Struct openpgp_card::CardApp

pub struct CardApp { /* fields omitted */ }

Low-level access to OpenPGP card functionality.

Not many checks are performed here (e.g. for valid data lengths). Such checks should be performed on a higher layer, if needed.

Also, no caching of data is done here. If necessary, caching should be done on a higher layer.

Implementations

impl CardApp

pub fn initialize(card_client: CardClientBox) -> Result<Self>

Get a CardApp based on a CardClient.

It is expected that SELECT has already been performed on the card beforehand.

This fn initializes the CardCaps by requesting application_related_data from the card, and setting the capabilities accordingly.

pub fn application_related_data(&mut self) -> Result<ApplicationRelatedData>

Get the “application related data” from the card.

(This data should probably be cached in a higher layer. Some parts of it are needed regularly, and it does not usually change during normal use of a card.)

pub fn url(&mut self) -> Result<String>

Get URL (5f50)

pub fn cardholder_related_data(&mut self) -> Result<CardholderRelatedData>

Get cardholder related data (65)

pub fn security_support_template(&mut self) -> Result<SecuritySupportTemplate>

Get security support template (7a)

pub fn cardholder_certificate(&mut self) -> Result<Response, Error>

Get cardholder certificate (each for AUT, DEC and SIG).

Call select_data() before calling this fn, to select a particular certificate (if the card supports multiple certificates).

pub fn algorithm_information(&mut self) -> Result<Option<AlgoInfo>>

Get “Algorithm Information”

pub fn firmware_version(&mut self) -> Result<Vec<u8>>

Firmware Version (YubiKey specific (?))

pub fn set_identity(&mut self, id: u8) -> Result<Vec<u8>>

Set identity (Nitrokey Start specific (?)). [see: https://docs.nitrokey.com/start/linux/multiple-identities.html https://github.com/Nitrokey/nitrokey-start-firmware/pull/33/]

pub fn select_data(&mut self, num: u8, tag: &[u8]) -> Result<Response, Error>

SELECT DATA (“select a DO in the current template”, e.g. for cardholder certificate)

pub fn private_use_do(&mut self, num: u8) -> Result<Vec<u8>>

Get data from “private use” DO.

num must be between 1 and 4.

pub fn set_private_use_do(&mut self, num: u8, data: Vec<u8>) -> Result<Vec<u8>>

Set data of “private use” DO.

num must be between 1 and 4.

Access condition:

• 1/3 need PW1 (82)
• 2/4 need PW3

pub fn factory_reset(&mut self) -> Result<()>

Reset all state on this OpenPGP card.

Note: the “factory reset” operation is not directly offered by the card spec. It is implemented as a series of OpenPGP card commands:

• send 4 bad requests to verify pw1,
• send 4 bad requests to verify pw3,
• terminate_df,
• activate_file.

With most cards, this sequence of operations causes the card to revert to a “blank” state.

(However, e.g. vanilla Gnuk doesn’t support this functionality. Gnuk needs to be built with the --enable-factory-reset option to the configure script to enable this functionality).

pub fn feature_pinpad_verify(&self) -> bool

Does the cardreader support direct pinpad verify?

pub fn feature_pinpad_modify(&self) -> bool

Does the cardreader support direct pinpad modify?

pub fn verify_pw1_for_signing(&mut self, pin: &str) -> Result<Response, Error>

Verify pw1 (user) for signing operation (mode 81).

Depending on the PW1 status byte (see Extended Capabilities) this access condition is only valid for one PSO:CDS command or remains valid for several attempts.

pub fn verify_pw1_for_signing_pinpad(&mut self) -> Result<Response, Error>

Verify pw1 (user) for signing operation (mode 81) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.

Depending on the PW1 status byte (see Extended Capabilities) this access condition is only valid for one PSO:CDS command or remains valid for several attempts.

pub fn check_pw1_for_signing(&mut self) -> Result<Response, Error>

Check the current access of PW1 for signing (mode 81).

If verification is not required, an empty Ok Response is returned.

