Yubico Forum

Re: Completely reset PGP 'app'?

2014-11-28T10:41:17+01:00

Check the manual please, genkeys was not support last time I checked.

Please try with a different version of the software. Also you should be aware that you should perform your test with STABLE versions of whatever software you are planning to run unless you are aware of the latest changes.

Statistics: Posted by Tom — Fri Nov 28, 2014 10:41 am

Re: Completely reset PGP 'app'?

2014-11-28T10:06:05+01:00

Tom wrote:

are you using gpg version 2.1 ?

Code:

$ gpg --version
gpg (GnuPG) 2.1.0
libgcrypt 1.6.2
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Yes.

Statistics: Posted by Automatic — Fri Nov 28, 2014 10:06 am

Re: Completely reset PGP 'app'?

2014-11-28T08:41:50+01:00

are you using gpg version 2.1 ?

Statistics: Posted by Tom — Fri Nov 28, 2014 8:41 am

Re: Completely reset PGP 'app'?

2014-11-27T18:46:30+01:00

Tom wrote:

Automatic wrote:

Yes, you can

Automatic wrote:

2. I can change the smart-card pins to whatever I want with no limitations of characters (I'm allowed alpha? numerical? special? Unicode? Which characters are not allowed?)

yes it can be alphanumeric, not sure about unicode you have to check gpg manual

Automatic wrote:

3. I can lock the device by getting the pin (Both admin & normal) incorrect three times, and I can actually unlock it using the above 'reset applet' link, correct? It's not going to lock up on me once I get it wrong three times and be bricked again?

You can reset it only when user/admin pin are both block

Automatic wrote:

4. I can modify all the special values surrounding the smart-card (Name, public key URL, sex, etc...)

yes

Automatic wrote:

I'd rather verify this with you guys first and miss out of a day of use while waiting for you to respond than have it brick on me and have to go through this whole ordeal again. I hope you understand.

Thanks!

Thank you, I messed about quite a bit with the key and can verify I can reset the key. New issue now:-

I seem unable to generate keys on the device, or be able to overwrite them (Without resetting the entire device). Generating keys on the device (`gpg --card-edit` `generate`) gives me this (Note:- This is a clean device, just reset):-

Code:

gpg/card> admin
Admin commands are allowed

gpg/card> generate
Make off-card backup of encryption key? (Y/n) Y

Please note that the factory settings of the PINs are
   PIN = '123456'     Admin PIN = '12345678'
You should change them using the command --change-pin

Please specify how long the key should be valid.
         0 = key does not expire
        = key expires in n days
      w = key expires in n weeks
      m = key expires in n months
      y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri 27 Nov 2015 17:30:44 GMT
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: John@Doe.com
Comment: This is a test key
You selected this USER-ID:
    "John Doe (This is a test key) "

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
Key generation failed: Not supported

This results in:-

Code:

$ gpg --card-status
Signature key ....: 6C86 A733 8A38 0C3D 5161  EBBD 3B0A 6CA8 E53C 66F6
      created ....: 2014-11-27 17:30:58
Encryption key....: [none]
Authentication key: D37E 8252 F027 BC1B 3B8F  BE5C 2894 239C 03D3 1AD0
      created ....: 2014-11-27 17:30:58

As you can see, no encryption key. If I then reset the applet and generate a key on my PC to import using keytocard, I can import the keys fine, but, not if there's a key already there (overwriting keys result in an error, the same error this person is getting).

Is this normal? My assumption was I should be able to overwrite keys and generate keys on the device, not that it matters a huge deal, but, still would be nice to know.

Statistics: Posted by Automatic — Thu Nov 27, 2014 6:46 pm

Re: Completely reset PGP 'app'?

2014-11-27T14:38:43+01:00

Automatic wrote:

Yes, you can

Automatic wrote:

2. I can change the smart-card pins to whatever I want with no limitations of characters (I'm allowed alpha? numerical? special? Unicode? Which characters are not allowed?)

yes it can be alphanumeric, not sure about unicode you have to check gpg manual

Automatic wrote:

You can reset it only when user/admin pin are both block

Automatic wrote:

4. I can modify all the special values surrounding the smart-card (Name, public key URL, sex, etc...)

yes

Automatic wrote:

Statistics: Posted by Tom — Thu Nov 27, 2014 2:38 pm

Re: Completely reset PGP 'app'?

2014-11-24T12:50:30+01:00

Sorry for bumping this, I just received my replacement Yubikey Neo in the mail today (Yay!), I have yet to plug it in yet as I'm a little bit scared of it dying on me again though.

Can I verify with you guys before I plug it in and start configuring it:-

1. I can change the smart-card pins with no limitations of how many times I change it (Within reason, I'm not going to change it thousands of times, maybe three or four times, just to verify it works).
2. I can change the smart-card pins to whatever I want with no limitations of characters (I'm allowed alpha? numerical? special? Unicode? Which characters are not allowed?)
3. I can lock the device by getting the pin (Both admin & normal) incorrect three times, and I can actually unlock it using the above 'reset applet' link, correct? It's not going to lock up on me once I get it wrong three times and be bricked again?
4. I can modify all the special values surrounding the smart-card (Name, public key URL, sex, etc...)

I'd rather verify this with you guys first and miss out of a day of use while waiting for you to respond than have it brick on me and have to go through this whole ordeal again. I hope you understand.

Thanks!

Statistics: Posted by Automatic — Mon Nov 24, 2014 12:50 pm

Re: Completely reset PGP 'app'?

