Hi All,
I purchased several Yubikey NEOs with the PIV applet (beta). I am not sure how to set it up or initialise it though. I am using Linux and OpenSC, although later I will be supporting other operating systems such as Windows and Mac OS X.
Code:
$ ykneomgr -a
0: a0000000035350
1: a0000005272001
2: a000000308
3: a0000005272101
4: d27600012401
AID a000000308 is the PIV applet, which appears to be ID-ONE by Oberthur Technologies - "Personal Identity Verification (PIV) / ID-ONE PIV BIO".
I haven't found any good documentation available on the Internet yet from Oberthur regarding the setup and initialisation.
Using OpenSC tools, such as piv-tool, pkcs15-tool, and pkcs11-tool, I can see that the certificates etc. have not yet been initialised.
Code:
$ piv-tool -n
Using reader with a card: Yubico Yubikey NEO OTP+CCID 00 00
PIV-II card
Code:
$ pcsc_scan
PC/SC device scanner
V 1.4.21 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.8
Using reader plug'n play mechanism
Scanning present readers...
0: Yubico Yubikey NEO OTP+CCID 00 00
Tue Jan 14 14:48:31 2014
Reader 0: Yubico Yubikey NEO OTP+CCID 00 00
Card state: Card inserted,
ATR: 3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
ATR: 3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
+ TS = 3B --> Direct Convention
+ T0 = FA, Y(1): 1111, K: 10 (historical bytes)
TA(1) = 13 --> Fi=372, Di=4, 93 cycles/ETU
43010 bits/s at 4 MHz, fMax for Fi = 5 MHz => 53763 bits/s
TB(1) = 00 --> VPP is not electrically connected
TC(1) = 00 --> Extra guard time: 0
TD(1) = 81 --> Y(i+1) = 1000, Protocol T = 1
-----
TD(2) = 31 --> Y(i+1) = 0011, Protocol T = 1
-----
TA(3) = FE --> IFSC: 254
TB(3) = 15 --> Block Waiting Integer: 1 - Character Waiting Integer: 5
+ Historical bytes: 59 75 62 69 6B 65 79 4E 45 4F
Category indicator byte: 59 (proprietary format)
+ TCK = A6 (correct checksum)
Possibly identified card (using /home/eh/.cache/smartcard_list.txt):
3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
Yubikey NEO
Code:
$ pkcs15-tool --list-data-objects
Using reader with a card: Yubico Yubikey NEO OTP+CCID 00 00
Reading data object <0>
applicationName: Card Capability Container
Label: Card Capability Container
applicationOID: 2.16.840.1.101.3.7.1.219.0
Path: db00
Data object read failed: File not found
Reading data object <1>
applicationName: Card Holder Unique Identifier
Label: Card Holder Unique Identifier
applicationOID: 2.16.840.1.101.3.7.2.48.0
Path: 3000
Data object read failed: File not found
Reading data object <2>
applicationName: Unsigned Card Holder Unique Identifier
Label: Unsigned Card Holder Unique Identifier
applicationOID: 2.16.840.1.101.3.7.2.48.2
Path: 3010
Data object read failed: File not found
Reading data object <3>
applicationName: X.509 Certificate for PIV Authentication
Label: X.509 Certificate for PIV Authentication
applicationOID: 2.16.840.1.101.3.7.2.1.1
Path: 0101
Data object read failed: File not found
Reading data object <4>
applicationName: Cardholder Fingerprints
Label: Cardholder Fingerprints
applicationOID: 2.16.840.1.101.3.7.2.96.16
Path: 6010
Auth ID: 01
Reading data object <5>
applicationName: Printed Information
Label: Printed Information
applicationOID: 2.16.840.1.101.3.7.2.48.1
Path: 3001
Auth ID: 01
Reading data object <6>
applicationName: Cardholder Facial Image
Label: Cardholder Facial Image
applicationOID: 2.16.840.1.101.3.7.2.96.48
Path: 6030
Auth ID: 01
Reading data object <7>
applicationName: X.509 Certificate for Digital Signature
Label: X.509 Certificate for Digital Signature
applicationOID: 2.16.840.1.101.3.7.2.1.0
Path: 0100
Data object read failed: File not found
Reading data object <8>
applicationName: X.509 Certificate for Key Management
Label: X.509 Certificate for Key Management
applicationOID: 2.16.840.1.101.3.7.2.1.2
Path: 0102
Data object read failed: File not found
Reading data object <9>
applicationName: X.509 Certificate for Card Authentication
Label: X.509 Certificate for Card Authentication
applicationOID: 2.16.840.1.101.3.7.2.5.0
Path: 0500
Data object read failed: File not found
Reading data object <10>
applicationName: Security Object
