deon/gnuk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

move old documents to doc/note

Browse Source
This commit is contained in:
NIIBE Yutaka
2012-07-21 08:32:53 +09:00
parent 63979416f6
commit c488bed215
7 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

920
doc/note/DEMO Normal file
View File

@@ -0,0 +1,920 @@
Demonstration of Gnuk
*********************
In this text, I record my interaction to Gnuk. It consists two parts,
a GnuPG session on host side and debug output from the target.
Generate RSA 2048-bit key
=========================
$ gpg --gen-key
gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: Niibe Yutaka
Email address: gniibe@fsij.org
Comment: FSIJ USB Token v2
You selected this USER-ID:
"Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
..............+++++
.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++
..+++++
gpg: key D849F25D marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0 valid: 4 signed: 52 trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1 valid: 52 signed: 35 trust: 1-, 0q, 0n, 2m, 49f, 0u
gpg: depth: 2 valid: 11 signed: 21 trust: 0-, 0q, 0n, 0m, 11f, 0u
gpg: depth: 3 valid: 1 signed: 1 trust: 0-, 0q, 0n, 1m, 0f, 0u
gpg: next trustdb check due at 2010-08-26
pub 2048R/D849F25D 2010-08-26
Key fingerprint = 2CF6 AF50 1034 FDFE DCD9 80E3 4FF1 4AC4 D849 F25D
uid Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
sub 2048R/AB28AFD3 2010-08-26
$
Test Gnuk works
===============
$ gpg --card-status
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
Application ID ...: D276000124010200FFFE000000010000
Version ..........: 2.0
Manufacturer .....: unmanaged S/N range
Serial number ....: 00000001
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
$
Parsonalize the card
====================
$ gpg --card-edit
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
Application ID ...: D276000124010200FFFE000000010000
Version ..........: 2.0
Manufacturer .....: unmanaged S/N range
Serial number ....: 00000001
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
gpg/card> passwd
gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
gpg: gpg-agent is not available in this session
Please enter the PIN
Enter PIN:
New PIN
Enter New PIN:
New PIN
Repeat this PIN: PIN changed.
gpg/card> admin
Admin commands are allowed
gpg/card> sex
Sex ((M)ale, (F)emale or space): m
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN:
gpg/card> name
Cardholder's surname: Niibe
Cardholder's given name: Yutaka
gpg/card> login
Login data (account name): gniibe
gpg/card> url
URL to retrieve public key: http://www.gniibe.org/gniibe.asc
gpg/card> lang
Language preferences: ja
gpg/card> passwd
gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 3
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN:
New Admin PIN
Enter New Admin PIN:
New Admin PIN
Repeat this PIN: PIN changed.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 4
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN:
New Reset Code
Enter New PIN:
New Reset Code
Repeat this PIN: Reset Code set.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? q
gpg/card> quit
$
Key import to the card
======================
$ gpg --edit-key d849f25d
gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
