Ticket #177 (reopened enhancement)

NB! If you want the issue fixed, leave an e-mail address or check back often.

Opened 2 years ago

Last modified 6 weeks ago

[PATCH] support for Italian CNS

Reported by: ep Owned by: viktor.tarasov@…
Priority: normal Milestone: 0.12.1
Component: opensc Version: trunk
Severity: normal Keywords: haspatch sm
Cc: ep@…, soujak@…

Description

This patch adds seemingly working support for the Italian CNS (eID and more) card.

Attachments

itacns-0.1.tar.gz Download (8.0 KB) - added by ep 2 years ago.
README and patches
itacns-0.2.tar.gz Download (8.8 KB) - added by ep 2 years ago.
Updated patch
itacns-0.3.tar.gz Download (22.5 KB) - added by ep 2 years ago.
Version 0.3, with Secure Messaging
itacns-r4518-20100719.patch.gz Download (13.1 KB) - added by ep 6 weeks ago.
itacns2.patch Download (42.9 KB) - added by martin 6 weeks ago.
itacns-patch3.diff Download (43.5 KB) - added by ep 3 weeks ago.
Updated patch against current trunk.
itacns-patch4.diff Download (39.9 KB) - added by ep 3 weeks ago.
Updated; further clean-up performed.
itacns-patch5.diff Download (43.5 KB) - added by ep 3 weeks ago.
Cardholder name is now included in the PKCS #15 label

Change History

Changed 2 years ago by ep

README and patches

  Changed 2 years ago by ep

NOTE: if you test this, do not forget to edit opensc.conf and enable "itacns" for "builtin_emulators" in the "framework pkcs15" section.

follow-ups: ↓ 3 ↓ 4   Changed 2 years ago by alonbl

Is it ready for merge? No opened issues? Why did you not enable the driver is opensc.conf?

in reply to: ↑ 2   Changed 2 years ago by ep

Replying to alonbl:

Is it ready for merge? No opened issues? Why did you not enable the driver is opensc.conf?

I forgot that it can/should be enable in the default configuration; thanks for reminding me!

I'd like to get some more testing/reports, but I guess that I'd get them more easily if it's in trunk, and it should not hurt anyone. I'll post here an updated version with a couple of enhancements (PUK, more standard data objects, detection of the official ID card) and a couple of fixes (the configuration and PIN retries, as soon as I figure it out). That will be ready for merge, in my opinion.

Thanks!

Changed 2 years ago by ep

Updated patch

in reply to: ↑ 2   Changed 2 years ago by ep

itacns-0.2.tar.gz is ready for merge, IMO. No open issues that I could detect.

Changed 2 years ago by ep

Version 0.3, with Secure Messaging

  Changed 2 years ago by ep

Version 0.3 has some more important changes, all related to the implementation of Secure Messaging; I'll soon post a message onto the mailing list rather than explain them here.

  Changed 2 years ago by ep

  • cc ep@… added

Version 0.3 is being actively tested and developed by a team. Interested parties can download the latest version of the patches from the Mercurial repository at  http://itacns.corp.it/hg/itacns/ .

  Changed 21 months ago by martin

  • version changed from 0.11.4 to trunk
  • milestone set to 0.11.7

  Changed 21 months ago by martin

  • owner changed from opensc-devel@… to martin
  • status changed from new to assigned

  Changed 7 months ago by martin

  • milestone 0.11.7 deleted

Milestone 0.11.7 deleted

  Changed 5 months ago by martin

  • keywords haspatch sm added; italian cns patch removed
  • summary changed from Patch: support for Italian CNS to [PATCH] support for Italian CNS
  • milestone set to 0.12.1

In addition to the small things this patch does, it adds support for secure messaging, which design might not be the only and best solution.