Label: Security Object
applicationOID: 2.16.840.1.101.3.7.2.144.0
Path: 9000
Data object read failed: File not found
Reading data object <11>
applicationName: Discovery Object
Label: Discovery Object
applicationOID: 2.16.840.1.101.3.7.2.96.80
Path: 6050
Data Object (20 bytes): < 7E 12 4F 0B A0 00 00 03 08 00 00 10 00 01 00 5F 2F 02 40 00 >
Reading data object <12>
applicationName: Cardholder Iris Image
Label: Cardholder Iris Image
applicationOID: 2.16.840.1.101.3.7.2.16.21
Path: 1015
Data object read failed: File not found
Code:
$ pkcs15-tool --list-pins
Using reader with a card: Yubico Yubikey NEO OTP+CCID 00 00
PIN [PIV Card Holder pin]
Object Flags : [0x1], private
ID : 01
Flags : [0x22], local, needs-padding
Length : min_len:4, max_len:8, stored_len:8
Pad char : 0xFF
Reference : 128
Type : ascii-numeric
PIN [PIV PUK]
Object Flags : [0x1], private
ID : 02
Flags : [0xE2], local, needs-padding, unblockingPin, soPin
Length : min_len:4, max_len:8, stored_len:8
Pad char : 0xFF
Reference : 129
Type : ascii-numeric
Code:
$ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --show-info
Cryptoki version 2.20
Manufacturer OpenSC (www.opensc-project.org)
Library Smart card PKCS#11 API (ver 0.0)
Using slot 1 with a present token (0x1)
Code:
$ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --list-slots
Available slots:
Slot 0 (0xffffffffffffffff): Virtual hotplug slot
(empty)
Slot 1 (0x1): Yubico Yubikey NEO OTP+CCID 00 00
token label: PIV_II (PIV Card Holder pin)
token manuf: piv_II
token model: PKCS#15 emulated
token flags: rng, readonly, login required, PIN initialized, token initialized
serial num : 00000000
Code:
$ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --list-mechanisms
Using slot 1 with a present token (0x1)
Supported mechanisms:
SHA-1, digest
SHA256, digest
SHA384, digest
SHA512, digest
MD5, digest
RIPEMD160, digest
GOSTR3411, digest
ECDSA, keySize={256,384}, hw, sign, other flags=0x1800000
ECDSA-SHA1, keySize={256,384}, hw, sign, other flags=0x1800000
ECDSA-KEY-PAIR-GEN, keySize={256,384}, hw, generate_key_pair, other flags=0x1800000
RSA-X-509, keySize={1024,3072}, hw, decrypt, sign, verify
RSA-PKCS, keySize={1024,3072}, hw, decrypt, sign, verify
SHA1-RSA-PKCS, keySize={1024,3072}, sign, verify
SHA256-RSA-PKCS, keySize={1024,3072}, sign, verify
MD5-RSA-PKCS, keySize={1024,3072}, sign, verify
RIPEMD160-RSA-PKCS, keySize={1024,3072}, sign, verify
RSA-PKCS-KEY-PAIR-GEN, keySize={1024,3072}, generate_key_pair
Code:
$ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --list-objects
Using slot 1 with a present token (0x1)
Data object 877800048
label: 'Card Capability Container'
application: 'Card Capability Container'
app_id: 2.16.840.1.101.3.7.1.219.0
flags:
Data object 877806224
label: 'Card Holder Unique Identifier'
application: 'Card Holder Unique Identifier'
app_id: 2.16.840.1.101.3.7.2.48.0
flags:
Data object 877806320
label: 'Unsigned Card Holder Unique Identifier'
application: 'Unsigned Card Holder Unique Identifier'
app_id: 2.16.840.1.101.3.7.2.48.2
flags:
Data object 877806416
label: 'X.509 Certificate for PIV Authentication'
application: 'X.509 Certificate for PIV Authentication'
app_id: 2.16.840.1.101.3.7.2.1.1
flags:
Data object 877806800
label: 'X.509 Certificate for Digital Signature'
application: 'X.509 Certificate for Digital Signature'
app_id: 2.16.840.1.101.3.7.2.1.0
flags:
Data object 877806896
label: 'X.509 Certificate for Key Management'
application: 'X.509 Certificate for Key Management'
app_id: 2.16.840.1.101.3.7.2.1.2
flags:
Data object 877806992
label: 'X.509 Certificate for Card Authentication'
application: 'X.509 Certificate for Card Authentication'
app_id: 2.16.840.1.101.3.7.2.5.0
flags:
Data object 877807088
label: 'Security Object'
application: 'Security Object'
app_id: 2.16.840.1.101.3.7.2.144.0
flags:
Data object 877807184
label: 'Discovery Object'
application: 'Discovery Object'
app_id: 2.16.840.1.101.3.7.2.96.80
flags:
piv-tool cannot read the serial, even as root:
Code:
# piv-tool --serial
Using reader with a card: Yubico Yubikey NEO OTP+CCID 00 00
sc_card_ctl(*, SC_CARDCTL_GET_SERIALNR, *) failed -1201