pub 2048R/D849F25D created: 2010-08-26 expires: never usage: SC
trust: ultimate validity: ultimate
sub 2048R/AB28AFD3 created: 2010-08-26 expires: never usage: E
[ultimate] (1). Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
gpg> toggle
sec 2048R/D849F25D created: 2010-08-26 expires: never
ssb 2048R/AB28AFD3 created: 2010-08-26 expires: never
(1) Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
gpg> keytocard
Really move the primary key? (y/N) y
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
Please select where to store the key:
(1) Signature key
(3) Authentication key
Your selection? 1
You need a passphrase to unlock the secret key for
user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
2048-bit RSA key, ID D849F25D, created 2010-08-26
gpg: gpg-agent is not available in this session
Enter passphrase: gpg: writing new key
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN:
sec 2048R/D849F25D created: 2010-08-26 expires: never
card-no: FFFE 00000001
ssb 2048R/AB28AFD3 created: 2010-08-26 expires: never
(1) Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
gpg> key 1
sec 2048R/D849F25D created: 2010-08-26 expires: never
card-no: FFFE 00000001
ssb* 2048R/AB28AFD3 created: 2010-08-26 expires: never
(1) Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
gpg> keytocard
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
Please select where to store the key:
(2) Encryption key
Your selection? 2
You need a passphrase to unlock the secret key for
user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
2048-bit RSA key, ID AB28AFD3, created 2010-08-26
Enter passphrase: gpg: writing new key
sec 2048R/D849F25D created: 2010-08-26 expires: never
card-no: FFFE 00000001
ssb* 2048R/AB28AFD3 created: 2010-08-26 expires: never
card-no: FFFE 00000001
(1) Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
gpg> quit
Save changes? (y/N) y
$
Making Digital signature
========================
$ gpg -u d849f25d --clearsign README
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
gpg: signatures created so far: 0
Please enter the PIN
[sigs done: 0]
gpg: gpg-agent is not available in this session
$ gpg --verify README.asc
gpg: Signature made Mon Sep 13 11:28:00 2010 JST using RSA key ID D849F25D
gpg: Good signature from "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
$
Decryption using Gnuk
=====================
$ gpg -u d849f25d --encrypt README
You did not specify a user ID. (you may use "-r")
Current recipients:
Enter the user ID. End with an empty line: d849f25d
Current recipients:
2048R/AB28AFD3 2010-08-26 "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
Enter the user ID. End with an empty line:
$ gpg --decrypt README.gpg
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
Please enter the PIN
gpg: gpg-agent is not available in this session
Enter PIN: gpg: verify CHV2 failed: bad passphrase
gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
"Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
gpg: public key decryption failed: bad passphrase
gpg: decryption failed: secret key not available
$ gpg --decrypt README.gpg
gpg: detected reader `FSIJ USB Token (20100910) 00 00'
Please enter the PIN
gpg: gpg-agent is not available in this session