  Changed 5 months ago by viktor.tarasov@…

  • owner changed from martin to viktor.tarasov@…
  • status changed from assigned to new

Martin Paljak wrote:
Can you have a look and see if:
a) parts of it can be integrated anyway
b) some of the code could be re-used for a better SM implementation
c) some parts of the design can be upgraded on the way

I take this ticket.

follow-up: ↓ 13   Changed 5 months ago by viktor.tarasov@…

I've been too optimistic, it'll be hardly possible to integrate these patchs without having CNS card .

I would like to do it in the two stages: first of all the support of CNS card without secure messaging; then some more general support of SM.

Afais, in the CNS card the SM protects qualified signature and associated PINs. So, at the first stage, the support of CNS card without Q-Sign key and SignPIN should be implemented.

Proposed patch make some touchs of the core sources, imho, not always justified; it uses deprecated PRKEY access; Sign PIN flags, defined in CNS emulator, imho, should be corrected... that's what I've seen at the first glance. It'll be difficult to make a changes to this patch without card.

So, I propose to postpone CNS ard support untill the better times.

in reply to: ↑ 12 ; follow-up: ↓ 15   Changed 5 months ago by ep

Replying to viktor.tarasov@…:

I've been too optimistic, it'll be hardly possible to integrate these patchs without having CNS card .

I do and I'm willing to do the work :)

I would like to do it in the two stages: first of all the support of CNS card without secure messaging; then some more general support of SM.

That's the path I took. I agree completely with your view.

Proposed patch make some touchs of the core sources, imho, not always justified;

IIRC, they were needed workarounds; I feel that we could at least conditionally include those of them that are really needed.

it uses deprecated PRKEY access; Sign PIN flags, defined in CNS emulator, imho, should be corrected... that's what I've seen at the first glance.

Please give me a pointer or two, if you have time. The PRKEY issue completely escapes me right now (couldn't dig up anything in the mailing list).

Otherwise, I'll try to keep the patches in sync with OpenSC.

Thanks!

  Changed 5 months ago by viktor.tarasov@…

About PRKEY: I've seen in the patch a new SC_PKCS15_PRKEY_ACCESS_SIGN_WITH_DECRYPT flag, that I confounded with recently deprecated SC_PKCS15_CARD_FLAG_SIGN_WITH_DECRYPT .

About SignPIN flags: the both SignPIN and SignPUK have the SC_PKCS15_PIN_FLAG_UNBLOCKING_PIN flag.

in reply to: ↑ 13   Changed 4 months ago by mike3050

  • status changed from new to closed
  • resolution set to fixed

Replying to ep:

Replying to viktor.tarasov@…:

I've been too optimistic, it'll be hardly possible to integrate these  auto insurance quotes patchs without having CNS card .

I do and I'm willing to do the work :)

I would like to do it in the two stages: first of all the support of CNS card without secure messaging; then some more general support of SM.

That's the path I took. I agree completely with your view.

Proposed patch make some touchs of the core sources, imho, not always justified;

IIRC, they were needed workarounds; I feel that we could at least conditionally include those of them that are really needed.

it uses deprecated PRKEY access; Sign PIN flags, defined in CNS emulator, imho, should be corrected... that's what I've seen at the first glance.

Please give me a pointer or two, if you have time. The PRKEY issue completely escapes me right now (couldn't dig up anything in the mailing list). Otherwise, I'll try to keep the patches in sync with OpenSC. Thanks!

Thank you.

Changed 6 weeks ago by ep

follow-up: ↓ 17   Changed 6 weeks ago by ep

  • status changed from closed to reopened
  • resolution fixed deleted

The last patch is aligned with the current trunk.

in reply to: ↑ 16   Changed 6 weeks ago by soujak

  • cc soujak@… added

Replying to ep:

The last patch is aligned with the current trunk.

Just thanks. I'm going to test it in the next weeks.

Changed 6 weeks ago by martin

Changed 3 weeks ago by ep

Updated patch against current trunk.

Changed 3 weeks ago by ep

Updated; further clean-up performed.

Changed 3 weeks ago by ep

Cardholder name is now included in the PKCS #15 label

Note: See TracTickets for help on using tickets.