Comments (8)
Hi,
Can you please check the https://github.com/alonbl/pkcs11-helper/tree/always-auth with the https://github.com/alonbl/gnupg-pkcs11-scd/tree/pincache branch? It should solve the yubikey issue.
Thanks,
from gnupg-pkcs11-scd.
Hi,
i'v tested the pincache branch. My use-case works just as well with it. signing & encryption works as expected.
I tried configuring pin cache in the gnupg-pkcs11-scd.conf (both pin-cache & use-gnupg-pin-cache) but it only works for a few seconds (which is what my yubikey hardware is configured to and what i actually want to happen). So I'm not sure what behaviour is exepcted here.
Regarding the pkcs11-helper i'm not sure how to test this (i'd be happy to help if i can). I'm not using opensc, but p11-kit-proxy with the libykcs11 module from yubico directly.
Thanks.
from gnupg-pkcs11-scd.
Hi @FStelzer,
Thank you for testing.
The pin-cache is used to enforce the insecure gnupg pin cache using the gpg-preset-passphrase[1], unless you use this utility to avoid passphrase prompt you should not use it.
The question is how yubikey actually works for you if you do not use pkcs11-helper always-auth branch... I have added support for context specific login as required by yubikey PIV PKCS#11 driver[2]. As far as I know it should not work for you as it enforces CONTEXT_SPECIFIC, unless you have done something special. Maybe the p11-kit is the one that doing something strange... why do you use it?
Please notice that although pkcs11-helper is maintained within opensc project, it has nothing to do with the opensc drivers, it interact with pure PKCS#11 modules and is the access layer of the gnupg-pkcs11-scd.
If you can test a configuration without p11-kit using the https://github.com/alonbl/pkcs11-helper/tree/always-auth with the https://github.com/alonbl/gnupg-pkcs11-scd/tree/pincache it would be great. Please remove pkcs11-helper from your system when building the solution, you may install all into your home directory using:
cd pkcs11-helper-*
./configure --prefix="${HOME}/root1"
make install
cd ..
cd gnupg-pkcs11-scd-*
PKG_CONFIG_PATH="${HOME}/root1/lib" ./configure --prefix="${HOME}/root1"
make install
Just remember to export LD_LIBRARY_PATH="${HOME}/root1/lib"
Thanks,
[1] https://www.gnupg.org/documentation/manuals/gnupg/gpg_002dpreset_002dpassphrase.html
[2] https://developers.yubico.com/yubico-piv-tool/YKCS11/
from gnupg-pkcs11-scd.
In my initial setup i did on fedora34 (gpg-2.2) i had the issue described here initially. I could only sign or encrypt stuff when setting the private-mask flag to the corresponding operation. This worked with p11-kit or libykcs11 directly both.
On Fedora35 (gpg-2.3) with your patch both works just fine. With p11-kit and also libykcs11 directly. I had some issues using opensc-pkcs11 in the past so i did not try it this time.
I am using a Yubikey with 3 PIV Certs for multiple use cases.
- Email signing/encryption with Thunderbird
- SSH Authentication via pivy-agent (i'm trying yubikey-agent, but it still needs some work)
- ggpsm also for email signing/encryption when using cli email tooling
- TLS Client authentication in chromium or firefox
Since not all of these tools seem to use a shared connection to the yubikey (I had issues in the past when thunderbird would block the key from other use until restarted) i configured all to use p11-kit-proxy module, which as far as i understand uses a shared connection to the key but can simulate both types with the applications. Since then I never had to reset anything or reinsert the key.
I can try the libykcs11 (without p11-kit) with the system pkcs11-helper and with the version from your branch tomorrow.
Thanks
from gnupg-pkcs11-scd.
Thanks for the description.
You are correct that the mozilla suite once locked the session so other application were blocked, this was invalid behavior of this particular application. I was sure that thunderbird is not maintained anymore...
from gnupg-pkcs11-scd.
Ok, i tried directly configuring libykcs11.so in the pincache scd build (with the OS pkcs11-helper from fedora35) and signing & encryption also work just fine. (i only have to enter my pin once)
When i build scd with the always-auth branch of pkcs11-helper then eveything works just as well. However i get prompted for the pin twice and the pin prompt showing the token to use has encodings in it (Yubico\x20\x28www....).
Otherwise this is some pkcs11: model=, manufacturer= string.
This and that i need to enter the pin twice is the only difference i could find.
When using thunderbird to sign email directly i usually have to enter the pin twice as well though. Not sure why...
I have 3 certs on my key. One with digital signature key usage that i use for singing emails. this key has a hardware pin caching policy of "once". so i'll need to type my key everytime i use it.
The two other certs/keys are for encryption & authentication and have a short pin cache policy (a few seconds i think)
I know that this whole pkcs11 token stuff is hard to debug and the logs could contain personal and even secret information. So i'm of course hesitant to share those... But if your are interested in specific sections of the scd log during some operation then let me know.
from gnupg-pkcs11-scd.
Yubikey PKCS#11 driver has a restriction on key usage, this is why you need to authenticate twice, once for using the token and then once for each key usage. This is why I do not understand how it works with the native pkcs11-helper which should have not worked in this configuration.
Anyway, I am glad everything is working, I will perform additional tests before merging it.
from gnupg-pkcs11-scd.
Should work with gnupg-pkcs11-scd-0.9.3
from gnupg-pkcs11-scd.
Related Issues (20)
- Cannot use PIN-pad reader HOT 16
- safenet HSM card not found with gpg 2.2.9 HOT 15
- Support for SSH authentication HOT 6
- gpg 2.3.x regression HOT 25
- Select slot/token and env for library in configuration HOT 9
- Utimaco problem: Bad session key HOT 8
- Documentation Isuse for Yubikey with OpenSC HOT 5
- Problem in loading keys to the gpg HOT 8
- 9.3 release segfaults on PKAUTH command
- 9.3 release always requires PIN for signing operation HOT 7
- gpg2 --card-status fails to list any key HOT 4
- why importing same key from same token in different machine lead to different keyids HOT 1
- Instructions on compiling for Windows HOT 3
- Cannot sign, asks PIN-code, but no success HOT 9
- Support for PKCS#11 Modules without Certificates HOT 14
- gpg --expert --full-generate-key fails to recognize card HOT 1
- Command GETATTR APPTYPE and $DISPSERIALNO is not implemented HOT 13
- Can this interface support Yubikey 5? HOT 11
- gpg --sign not triggering pin entry using a key with 'always authenticate' HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gnupg-pkcs11-scd.