37 38 . ...12345678\r\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:199:pcsc_internal_transmit: called\r\n0x7fff78711000 23:56:15.049 [tokend] reader-pcsc.c:279:pcsc_transmit:\r\nIncoming APDU (2 bytes):\r\n6D 00 m.\r\n0x7fff78711000 23:56:15.050 [tokend] apdu.c:386:sc_single_transmit: returning with: 0 (Success)\r\n0x7fff78711000 23:56:15.050 [tokend] apdu.c:539:sc_transmit: returning with: 0 (Success)\r\n0x7fff78711000 23:56:15.050 [tokend] card.c:434:sc_unlock: called\r\n0x7fff78711000 23:56:15.050 [tokend] iso7816.c:121:iso7816_check_sw: Instruction code not supported or invalid\r\n0x7fff78711000 23:56:15.050 [tokend] sec.c:206:sc_pin_cmd: returning with: -1204 (Unsupported INS byte in APDU)\r\n0x7fff78711000 23:56:15.050 [tokend] pkcs15-pin.c:368:sc_pkcs15_verify_pin: PIN cmd result -1204\r\n. . . . .\r\n```\r\n\r\n**Update**\r\nSpecifying `disconnect_action = leave` (instead of default `reset`) in `opensc.conf` seems to alleviate this problem, but I don't know what (other) consequences that setting has (I wonder whether these settings and what they do is documented anywhere?). And `reconnect()` is still broken. So would still like somebody more knowledgable than myself to go over this."},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/223809665","html_url":"https://github.com/OpenSC/OpenSC/issues/786#issuecomment-223809665","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/786","id":223809665,"user":{"login":"dengert","id":865329,"avatar_url":"https://avatars.githubusercontent.com/u/865329?v=3","gravatar_id":"","url":"https://api.github.com/users/dengert","html_url":"https://github.com/dengert","followers_url":"https://api.github.com/users/dengert/followers","following_url":"https://api.github.com/users/dengert/following{/other_user}","gists_url":"https://api.github.com/users/dengert/gists{/gist_id}","starred_url":"https://api.github.com/users/dengert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dengert/subscriptions","organizations_url":"https://api.github.com/users/dengert/orgs","repos_url":"https://api.github.com/users/dengert/repos","events_url":"https://api.github.com/users/dengert/events{/privacy}","received_events_url":"https://api.github.com/users/dengert/received_events","type":"User","site_admin":false},"created_at":"2016-06-05T12:08:28Z","updated_at":"2016-06-05T12:08:28Z","body":"\n  \n    \n  \n  \n    Looks like when the opensc-pkcs11 process ends, pcscd may be\n    powering down the reader. You need a pcscd trace to see what is\n    going on with the reader. Also look at the opensc.conf to see what\n    reader-pcsc.c  will do with the reader on disconect. \n    \n    A higher opensc debug level  might show the calls to pcscd, and\n    might show if the opensc-pkcs11 process still has a lock set. \n    \n    It is also not clear why the openssl pkeyutl -engine pkcs11\n      never cleaned up the pkcs11 sessions. \n      It should have also done  C_CloseSession,\n      C_Finalize, leading to pcsc_finish which should have\n      then produced the same problem as the bad log. \n       \n    On 6/4/2016 11:27 PM, Mouse wrote:\n    \n    \n      Expected behaviour\n      Mac OS X native applications (Apple Mail, Keychain Access)\n        should be able to use the token after OpenSC command line tool\n        completes its work and releases the token.\n      Actual behaviour\n      If the operation performed involved private key (signature,\n        decryption, or on-token key derivation), subsequent attempts by\n        Tokend to unlock the token fail. Observed with Yubikey and CAC.\n      Steps to reproduce\n      \n        Build and install the current master of OpenSC.\n        Insert a token (RSA or ECC, doesn't matter).\n        Perform a private key operation using, e.g., pkcs11-tool\n          or openssl -engine pkcs11 <whatever>\n        \n        Attempt to unlock the token using Keychain Access (or Apple\n          Mail). Observe failure to unlock the token.