Card misidentification about opensc HOT 13 OPEN

From the source code, the second should be identified as 840, but it looks like the mask overlaps since #2958.

Is it correct that it should be 840?

The workaround might be to change the order of the masks.

from opensc.

Yes, one should be 840. The other is OK to be 940. I am not familiar with the masks usage.

from opensc.

If I understand properly the mentioned PR turned off the bits that identify the card. What was the reason @Nihlus ?

from opensc.

If I understand properly the mentioned PR turned off the bits that identify the card. What was the reason @Nihlus ?

No, it set the mask to 0x00, which means any bits match there. It looks like something we overlooked and I think just changing order of the entries should solve the issue. But we will need to test it with various cards ...

from opensc.

I have 940 and 840. Will try changing order.

from opensc.

But this also means that 940 and 940C overlap.

from opensc.

Changing order fixes identification, but it uncovered that 840 does not have EC support. Specs say:

Encryption algorithms:
RSA: up to RSA 2048 bits, RSA OAEP & RSA PSS, elliptic curves: P-256, P-384, P-521 bits, ECDSA, ECDH, (RSA & Elliptic) 3DES (ECB, CBC), AES (128, 192, 256 bits),
Hash functions:
Hash: SHA-1, SHA-256, SHA-384, SHA-512
Memory size:
80 kB, up to 15 containers for storage of encryption keys (RSA, elliptic curves)
Data storage in memory:
25+ years
Memory overwriting:
at least 500.000 cycles
Operating conditions:
T=0, T=1, PPS, with baud up to 230 Kbps

from opensc.

This is set just for 930 and 940, but it is also usable for MD 840:

from opensc.

I am not sure about the ext_flags.

from opensc.

Yeah, I just updated the mask so that the 940 card I had passed (enabling the bits that differed). I don't have any other IDPrime cards to test with, so I went with the naive approach. Changing as previously suggested seems like a fair option.

from opensc.

@msetina do you want to submit a PR with your changes getting the 940 card detected correctly?

from opensc.

I was wondering why this card driver does not support key generation.

from opensc.

Because nobody implemented it. There is no specification for this applet.

If you would like to capture the APDU trace of official driver while generating keys and implement it into opensc, we would be happy to take your patches. But so far we had quite enough work to get the card detection and readonly operations right (as you can see).

from opensc.