Probable Reasons For CKR_GENERAL_ERROR From C_Login about opensc HOT 4 OPEN

I think we would need the OpenSC debug log to see what is going on there with the token. The pkcs11 spy trace looks completely reasonable to the extent I can see just from the function names.

If it is just one user, it might be anything from lose wire or worn out memory in the token, but again, without opensc debug its hard to guess if it could be inside of opensc or the token itself. The epass tokens encrypt the pin so there is a possiblity that we do it somehow wrong, which causes random failures. But I did not see this issue with the tokens we have in CI over last couple of months:

https://gitlab.com/redhat-crypto/OpenSC/-/pipelines?page=1&scope=all&ref=epass2003

There were also many changes to the driver over the last years so OpenSC version information would be useful too.

from opensc.

The epass tokens encrypt the pin so there is a possiblity that we do it somehow wrong, which causes random failures.

As far as epass2003 is concerned, I don't think we have a problem here, the PIN entered by the user is hashed and then authenticated using external auth. External auth in this case uses hashed PIN as a key to encrypt the challenge from the card.

Without a more precise log, it is not possible to analyze why C_Login fails.

from opensc.

Alright, thanks for the feedback thus far. I'll see if I can have the user get some more detailed logs.

from opensc.

This may be related to #2843 To help identify your ePass2003 type can you run:
opensc-tool --card-driver default -a --send-apdu 00:CA:01:86:00

from opensc.