\n      \n      Logs\n      Good log, showing that after public key was accessed, the token\n        stays operational, and Keychain Access has no difficulty\n        unlocking it. This log was obtain by running openssl\n          pkeyutl -engine pkcs11 -derive -keyform PEM -inkey\n          e256.priv.pem -peerform engine -peerkey\n          \"pkcs11:object=KEY%20MAN%20pubkey;object-type=public\" -hexdump,\n        followed by Keychain \"Unlock\" command:\n        opensc-derive-good.txt\n      Bad log, showing that after private key operation was performed\n        on the token, Keychain Access fails to unlock it. This log was\n        obtained by running pkcs11-tool -l --derive -m\n          ECDH1-COFACTOR-DERIVE -d 03 -i e256.pub.der, followed\n        by Keychain \"Unlock\" command:\n        opensc-derive-bad.txt\n      Excerpt from the good log:\n      . . . . . \n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs15-pubkey.c:757:sc_pkcs15_encode_pubkey_ec: returning with: 0 (Success)\n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140436191600000: CKA_EC_POINT = 044104A5E2B8F6763FCA7C4018CDF6135AB2EBDD45979D06B8BD1B186F3CD97C\n0x7fff78711000 23:48:35.722 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7fb9d94336d0, hObject=0x7fb9d9505d80) = CKR_OK\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:154:pinStatus: In OpenSCToken::pinStatus for pinNum (1)\n0x7fff78711000 23:48:41.026 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:161:pinStatus: In OpenSCToken::pinStatus blocked\n0x7fff78711000 23:48:41.030 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:490:getOwner: In OpenSCToken::getOwner()\n0x7fff78711000 23:48:41.030 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:177:verifyPIN: In OpenSCToken::verifyPIN(1)\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:223:_verifyPIN: In OpenSCToken::_verifyPIN(), PIN num is: 1\n0x7fff78711000 23:48:44.056 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:237:_verifyPIN:   sc_pkcs15_get_objects(pin_id=01): 2\n0x7fff78711000 23:48:44.056 [tokend] pkcs15-pin.c:295:sc_pkcs15_verify_pin: called\n0x7fff78711000 23:48:44.056 [tokend] pkcs15-pin.c:296:sc_pkcs15_verify_pin: PIN(type:0;method:1;len:)\n0x7fff78711000 23:48:44.056 [tokend] card.c:394:sc_lock: called\n0x7fff78711000 23:48:44.056 [tokend] reader-pcsc.c:547:pcsc_lock: called\n0x7fff78711000 23:48:44.057 [tokend] sec.c:159:sc_pin_cmd: called\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:550:sc_transmit_apdu: called\n0x7fff78711000 23:48:44.057 [tokend] card.c:394:sc_lock: called\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:517:sc_transmit: called\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:371:sc_single_transmit: called\n0x7fff78711000 23:48:44.057 [tokend] apdu.c:376:sc_single_transmit: CLA:0, INS:20, P1:0, P2:80, data(8) 0x7fff5e5c1010\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:269:pcsc_transmit: reader 'Yubico Yubikey NEO OTP+U2F+CCID'\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:270:pcsc_transmit:\nOutgoing APDU (13 bytes):\n00 20 00 80 08 31 32 33 34 35 36 37 38 . ...12345678\n0x7fff78711000 23:48:44.057 [tokend] reader-pcsc.c:199:pcsc_internal_transmit: called\n0x7fff78711000 23:48:44.089 [tokend] reader-pcsc.c:279:pcsc_transmit:\nIncoming APDU (2 bytes):\n90 00 ..\n. . . . .\n0x7fff78711000 23:48:44.090 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:243:_verifyPIN:   In OpenSCToken::verify returned 0 for pin 1\n0x7fff78711000 23:48:44.090 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:208:verifyPIN:   PIN verified\n. . . . .\n\n      Excerpt from the bad log:\n      . . . . .\n0x7fff78711000 23:56:07.618 [opensc-pkcs11] framework-pkcs15.c:3719:pkcs15_prkey_derive: Derivation complete. Result 32.\n. . . . .\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:147:C_CloseSession: C_CloseSession(0x7ffeb0502130)\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:98:sc_pkcs11_close_session: real C_CloseSession(0x7ffeb0502130)\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs15-pin.c:690:sc_pkcs15_pincache_clear: called\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-global.c:304:C_Finalize: C_Finalize()\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] ctx.c:819:sc_cancel: called\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] reader-pcsc.c:637:pcsc_cancel: called\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:163:card_removed: Yubico Yubikey NEO OTP+U2F+CCID: card removed\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x0)\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:129:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x0) 0\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] framework-pkcs15.c:1364:pkcs15_release_token: pkcs15_release_token() not implemented\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x1)\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] pkcs11-session.c:129:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x1) 0\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] slot.c:425:slot_token_removed: slot_token_removed(0x2)\n. . . . .