Enter PIN: gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
"Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
[... output of README ... ]
$
Corresponding DEBUG output
==========================
$ cu -l /dev/ttyACM0
^GConnected.
ON
ON
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
0065
GPG!: 20001284
- Get Data
005b
GPG!: 20001284
- Get Data
5f2d
GPG!: 20001284
- Get Data
5f35
GPG!: 20001284
- Get Data
5f50
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
007a
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
0065
GPG!: 20001284
- Get Data
005b
GPG!: 20001284
- Get Data
5f2d
GPG!: 20001284
- Get Data
5f35
GPG!: 20001284
- Get Data
5f50
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
007a
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
007a
GPG!: 20001284
Change PW
01
flash DO
flash DO...done
Changed DO_KEYSTRING_PW1.
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- VERIFY
83
good
GPG!: 20001284
- PUT DATA
5f35
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
005b
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
005e
flash DO
flash DO...done
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- PUT DATA
5f50
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
5f2d
flash DO
flash DO...done
GPG!: 20001284
- Get Data
005b
GPG!: 20001284
- Get Data
5f2d
GPG!: 20001284
- Get Data
5f35
GPG!: 20001284
- Get Data
5f50
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
007a
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
Change PW
03
Random: 000028ca
Random: 00004d02
flash DO
flash DO...done
done.
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- VERIFY
83
good
GPG!: 20001284
- PUT DATA
00d3
Resetting Code!
done (no prvkey).
flash DO
flash DO...done
flash DO
flash DO...done
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
0065
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- VERIFY
83
good
GPG!: 20001284
- PUT DATA
3fff
4d 82 01 16 b6 00 7f 48 08 91 04 92 81 80 93 81
80 5f 48 82 01 04 00 01 00 01 ee 1c 56 89 bf c7
78 9d b4 2b 30 2f 69 2d e4 ac 3f d8 79 83 60 02
c0 b4 88 7d 46 4d be c3 ad 69 77 02 c1 3a 84 a1
0b 61 5c 73 79 b6 04 27 29 f7 f3 58 1d 31 45 cd
7d b0 1c d4 90 f8 fa 98 45 19 52 4b f0 f2 bc 5f
86 e5 2f 85 67 55 a3 3d f2 7f 57 66 c5 ce 5d ac
3f 72 d8 25 35 30 a9 73 e3 8a b9 8a b5 42 95 a0
73 8a 04 d7 4a 05 67 9c 8c 0b d4 56 0e 99 44 07
6e f9 aa 24 ce 88 07 ff 9d 39 f8 57 33 95 bc b9
96 64 cf 67 c2 bb c0 b4 a1 b0 44 ee e7 6b c9 6a
ea ec e0 14 8c 57 00 39 04 20 7d 99 df f8 50 23
1e 80 79 ea 86 9b 2c 4d b8 4f 8c d3 7e 08 99 9b
63 ca 8f 93 dd 9f ce b6 ff 81 9e 53 86 79 70 52
e8 5b be b0 62 ca 52 42 85 46 c0 6c 50 7d d1 9d
51 b6 c3 9e 2c d3 1a 60 e9 8a 62 2e 4e 67 d7 8d
aa 31 f3 b3 2d 78 22 4c de fa 44 b7 6f a6 2c 08
09 da 3d 51 ab 8c 83 9c 29 e7
Key import
0100
Getting keystore address...
key_addr: 0800e800
Random: 00001265
Random: 00003e52
ENC
ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
ENC
4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
ENC
4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
ENC
4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
00c7
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
00ce
flash DO
flash DO...done
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- PUT DATA
3fff
