{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1292","repository_url":"https://api.github.com/repos/OpenSC/OpenSC","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1292/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1292/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1292/events","html_url":"https://github.com/OpenSC/OpenSC/issues/1292","id":306959790,"node_id":"MDU6SXNzdWUzMDY5NTk3OTA=","number":1292,"title":"PIV II regression: Unable to decipher (Security status not satisfied)","user":{"login":"dpward","id":217655,"node_id":"MDQ6VXNlcjIxNzY1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/217655?v=4","gravatar_id":"","url":"https://api.github.com/users/dpward","html_url":"https://github.com/dpward","followers_url":"https://api.github.com/users/dpward/followers","following_url":"https://api.github.com/users/dpward/following{/other_user}","gists_url":"https://api.github.com/users/dpward/gists{/gist_id}","starred_url":"https://api.github.com/users/dpward/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dpward/subscriptions","organizations_url":"https://api.github.com/users/dpward/orgs","repos_url":"https://api.github.com/users/dpward/repos","events_url":"https://api.github.com/users/dpward/events{/privacy}","received_events_url":"https://api.github.com/users/dpward/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":43,"created_at":"2018-03-20T17:14:28Z","updated_at":"2018-07-09T03:09:06Z","closed_at":"2018-04-05T14:37:46Z","author_association":"CONTRIBUTOR","body":"#1256 introduced a regression where I am no longer able to decrypt e-mails in Thunderbird or access PKI-enabled websites in Firefox using my PIV II card. My PIN is still accepted, and I am still able to display objects/certificates on the card using `pkcs11-tool`.\r\n\r\nI am using pcsc-lite 1.8.23 and pcsc-lite-ccid 1.4.29 under RHEL 7.4, on a Dell Latitude E7450, using its integrated smart card reader (via the Broadcom 5880 USH).\r\n\r\nI've collected the relevant section from the [working debug log](https://gist.github.com/dpward/646439e9e32c0fa9424abeb7da6f2c3e#file-opensc-debug-1d4f59e-log) with commit 1d4f59e (immediately before this PR was merged), and the [non-working debug log](https://gist.github.com/dpward/646439e9e32c0fa9424abeb7da6f2c3e#file-opensc-debug-7ca16a7-log) with commit 7ca16a7 (the merge commit for this PR). APDU contents are removed.\r\n"},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/403347468","html_url":"https://github.com/OpenSC/OpenSC/issues/1292#issuecomment-403347468","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1292","id":403347468,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzM0NzQ2OA==","user":{"login":"mouse07410","id":5923577,"node_id":"MDQ6VXNlcjU5MjM1Nzc=","avatar_url":"https://avatars1.githubusercontent.com/u/5923577?v=4","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"created_at":"2018-07-09T03:09:06Z","updated_at":"2018-07-09T03:09:06Z","author_association":"CONTRIBUTOR","body":"I just tested Yubikey NEO (ECCP256) and Yubikey 4 (ECCP384) keys with the current master (using `pkcs11-tool`,  `libp11` with `openssl`, and `pkcs15-crypt`). They all appeared to work as expected.\r\n\r\nYubikey 4:\r\n```\r\nUsing reader with a card: Yubico Yubikey 4 OTP+U2F+CCID\r\nread EC key\r\nopenssl dgst -sha384 -binary -out /tmp/derive.2048.sha384 yubi-ecc-ccc.txt\r\npkcs11-tool --sign -f 'openssl' -m ECDSA -d 02 -i /tmp/derive.2048.sha384 -o /tmp/yubi-ecc-ccc.txt.sig\r\nUsing slot 0 with a present token (0x0)\r\nLogging in to \"PIV_II\".\r\nPlease enter User PIN: \r\nUsing signature algorithm ECDSA\r\nLogging in to \"PIV_II\".\r\nPlease enter context specific PIN: \r\nSignature for yubi-ecc-ccc.txt is stored in /tmp/yubi-ecc-ccc.txt.sig\r\n\r\npkcs11-tool -r -y pubkey -d 02 -o /tmp/derive.2048.02\r\nUsing slot 0 with a present token (0x0)\r\nopenssl dgst -verify /tmp/derive.2048.02 -keyform DER -sha384 -signature /tmp/yubi-ecc-ccc.txt.sig yubi-ecc-ccc.txt\r\nVerified OK\r\n\r\nopenssl dgst -engine pkcs11 -keyform engine -sha384 -verify \"pkcs11:manufacturer=piv_II;object=SIGN%20pubkey;type=public\" -signature /tmp/yubi-ecc-ccc.txt.sig yubi-ecc-ccc.txt\r\nengine \"pkcs11\" set.\r\nVerified OK\r\n```\r\n\r\nand Yubikey NEO:\r\n```\r\n$ pkcs11-ecdsa-demo2\r\nGenerating random 250 bytes of Base64-encoded data...\r\nopenssl rand -base64 -out /tmp/derive.2125.text 250\r\n\r\nExamining public key on the token to determine its curve...\r\nUsing reader with a card: Yubico Yubikey NEO OTP+U2F+CCID\r\nread EC key\r\nThe key pair is on the curve prime256v1, will use hash sha256\r\n\r\nGenerating digital signature over /tmp/derive.2125.text...\r\nopenssl dgst -engine pkcs11 -keyform engine -sha256 -sign \"pkcs11:manufacturer=piv_II;object=SIGN%20key;type=private\" -out /tmp/derive.2125.text.sig /tmp/derive.2125.text\r\nengine \"pkcs11\" set.\r\nEnter PKCS#11 token PIN for Me Mouse:\r\nSignature is stored in /tmp/derive.2125.text.sig\r\n\r\nVerifying signature over /tmp/derive.2125.text...\r\nopenssl dgst -engine pkcs11 -keyform engine -sha256 -verify \"pkcs11:manufacturer=piv_II;object=SIGN%20pubkey;type=public\" -signature /tmp/derive.2125.text.sig /tmp/derive.2125.text\r\nengine \"pkcs11\" set.\r\nVerified OK\r\n```\r\n\r\nYubikey 4 using `pkcs15-crypt`:\r\n```\r\n$ openssl rand -out /tmp/sha384-rand.dat 48\r\n$ pkcs15-crypt -s -f 'openssl' --key 02 -i /tmp/sha384-rand.dat -o /tmp/sha384-rand.sig --sha-384\r\nUsing reader with a card: Yubico Yubikey 4 OTP+U2F+CCID\r\nEnter PIN [PIN]: \r\n$ openssl pkeyutl -engine pkcs11 -keyform engine -pubin -inkey \"pkcs11:manufacturer=piv_II;id=%02;type=public\" -verify -sigfile /tmp/sha384-rand.sig -in /tmp/sha384-rand.dat\r\nengine \"pkcs11\" set.\r\nSignature Verified Successfully\r\n$\r\n```"}}
{"actor":{"display_login":"mouse07410"}}