\n0x7fff78711000 23:56:07.619 [opensc-pkcs11] reader-pcsc.c:533:pcsc_disconnect: called\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] card.c:357:sc_disconnect_card: returning with: 0 (Success)\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] ctx.c:842:sc_release_context: called\n0x7fff78711000 23:56:07.628 [opensc-pkcs11] reader-pcsc.c:794:pcsc_finish: called\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:502:getAcl: In OpenSCToken::getAcl()\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:154:pinStatus: In OpenSCToken::pinStatus for pinNum (1)\n0x7fff78711000 23:56:12.460 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:161:pinStatus: In OpenSCToken::pinStatus blocked\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:177:verifyPIN: In OpenSCToken::verifyPIN(1)\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:223:_verifyPIN: In OpenSCToken::_verifyPIN(), PIN num is: 1\n0x7fff78711000 23:56:15.034 [tokend] /Users/uri/src/OpenSC/OpenSC.tokend/OpenSC/OpenSCToken.cpp:237:_verifyPIN:   sc_pkcs15_get_objects(pin_id=01): 2\n0x7fff78711000 23:56:15.034 [tokend] pkcs15-pin.c:295:sc_pkcs15_verify_pin: called\n0x7fff78711000 23:56:15.034 [tokend] pkcs15-pin.c:296:sc_pkcs15_verify_pin: PIN(type:0;method:1;len:)\n0x7fff78711000 23:56:15.034 [tokend] card.c:394:sc_lock: called\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:547:pcsc_lock: called\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:440:pcsc_reconnect: Reconnecting to the card...\n0x7fff78711000 23:56:15.034 [tokend] reader-pcsc.c:303:refresh_attributes: Yubico Yubikey NEO OTP+U2F+CCID check\n0x7fff78711000 23:56:15.035 [tokend] reader-pcsc.c:323:refresh_attributes: returning with: 0 (Success)\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:547:pcsc_lock: called\n0x7fff78711000 23:56:15.036 [tokend] sec.c:159:sc_pin_cmd: called\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:550:sc_transmit_apdu: called\n0x7fff78711000 23:56:15.036 [tokend] card.c:394:sc_lock: called\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:517:sc_transmit: called\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:371:sc_single_transmit: called\n0x7fff78711000 23:56:15.036 [tokend] apdu.c:376:sc_single_transmit: CLA:0, INS:20, P1:0, P2:80, data(8) 0x7fff53ab8010\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:269:pcsc_transmit: reader 'Yubico Yubikey NEO OTP+U2F+CCID'\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:270:pcsc_transmit:\nOutgoing APDU (13 bytes):\n00 20 00 80 08 31 32 33 34 35 36 37 38 . ...12345678\n0x7fff78711000 23:56:15.036 [tokend] reader-pcsc.c:199:pcsc_internal_transmit: called\n0x7fff78711000 23:56:15.049 [tokend] reader-pcsc.c:279:pcsc_transmit:\nIncoming APDU (2 bytes):\n6D 00 m.\n0x7fff78711000 23:56:15.050 [tokend] apdu.c:386:sc_single_transmit: returning with: 0 (Success)\n0x7fff78711000 23:56:15.050 [tokend] apdu.c:539:sc_transmit: returning with: 0 (Success)\n0x7fff78711000 23:56:15.050 [tokend] card.c:434:sc_unlock: called\n0x7fff78711000 23:56:15.050 [tokend] iso7816.c:121:iso7816_check_sw: Instruction code not supported or invalid\n0x7fff78711000 23:56:15.050 [tokend] sec.c:206:sc_pin_cmd: returning with: -1204 (Unsupported INS byte in APDU)\n0x7fff78711000 23:56:15.050 [tokend] pkcs15-pin.c:368:sc_pkcs15_verify_pin: PIN cmd result -1204\n. . . . .\n\n      —\n        You are receiving this because you are subscribed to this\n        thread.\n        Reply to this email directly, view it on\n          GitHub, or mute\n          the thread.\n      \n        \n          \n          \n        \n        \n      \n    \n    \n    -- \n\n Douglas E. Engert  <DEEngert@gmail.com>"}}
{"actor":{"display_login":"dengert"}}