4d 82 01 16 b8 00 7f 48 08 91 04 92 81 80 93 81
80 5f 48 82 01 04 00 01 00 01 dd 7a 0f 38 d9 e5
29 e3 14 47 d9 b5 4e a7 f1 cf b0 8e 7c a4 9b 39
57 e0 ab 36 39 f5 97 0b 96 ac cd 8c c9 e3 de 45
0a 48 93 84 8a 14 ea cd 9b 91 1f d5 31 52 76 b0
60 e0 42 65 ab b3 dc 85 4c 6c 64 1c 13 83 89 4d
b4 75 03 2d 11 38 29 72 5e 4b 89 4e c0 da 72 e5
1e 53 82 a7 e2 e8 f1 05 07 47 8d 72 02 46 c8 95
4d 52 6d e8 9d 28 75 d5 65 b3 2e f3 c1 a1 fb 5b
45 fa 4a 12 b1 04 3f 81 65 f5 ef a9 51 2b a2 13
60 5a 95 c1 c2 13 26 05 14 d5 9e 05 ec de 0a c1
53 1a d8 3e b0 5b d4 87 55 79 26 ff e5 91 79 96
e9 98 a8 6f 54 eb e6 d7 a6 ba 81 fc a3 cc e7 5b
7a a0 7e 37 e1 4e af 82 f1 57 9b df bd 4f 18 65
f2 b3 ab 7e 08 16 e6 d6 bf 6b 3f 9a 16 2a 1a 8c
2d c6 57 5a 48 3e 5a 43 96 19 a4 15 cf ef a5 be
ab 48 97 09 e1 64 94 6e 88 c3 04 cd c9 5b 54 b0
95 38 5a 4d 0b a6 86 70 5c 1d
Key import
0100
Getting keystore address...
key_addr: 0800ea00
Random: 00007dfd
Random: 0000ac26
ENC
dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
ENC
6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
ENC
6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
ENC
6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
flash DO
flash DO...done
flash DO
flash DO...done
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
00c8
flash DO
flash DO...done
GPG!: 20001284
- PUT DATA
00cf
flash DO
flash DO...done
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
007a
GPG!: 20001284
- VERIFY
81
verify_pso_cds
06
DEC
4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
DEC
ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
good
GPG!: 20001284
- PSO: 20001264
0023
RSA sign...ok...done.
flash DO
flash DO...done
PSO done.
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- VERIFY
82
verify_pso_other
DEC
1a d0 32 c3 06 c8 68 58 0c 5a 7b 81 80 62 2c 45
DEC
a0 e8 98 60 66 36 93 0e f2 cd e5 56 3c ca aa 0a
d7 b1 5e 1f 97 20 1b c0 86 98 a5 fb bf da b3 c6
24 18 d9 8c e2 a1 c0 5c c1 7f 8d 8f 44 1d d3 78
30 97 da 55 6b 63 a4 3e 6f ad 4b c3 1e fa 6f 64
22 7b b3 63 c6 b5 2f 4b 84 cd e1 b4 12 3a a3 76
75 96 05 f8 a3 b4 9a 04 7c f4 e3 7a 47 c1 10 82
f3 8b 5f d0 7a de 46 1a 7b d6 71 7d 11 f8 91 9e
03 6e af eb 9a 1a c2 3c 54 da fd 07 1f 94 b8 6c
14 3e c3 9e e0 57 65 56 cd af 59 74 27 06 72 56
35 1e 4b 8b fe 71 1a 6e 73 9a 59 b6 eb 61 35 81
bf df d2 45 a3 be 4f a9 65 fe 6a b8 7e 60 0e e2
14 a4 bc f7 ef a1 f1 49 4e 67 e3 0a 37 ea 30 10
c6 7f 20 94 91 2b 38 1a dc 90 c1 f5 b7 22 c7 0e
46 08 91 a0 ec 12 35 60 46 d4 9d f5 cb 00 b7 21
89 ae 8f 83 aa 24 c8 3b e5 25 ae 71 c6 3a 3f ae
90 47 86 1c 42 f4 fc 56 7c 9a 39 55 90 89 42 20
51 d0 e3 dc 45 c3 1f f7 69 26 36 f6 66 14 26 de
gpg_do_load_prvkey failed.
flash DO
flash DO...done
failed
GPG!: 20001284
- select DF by name
GPG!: 20001284
- Get Data
004f
GPG!: 20001284
- Get Data
5f52
GPG!: 20001284
- Get Data
00c4
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
005e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- Get Data
006e
GPG!: 20001284
- VERIFY
82
verify_pso_other
DEC
6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
DEC
dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
flash DO
flash DO...done
good
GPG!: 20001284
- PSO: 20001264
0101
RSA decrypt:20001234
00000100
RSA decrypt ...done.
PSO done.
--