2014-11-19T14:45:25+01:00

Thought I may add this update:- I updated my neo manager to 1.0.0 to test out the OTP+U2F+CCID functionality (Although, apparently my Distro's Chromium package is still on v38, so, I'll have to wait to test this as I don't feel like compiling Chromium myself), while messing around in the neo manager I did spot these errors floating around in the command line:-

Code:

$ neoman
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/neoman/model/jsapi.py", line 66, in send_apdu
    return self._neo.send_apdu(apdu.decode('hex')).encode('hex')
  File "/usr/lib/python2.7/site-packages/neoman/model/neo.py", line 40, in inner
    return func(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/neoman/device_ccid.py", line 104, in send_apdu
    byref(buf_size)))
  File "/usr/lib/python2.7/site-packages/neoman/device_ccid.py", line 62, in check
    raise YkNeoMgrError(status)
neoman.exc.YkNeoMgrError: ykneomgr error: -4
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985
LOG [OpenPGP]: ERROR req: 00f10000, resp: 6985

As I normally run neomanager from dmenu (A little tool that launches applications, sort of like the 'run' dialog on Windows) I've never really seen the std{out,err} of neoman. The neoman interface works fine, even with these errors/exceptions, but, obviously something is going on behind the scenes that even your own software can't deal with, unfortunately, I don't know the APDU command list, so, I don't know what the actual commands it's issuing are, nor what the response is.

Statistics: Posted by Automatic — Wed Nov 19, 2014 2:45 pm

Re: Completely reset PGP 'app'?

2014-11-17T17:49:33+01:00

Tom wrote:

No, we have a subset of serial with a bug in the openpgp applet, thus i need to know the exact serial number. It has nothing to do with transport key.

You can send that to me via PM if you wish i'll forward that to the support guys.

Tom

The reason I didn't PM it to you was because I did include it in my support ticket, I have, however, just sent you a PM with it again. Thanks.

Statistics: Posted by Automatic — Mon Nov 17, 2014 5:49 pm

Re: Completely reset PGP 'app'?

2014-11-17T14:22:21+01:00

Statistics: Posted by Tom — Mon Nov 17, 2014 2:22 pm

Re: Completely reset PGP 'app'?

2014-11-17T11:52:05+01:00

Tom wrote:

what is the serial number on your NEO?

Could you submit a support ticket on yubi.co/support

Make a ticket including my serial number, but, for public reference (In case anyone else is having this issue, and I'm not too sure what the serial actually contains (I.E. if it's private or not)), it's >3,000,000, which I believe is the question you were actually asking.

Statistics: Posted by Automatic — Mon Nov 17, 2014 11:52 am

Re: Completely reset PGP 'app'?

2014-11-17T10:12:02+01:00

what is the serial number on your NEO?

Could you submit a support ticket on yubi.co/support

Statistics: Posted by Tom — Mon Nov 17, 2014 10:12 am

Re: Completely reset PGP 'app'?

2014-11-14T18:15:22+01:00

bmalkow wrote:

Check ResetApplet.

Code:

$ gpg-connect-agent --hex
> scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
ERR 100663408 Card not present 

Since I read somewhere this should only occur if you're in smart-card only mode when you push the button on the Yubikey (Even though I was in u2f+ccid mode), I switched to ccid then started messing with the button:-

Code:

$ gpg-connect-agent --hex
> scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
ERR 100663406 Card removed 
> scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
ERR 100663406 Card removed 
> scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
ERR 100663406 Card removed 
> scd apdu 00 e6 00 00
ERR 100663406 Card removed 
> scd apdu 00 e6 00 00
ERR 100663406 Card removed 

Keeps telling me the card is removed, despite (obviously), there being no card to remove. Tapping the button does nothing.

EDIT:- Messing around a little more got me:-

Code:

ERR 100663427 Conditions of use not satisfied 
> scd apdu 00 e6 00 00
ERR 100663427 Conditions of use not satisfied 
> scd apdu 00 44 00 00
ERR 100663427 Conditions of use not satisfied 

EDIT:- I also am unable to reinstall the OpenGPG applet (I thought I read somewhere doing this would wipe all related data to it):-
>mutual_authentication() returns 0x80302000 (The verification of the card cryptogram failed.)

From the gpshell command.

Statistics: Posted by Automatic — Fri Nov 14, 2014 6:15 pm

Re: Completely reset PGP 'app'?

2014-11-14T18:11:20+01:00

Check ResetApplet.

Statistics: Posted by bmalkow — Fri Nov 14, 2014 6:11 pm

Completely reset PGP 'app'?

2014-11-14T17:58:59+01:00

Long story short:-

Code:

$ gpg --card-status
gpg: OpenPGP card not available: Not supported

Slightly longer story:-
1. Generated key
2. Changed the admin/normal pin
3. Card went insane and started accusing me that my admin pin was incorrect, and that my normal pin was incorrect when attempting to regenerate keys (But only there, all other occurrences of normal pin worked fine) despite the fact that GPG accepted the pin (It accepted, went through the questions, then complained once it got to actually generating, an incorrect-incorrect pin would error out instantly).
4. I, purposefully, got my admin password incorrect to lock the device, assuming this would reset it
5. Locked.

Any assistance?

Bit more information:-
Neo firmware:- 3.3.0
Neo mode:- U2F+CCID
Neo U2F version:- "1.0.1 installed"
Neo OpenPGP version:- "Installed" (All other apps state their version, this one, however, does not)

Statistics: Posted by Automatic — Fri Nov 14, 2014 5:58 pm