In 2014 I wrote CCID USB spy using Wireshark to show how to use Wireshark to dissect CCID frames. CCID is the protocol used to communicate to a USB smart card reader.

Some frames were not dissected correctly or not dissected at all so it was not easy to understand what was hapenning. In the present case the CCID frames Set Parameters and the reader answer were not dissected.

I submitted a Wireshark patch to allow the decoding of these CCID frames. My merge request is available at https://gitlab.com/wireshark/wireshark/-/merge_requests/8994 and has been merged upstream.

Before

Using Wireshark 4.0.6 from Debian 12 bookworm (Debian stable when I write this) I have:

• for the command PC_to_RDR_SetParameters sent to the reader:

The data in abProtocolDataStructure (5 bytes in this case) are displayed as an hex dump (Data: 1100000a00). But you do not get more information.

• for the answer RDR_to_PC_Parameters from the reader:

Here the data in abProtocolDataStructure are not even displayed in hex.

After

You need to use the development release 4.1.0 of Wireshark to have my patch included. I will use the macOS version of Wireshark just because I can. You then have (for the same USB traffic dump):

• for the command PC_to_RDR_SetParameters sent to the reader:

The 5 bytes of abProtocolDataStructure are dissected.

Protocol Data Structure for Protocol T=0
    Fi/Di selecting clock rate: 0x11
    Convention used: 0x00
    Extra Guardtime between two characters: 0x00
    WI for T= 0 used to define WWT: 0x0a
    ICC Clock Stop Support: 0x00

• for the answer RDR_to_PC_Parameters from the reader:

Again the 5 bytes of abProtocolDataStructure are also dissected.

In this case the 5 bytes are identical in the command and the answer since the reader replies with what is acceptable for it.

I just released a new version of pcsc-lite 2.0.0.

pcsc-lite is a Free Software implementation of the PC/SC (or WinSCard) API for Unix systems.

The version changed from 1.9.9 to 2.0.0 but this is a minor version change.

I moved my blog from https://ludovicrousseau.blogspot.com/ to https://blog.apdu.fr/.

I modified gscriptor (included in pcsc-tools) to support internationalization (i18n). The next version of gscriptor (no release date planned yet) will be available (at least) in French and in Russian.

gscriptor

gscriptor is a graphical tool to send APDU commands to a smart card.

It is written in Perl and uses the Gtk+ graphical library.

French

Russian

Conclusion

Thanks to Pro-pra for the initial patch and the Russian localization.

If you want to add another language please copy the file pcsc-tools.pot, add your translations and send me the resulting file.

One of the most popular search request that bring people on my blog is about SCARD_E_SERVICE_STOPPED.

The problem

With pcsc-lite the only cause for the error SCARD_E_SERVICE_STOPPED is that the two sides, pcscd and libpcsclite, are using a different version of the communication protocol.

See for example the reported issue "SCardEstablishContext: Service was stopped.".

In the logs you have something like:

$ journalctl --unit=pcscd
[...]
févr. 11 18:55:07 debian pcscd[3715]: 00000006 winscard_svc.c:361:ContextThread() Received command: CMD_VERSION from client 8
févr. 11 18:55:07 debian pcscd[3715]: 00000004 winscard_svc.c:373:ContextThread() Client is protocol version 4:3
févr. 11 18:55:07 debian pcscd[3715]: 00000001 winscard_svc.c:382:ContextThread() Communication protocol mismatch!
févr. 11 18:55:07 debian pcscd[3715]: 00000002 winscard_svc.c:384:ContextThread() Client protocol is 4:3
févr. 11 18:55:07 debian pcscd[3715]: 00000001 winscard_svc.c:386:ContextThread() Server protocol is 4:4
févr. 11 18:55:07 debian pcscd[3715]: 00000002 winscard_svc.c:396:ContextThread() CMD_VERSION rv=0x8010001E for client 8

The cause

This situation can happen if you reinstalled pcsc-lite yourself but in /usr/local/ instead of /usr/. In that case you have 2 different versions of pcsc-lite installed at the same time on your system.

You may also use an application inside a flatpak container that uses a different version of pcsc-lite. See the limitations listed in "Accessing smart cards from inside a flatpak sandbox".

The solution

Do not mix different versions of pcsc-lite.

Conclusion

This is the second article in the FAQ "section". The first one was "FAQ: wintypes.h or winscard.h not found". I will try to provide other articles about common errors.

With PyKCS11 I provide a sample code signature.py to compute a RSA+SHA256 signature. The Python sample also contains the code to check the signature using PyKCS11.

But what if you want to verify the signature using OpenSSL?

Export the public key

$ export PYKCS11LIB=/usr/local/lib/softhsm/libsofthsm2.so

#!/bin/bash

set -e

# get the 1st key object ID
ID=$(pkcs11-tool --module $PYKCS11LIB --list-objects --type pubkey \
    | grep ID \
    | cut -d: -f 2)
echo "Object id: $ID"

# export the public key
pkcs11-tool --module $PYKCS11LIB --read-object --type pubkey --id $ID -o rsa_pub.key

# convert the public key to PEM
openssl rsa -pubin -inform DER -in rsa_pub.key -outform PEM -out rsa_pub.pem

The RSA key pair has been generated by the generate.py script and is stored in the PKCS#11 token. We need to export it so that OpenSSL can use it to check the signature.