233
doc/note/DEMO-2 Normal file
View File

@@ -0,0 +1,233 @@
$ unset GPG_AGENT_INFO
$ gpg --card-edit
gpg: detected reader `FSIJ USB Token (20101023) 00 00'
Application ID ...: D276000124010200F517000000010000
Version ..........: 2.0
Manufacturer .....: unknown
Serial number ....: 00000001
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
gpg/card> passwd
gpg: OpenPGP card no. D276000124010200F517000000010000 detected
gpg: gpg-agent is not available in this session
Please enter the PIN
Enter PIN: 123456
New PIN
Enter New PIN: *************
New PIN
Repeat this PIN: *************
PIN changed.
gpg/card> admin
Admin commands are allowed
gpg/card> sex
Sex ((M)ale, (F)emale or space): m
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN: 12345678
gpg/card> name
Cardholder's surname: Niibe
Cardholder's given name: Yutaka
gpg/card> login
Login data (account name): gniibe
gpg/card> url
URL to retrieve public key: http://www.gniibe.org/gniibe.asc
gpg/card> lang
Language preferences: ja
gpg/card> passwd
gpg: OpenPGP card no. D276000124010200F517000000010000 detected
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 3
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN: 12345678
New Admin PIN
Enter New Admin PIN: ***************
New Admin PIN
Repeat this PIN: ***************
PIN changed.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 4
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN: ***************
New Reset Code
Enter New PIN: ************
New Reset Code
Repeat this PIN: ************
Reset Code set.
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? q
gpg/card> quit
$ gpg --edit-key 4CA7BABE
gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
pub 2048R/4CA7BABE created: 2010-10-15 expires: never usage: SC
trust: ultimate validity: ultimate
sub 2048R/084239CF created: 2010-10-15 expires: never usage: E
sub 2048R/5BB065DC created: 2010-10-22 expires: never usage: A
[ultimate] (1). NIIBE Yutaka <gniibe@fsij.org>
gpg> toggle
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
ssb 2048R/084239CF created: 2010-10-15 expires: never
ssb 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> keytocard
Really move the primary key? (y/N) y
gpg: detected reader `FSIJ USB Token (20101023) 00 00'
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
Please select where to store the key:
(1) Signature key
(3) Authentication key
Your selection? 1
You need a passphrase to unlock the secret key for
user: "NIIBE Yutaka <gniibe@fsij.org>"
2048-bit RSA key, ID 4CA7BABE, created 2010-10-15
gpg: gpg-agent is not available in this session
gpg: writing new key
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
Enter Admin PIN: ***************
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/084239CF created: 2010-10-15 expires: never
ssb 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> key 1
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb* 2048R/084239CF created: 2010-10-15 expires: never
ssb 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> keytocard
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
Please select where to store the key:
(2) Encryption key
Your selection? 2
You need a passphrase to unlock the secret key for
user: "NIIBE Yutaka <gniibe@fsij.org>"
2048-bit RSA key, ID 084239CF, created 2010-10-15
gpg: writing new key
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb* 2048R/084239CF created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> key 1
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/084239CF created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> key 2
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/084239CF created: 2010-10-15 expires: never
card-no: F517 00000001
ssb* 2048R/5BB065DC created: 2010-10-22 expires: never
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> keytocard
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
Please select where to store the key:
(3) Authentication key
Your selection? 3
You need a passphrase to unlock the secret key for
user: "NIIBE Yutaka <gniibe@fsij.org>"
2048-bit RSA key, ID 5BB065DC, created 2010-10-22
gpg: writing new key
sec 2048R/4CA7BABE created: 2010-10-15 expires: never
card-no: F517 00000001
ssb 2048R/084239CF created: 2010-10-15 expires: never
card-no: F517 00000001
ssb* 2048R/5BB065DC created: 2010-10-22 expires: never
card-no: F517 00000001
(1) NIIBE Yutaka <gniibe@fsij.org>
gpg> quit
Save changes? (y/N) y
$

53
doc/note/HACKING Normal file
View File

@@ -0,0 +1,53 @@
* [DONE] Random Number Generator
RNG is needed for Data Encryption Key to encrypt private key (P and Q).
It is important to collect enough entropy. Perhaps, it would
be possible to get entropy from USB traffic (of other devices).
* RSA
It would be good not to use malloc.
* Flash ROM recover from unexpected shutdown during write
* [DONE] configure support
configure script would be good to select a board and to generate
random serial number.
* [DONE] Random number update
Implemented using SECECT_FILE and UPDATE_BINARY command, which is not
in the OpenPGP card specification.
Old description: Currently, Gnuk doesn't have random number generator,
but use random bytes calculated by hosts. After Gnuk uses random
number, the entry in Flash ROM will be cleared. Some scheme to update
random number bytes is needed. Possibly, private Data Objects, or by
another SELECT FILE.
* [DONE] Manufacture ID
Get it from FSFE.
* [DONE] Serial number
The AID of the card contains serial number. It should be unique. USB
serial number should be unique to identify different tokens, too.
* [DONE] Flash ROM garbage collection
* [DONE] Flash ROM protection
Flash ROM can be protected with OpenOCD. DfuSe users should know that
the content can be accessible by DfuSe, even if we enable read
protection of flash ROM. For proper protection, don't use DfuSe but
use OpenOCD to write and protect.

