security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

scd:nks: Implement writecert for the Signature card v2.

Browse source 
* scd/iso7816.c (CMD_UPDATE_BINARY): New.
(iso7816_update_binary): New.
* scd/app-nks.c (do_deinit): Factor some code out to...
(flush_fid_cache): new.
(do_writecert): New.
(app_select_nks): Register new handler.
--

This can be used with gpg-card to write the 3 extra certificates of a
Telesec TCOS Signature Card v2.  The card with the qualified signature
is distributed with the keys for encryption and advanced signatures
but without the certificates.  The certificates can be downloaded from
the website after an mail confirmation.  Unpacked the downloaded
zipfile has these certificates:

  auth_zert.crt
  sig_zert.crt
  enc_zert.crt

Using gpg-card issue these commands:

 writecert NKS-NKS3.4531 <sig_zert.crt
 writecert NKS-NKS3.45B1 <enc_zert.crt
 writecert NKS-NKS3.4571 <auth_zert.crt

Don't mix that up, tight now there is no checking that the
certificates match the public key.  I also need to write another patch
to actually implement signing and encryption with these nistp256
certificates.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2020-07-02 18:35:34 +02:00
parent f55a05a69b
commit c1663c690b
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
3 changed files with 133 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scd/iso7816.c
View file

@ -45,6 +45,7 @@
#define CMD_GET_CHALLENGE 0x84
#define CMD_READ_BINARY 0xB0
#define CMD_READ_RECORD 0xB2
#define CMD_UPDATE_BINARY 0xD6
static gpg_error_t
map_sw (int sw)
@ -1018,3 +1019,23 @@ iso7816_read_record (int slot, int recno, int reccount, int short_ef,
return 0;
}
/* Perform an UPDATE BINARY command on card in SLOT. Write DATA of
* length DATALEN to a transparent file at OFFSET. */
gpg_error_t
iso7816_update_binary (int slot, int extended_mode, size_t offset,
const void *data, size_t datalen)
{
int sw;
/* We can only encode 15 bits in p0,p1 to indicate an offset. Thus
* we check for this limit. */
if (offset > 32767)
return gpg_error (GPG_ERR_INV_VALUE);
sw = apdu_send_simple (slot, extended_mode, 0x00, CMD_UPDATE_BINARY,
((offset>>8) & 0xff), (offset & 0xff),
datalen, (const char*)data);
return map_sw (sw);
}