To export the key I use pkcs11-tool from the OpenSC project. We need to know the object ID of the public key. This ID is configured in generate.py script line 22. We dump the public keys and get the object ID.

$ pkcs11-tool --module $PYKCS11LIB --list-objects --type pubkey
Using slot 0 with a present token (0x27ca3aa)
Public Key Object; RSA 1024 bits
  label:      My Public Key
  ID:         22
  Usage:      encrypt, verify, wrap
  Access:     local

The script will work correctly if only one public key is present in the token. I let you handle more complex cases.

output

$ ./export_key.sh 
Using slot 0 with a present token (0x27ca3aa)
Object id:          22
Using slot 0 with a present token (0x27ca3aa)
writing RSA key

Compute signature

#!/usr/bin/env python3

from PyKCS11 import *
import binascii

pkcs11 = PyKCS11Lib()
pkcs11.load()  # define environment variable PYKCS11LIB=YourPKCS11Lib

# get 1st slot
slot = pkcs11.getSlotList(tokenPresent=True)[0]

session = pkcs11.openSession(slot, CKF_SERIAL_SESSION | CKF_RW_SESSION)
session.login("1234")

# message to sign
toSign = "Hello World!\n"
mechanism = Mechanism(CKM_SHA256_RSA_PKCS, None)

# find first private key and compute signature
privKey = session.findObjects([(CKA_CLASS, CKO_PRIVATE_KEY)])[0]
signature = session.sign(privKey, toSign, mechanism)
print("\nsignature: {}".format(binascii.hexlify(bytearray(signature))))

# save the clear text in a file
with open("cleartext.txt", "w") as f:
    f.write(toSign)

# save to a signature in a file
with open("sig_sha256.bin", "bw") as f:
    f.write(bytearray(signature))

# find first public key and verify signature
pubKey = session.findObjects([(CKA_CLASS, CKO_PUBLIC_KEY)])[0]
result = session.verify(pubKey, toSign, signature, mechanism)
print("\nVerified:", result)

# logout
session.logout()
session.closeSession()

Output

$ ./signature.py 

signature: b'322c1591cb9aba1e361264b02464a2bd9d55693bf772b4253da0862616e611dc139005742c511795c27c8f609e4ddbaafceba1c3b3ce278b8e0af564c84de54a639cff67a9a3f97dcc542cd6f0200954ef7fce4a0f87b61636272e21fc1e3ef9f0b683e360cca4231405dd90ae2c4a3638ca7a85e2b62f6ae30975ff3885ab60'

Verified: True

Verify signature

#!/bin/bash

set -e

# verify signature
openssl dgst -sha256 -verify rsa_pub.pem -signature sig_sha256.bin cleartext.txt

Output

$ ./verify.sh 
Verified OK

Conclusion

Thanks to Leon Rman for the initial code and the idea.

I let you write the code to do the symmetrical operations: sign using OpenSSL and verify using PyKCS11.

I just released a new version of PyKCS11, a Python wrapper above the PKCS#11 API.
See "PyKCS11 introduction" or "PyKCS11’s documentation".

I just released a new version 2.0.7 of pyscard. PySCard is a python module adding smart cards support (PC/SC) to Python.

The PySCard project is available at:

• pypi
• github
• sourceforge

Changes:

2.0.7 (March 2023)

• do not include the generated HTML documentation in the archive

2.0.6 (March 2023)

• handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
• add support of MSYS2/mingw environment on Windows
• improve documentation
• minor changes

One of the most popular search requests that bring people on my website https://pcsclite.apdu.fr/ is about wintypes.h not found.

Problem

For example you try to compile something and get the error:

smartcard/scard/helpers.c:28:10: fatal error: winscard.h: No such file or directory
 #include <winscard.h>
          ^~~~~~~~~~~~ 

Solution

The PC/SC header files (winscard.h, wintypes.h and some others) are provided by the development pcsclite package.

• for Debian, Ubuntu or derivatives the package is pcsclite-dev
• for RedHat, Fedora and derivatives the package is pcsc-lite-devel
• for other Unixes, use your favourite search engine 😜

You install the correct package and you try again to build your software.

Conclusion

I hope this blog article will be correctly indexed by search engines to help people find the solution.

I just released version 1.5.2 of libccid the Free Software CCID class smart card reader driver. 

Changes:

1.5.2 - 31 January 2023, Ludovic Rousseau

• Add support of
• KAPELSE KAP-LINK
• LDU LANDI
• Sensyl SSC-HV Reader
• TOKEN2 MFA NFC Reader
• TOKEN2 Molto2
• Thales RF Reader
• Alcor Micro AU9560: Remove high speeds since they are not supported
• Hack for AlcorMicro AU9560 and Acos-ID card
• configure.ac: disable the use of --disable-usbdropdir