89
doc/note/NOTES Normal file
View File

@@ -0,0 +1,89 @@
USB communication (current)
===========================
* Get response, command chaining, short APDU only.
If it were only for token and no smartcard:
* Get response, command chaining and short APDU would be considered
useless.
* It would be wise to use extended APDU and CCID/ICCD block chaining.
The question would be: When lower layer (CCID/ICCD layer) support
enough mechanism of block assembly, why not use one in the application
layer (ISO 7816)?
For token implementation, CCID/ICCD would be lower layer and ISO 7816
would be higher layer, but it's different in fact. The figure of
communication is like::
host <-----------> reader <---------> smartcard
CCID/ICCD ISO 7816
host <--> token
Given the situation host side (GnuPG) already has the features of
handling get response, command chaining, and short APDU only, it is
rather better to do that on token side too.
Besides, supporting extended APDU on host side, it would be needed to
prepare 64KB buffer (that's the maximum size), as there is no explicit
limitation for buffer size. 64KB would be large, and this could be
avoided when we use short APDU only.
USB communication (second attempt)
==================================
* No get response, no command chaining, but extended APDU and extended
Lc and Le. I think that this keep the code simple.
* The value of dwMaxCCIDMessageLength is 320, that's the size
of header of ICC block plus size of maximum APDU (by 64
granularity). Still, some ccid implementation (ccid 1.3.11, for
example) sends ICC block using chaining unfortunately, so we keep
the code of ICC block chaining.
USB communication (initial attempt)
===================================
* Once in the past (version <= 0.4), the value of
dwMaxCCIDMessageLength was 64 and we supported CCID/ICCD block chaining,
so that we could not handle multple Bulk transactions.
OpenPGP card protocol implementation
====================================
I try to follow "no clear password(s)" policy, even if it is on
protected flash memory. Further, keystrings for user and reset code
are removed after key imports. Because of this, replacing keys are
not possible without password information. (Thus, replacing existing
keys are not supported.)
Therefore, there is "no clear password" and "no keystrings" on flash
ROM when Gnuk is used by admin-less mode. When it is used with admin,
the keystring of admin is on flash ROM.
How a private key is stored
===========================
KEYPTR
----> [ P ][ Q ][ N ]
<---encrypted----><--- plain ---->
key_addr 4-byte
initial_vector (random) 16-byte
checksum_encrypted 16-byte
dek_encrypted_by_keystring_pw1 16-byte
dek_encrypted_by_keystring_rc 16-byte
dek_encrypted_by_keystring_pw3 16-byte
... decrypted to
[ P ][ Q ]
checksum 16-byte