But pkcs15-tool will print the serial when dumping:
Code:
$ pkcs15-tool --dump
Using reader with a card: Yubico Yubikey NEO OTP+CCID 00 00
PKCS#15 Card [PIV_II]:
Version : 0
Serial number : 00000000
Manufacturer ID: piv_II
Flags :
PIN [PIV Card Holder pin]
Object Flags : [0x1], private
ID : 01
Flags : [0x22], local, needs-padding
Length : min_len:4, max_len:8, stored_len:8
Pad char : 0xFF
Reference : 128
Type : ascii-numeric
PIN [PIV PUK]
Object Flags : [0x1], private
ID : 02
Flags : [0xE2], local, needs-padding, unblockingPin, soPin
Length : min_len:4, max_len:8, stored_len:8
Pad char : 0xFF
Reference : 129
Type : ascii-numeric
Reading data object <0>
applicationName: Card Capability Container
Label: Card Capability Container
applicationOID: 2.16.840.1.101.3.7.1.219.0
Path: db00
Data object read failed: File not found
Reading data object <1>
applicationName: Card Holder Unique Identifier
Label: Card Holder Unique Identifier
applicationOID: 2.16.840.1.101.3.7.2.48.0
Path: 3000
Data object read failed: File not found
Reading data object <2>
applicationName: Unsigned Card Holder Unique Identifier
Label: Unsigned Card Holder Unique Identifier
applicationOID: 2.16.840.1.101.3.7.2.48.2
Path: 3010
Data object read failed: File not found
Reading data object <3>
applicationName: X.509 Certificate for PIV Authentication
Label: X.509 Certificate for PIV Authentication
applicationOID: 2.16.840.1.101.3.7.2.1.1
Path: 0101
Data object read failed: File not found
Reading data object <4>
applicationName: Cardholder Fingerprints
Label: Cardholder Fingerprints
applicationOID: 2.16.840.1.101.3.7.2.96.16
Path: 6010
Auth ID: 01
Reading data object <5>
applicationName: Printed Information
Label: Printed Information
applicationOID: 2.16.840.1.101.3.7.2.48.1
Path: 3001
Auth ID: 01
Reading data object <6>
applicationName: Cardholder Facial Image
Label: Cardholder Facial Image
applicationOID: 2.16.840.1.101.3.7.2.96.48
Path: 6030
Auth ID: 01
Reading data object <7>
applicationName: X.509 Certificate for Digital Signature
Label: X.509 Certificate for Digital Signature
applicationOID: 2.16.840.1.101.3.7.2.1.0
Path: 0100
Data object read failed: File not found
Reading data object <8>
applicationName: X.509 Certificate for Key Management
Label: X.509 Certificate for Key Management
applicationOID: 2.16.840.1.101.3.7.2.1.2
Path: 0102
Data object read failed: File not found
Reading data object <9>
applicationName: X.509 Certificate for Card Authentication
Label: X.509 Certificate for Card Authentication
applicationOID: 2.16.840.1.101.3.7.2.5.0
Path: 0500
Data object read failed: File not found
Reading data object <10>
applicationName: Security Object
Label: Security Object
applicationOID: 2.16.840.1.101.3.7.2.144.0
Path: 9000
Data object read failed: File not found
Reading data object <11>
applicationName: Discovery Object
Label: Discovery Object
applicationOID: 2.16.840.1.101.3.7.2.96.80
Path: 6050
Data Object (20 bytes): < 7E 12 4F 0B A0 00 00 03 08 00 00 10 00 01 00 5F 2F 02 40 00 >
Reading data object <12>
applicationName: Cardholder Iris Image
Label: Cardholder Iris Image
applicationOID: 2.16.840.1.101.3.7.2.16.21
Path: 1015
Data object read failed: File not found
piv-tool has a --admin parameter that uses a PIV_EXT_AUTH_KEY environment variable that points to a file that contains the key in hexadecimal format. However I was not supplied with they key nor documentation.
Searching the forum and the Internet I found a reference to
https://github.com/berkmanmd/yubikey-neo-osx however it has since been removed from GitHub. Mike Berkman if you are reading this would you mind sharing the details again, please?
There is also pki-tool in easy-rsa.
I have not tried ./pki-tool --pkcs11-init, pkcs11-tool --init-token, nor pkcs15-init, yet as I do not want to delete/erase/wreck the applet by not supplying the correct key if it is needed.
Can anyone clarify if the key is needed, or is only the PIN needed?
Some commands have prompted for a PIN, I used 123456 which worked. Same default and the OpenPGP user PIN.
Any help will be appreciated.
Thanks,
air
Login
FAQ
Search