132
doc/note/firmware-update Normal file
View File

@@ -0,0 +1,132 @@
Firmware update feature
=======================
The firmware update feature of Gnuk is experimental. Please be
careful using that.
Note that updating firmware, all data objects and keys will be
removed. There is _no way_ to preserve those data.
Preparation
===========
In addition to settings of Gnuk, I create a file
/etc/udev/rules.d/92-gnuk.rules::
# For updating firmware, permission settings are needed.
SUBSYSTEMS=="usb", ATTRS{idVendor}=="234b", ATTRS{idProduct}=="0000", \
ENV{ID_USB_INTERFACES}=="*:ff0000:*", GROUP="pcscd"
While I am a member of group "pcscd" in /etc/group.
This is needed for reGNUal, the firmware update program.
Registering a public key for firmware update
============================================
You need to register a public key to update the firmware. It should
be RSA 2048-bit.
One way to extract public key data is by using "gpg-connect-agent"
command connecting gpg-agent.
We can examine key information of gpg-agent by "KEYINFO" command.
Here is my example::
$ gpg-connect-agent "KEYINFO --list" /bye
S KEYINFO 4970A0D537CA2EF7CE6A106E47AD89B0EFB684C8 D - - - - -
S KEYINFO 65F67E742101C7FE6D5B33FCEFCF4F65EAF0688C T D276000124010200F517000000010000 OPENPGP.2 - - -
S KEYINFO 5D6C89682D07CCFC034AF508420BF2276D8018ED T D276000124010200F517000000010000 OPENPGP.3 - - -
S KEYINFO 7D180C0C2A991B25204110A92F5F92A5A509845B D - - - - -
S KEYINFO 101DE7B639FE29F4636BDEECF442A9273AFA6565 T D276000124010200F517000000010000 OPENPGP.1 - - -
OK
I have two local keys (in my PC) and three keys in my token.
With the script below, I extract public key of the keygrip
5D6C89682D07CCFC034AF508420BF2276D8018ED into the file: 5D6C8968.bin::
$ ./get_public_key.py 5D6C89682D07CCFC034AF508420BF2276D8018ED
Here is the script, get_public_key.py::
#! /usr/bin/python
import sys, binascii
from subprocess import check_output
def get_gpg_public_key(keygrip):
result = check_output(["gpg-connect-agent", "READKEY %s" % keygrip, "/bye"])
key = ""
while True:
i = result.find('%')
if i < 0:
key += result
break
hex_str = result[i+1:i+3]
key += result[0:i]
key += chr(int(hex_str,16))
result = result[i+3:]
pos = key.index("D (10:public-key(3:rsa(1:n257:") + 31 # skip NUL too
key = key[pos:-17] # )(1:e3:XYZ)))\nOK\n
if len(key) != 256:
raise ValueError, binascii.hexlify(key)
return key
if __name__ == '__main__':
keygrip = sys.argv[1]
k = get_gpg_public_key(keygrip)
shorthand = keygrip[0:8] + ".bin"
f = open(shorthand,"w")
f.write(k)
f.close()
Then, we can put the data of public key into token by::
$ tool/gnuk_put_binary_libusb.py -k 0 5D6C8968.bin
Invoking firmware update
========================
We specify reGNUal binary and Gnuk binary.
$ ../tool/gnuk_upgrade.py ../regnual/regnual.bin gnuk.bin
Two or more tokens
==================
Currently, GnuPG doesn't support multiple devices connected to the
host.
In order to update the firmware of a TARGET token, we use GnuPG to
authenticate with public key. It is assumed that you have another
AUTH token for this. This situation is somewhat complicated.
What I do is:
(1) Don't run PC/SC daemon::
# /etc/init.d/pcscd stop
(2) To make sure, kill scdaemon::
$ killall -9 scdaemon
(3) Insert the AUTH token to USB, and use it::
$ gpg --card-status
(4) Insert the TARGET token to USB (after scdaemon communicates AUTH
token), and invoke gnuk_upgrade.py.
In this situation, gnuk_upgrade.py tries to connect one of tokens,
but a connection to the AUTH token will fail because scdaemon is
connecting to that device, and will be expected to connect to the
TARGET token succesufully, instead.
--

34
doc/note/settings-for-DnDpinentry Normal file
View File

@@ -0,0 +1,34 @@
On GNU/Linux Desktop, I use udisks-glue so that DnDpinentry folder can
be mounted with sync and noatime options.
After installing udisks-glue, I invoke gnome-session-properties to
add udisks-glue to "Startup Program".
Then, I have two files to configure udisks (disable udisks for
DnDpinentry) and udisks-glue (enable and specify options for DnDpinentry).
/etc/udev/rules.d/88-udisks.rules
---------------
ENV{ID_VENDOR}=="FSIJ", ENV{DEVTYPE}=="disk", ENV{ID_FS_LABEL}=="DnDpinentry", ENV{UDISKS_PRESENTATION_NOPOLICY}="1"
---------------
~/.udisks-glue.conf
---------------
filter gone {
label = "DnDpinentry"
optical = false
}
match gone {
automount = true
automount_options = { sync, noatime }
}
---------------
We need following setting for pinentry. Or else, you can't do
anything when pinentry grabs mouse focus.
~/.gnupg/gpg-agent.conf
---------------
no-grab
---------------