(Note: some cards don’t correctly implement this feature, e.g. YubiKey 5)

pub fn verify_pw1(&mut self, pin: &str) -> Result<Response, Error>

Verify PW1 (user). (For operations except signing, mode 82).

pub fn verify_pw1_pinpad(&mut self) -> Result<Response, Error>

Verify PW1 (user) for operations except signing (mode 82), using a pinpad on the card reader. If no usable pinpad is found, an error is returned.

pub fn check_pw1(&mut self) -> Result<Response, Error>

Check the current access of PW1. (For operations except signing, mode 82).

If verification is not required, an empty Ok Response is returned.

(Note: some cards don’t correctly implement this feature, e.g. YubiKey 5)

pub fn verify_pw3(&mut self, pin: &str) -> Result<Response, Error>

Verify PW3 (admin).

pub fn verify_pw3_pinpad(&mut self) -> Result<Response, Error>

Verify PW3 (admin) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.

pub fn check_pw3(&mut self) -> Result<Response, Error>

Check the current access of PW3 (admin).

If verification is not required, an empty Ok Response is returned.

(Note: some cards don’t correctly implement this feature, e.g. YubiKey 5)

pub fn change_pw1(&mut self, old: &str, new: &str) -> Result<Response, Error>

Change the value of PW1 (user password).

The current value of PW1 must be presented in old for authorization.

pub fn change_pw1_pinpad(&mut self) -> Result<Response, Error>

Change the value of PW1 (user password) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.

pub fn change_pw3(&mut self, old: &str, new: &str) -> Result<Response, Error>

Change the value of PW3 (admin password).

The current value of PW3 must be presented in old for authorization.

pub fn change_pw3_pinpad(&mut self) -> Result<Response, Error>

Change the value of PW3 (admin password) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.

pub fn reset_retry_counter_pw1(
    &mut self,
    new_pw1: Vec<u8>,
    resetting_code: Option<Vec<u8>>
) -> Result<Response, Error>

Reset the error counter for PW1 (user password) and set a new value for PW1.

For authorization, either:

• PW3 must have been verified previously,
• secure messaging must be currently used,
• the resetting_code must be presented.

pub fn decipher(&mut self, dm: Cryptogram<'_>) -> Result<Vec<u8>, Error>

Decrypt the ciphertext in dm, on the card.

(This is a wrapper around the low-level pso_decipher operation, it builds the required data field from dm)

pub fn signature_for_hash(&mut self, hash: Hash<'_>) -> Result<Vec<u8>, Error>

Sign hash, on the card.

This is a wrapper around the low-level pso_compute_digital_signature operation. It builds the required data field from hash.

For RSA, this means a “DigestInfo” data structure is generated. (see 7.2.10.2 DigestInfo for RSA).

With ECC the hash data is processed as is, using pso_compute_digital_signature.

pub fn pso_compute_digital_signature(
    &mut self,
    data: Vec<u8>
) -> Result<Vec<u8>, Error>

Run signing operation on the smartcard (low level operation) (7.2.10 PSO: COMPUTE DIGITAL SIGNATURE)

pub fn authenticate_for_hash(
    &mut self,
    hash: Hash<'_>
) -> Result<Vec<u8>, Error>

Auth-sign hash, on the card.

This is a wrapper around the low-level internal_authenticate operation. It builds the required data field from hash.

For RSA, this means a “DigestInfo” data structure is generated. (see 7.2.10.2 DigestInfo for RSA).

With ECC the hash data is processed as is.

pub fn internal_authenticate(&mut self, data: Vec<u8>) -> Result<Vec<u8>, Error>

Run signing operation on the smartcard (low level operation) (7.2.13 INTERNAL AUTHENTICATE)

pub fn set_name(&mut self, name: &str) -> Result<Response, Error>

pub fn set_lang(&mut self, lang: &str) -> Result<Response, Error>

pub fn set_sex(&mut self, sex: Sex) -> Result<Response, Error>

pub fn set_url(&mut self, url: &str) -> Result<Response, Error>

pub fn set_creation_time(
    &mut self,
    time: KeyGenerationTime,
    key_type: KeyType
) -> Result<Response, Error>

pub fn set_fingerprint(
    &mut self,
    fp: Fingerprint,
    key_type: KeyType
) -> Result<Response, Error>

pub fn set_pw_status_bytes(
    &mut self,
    pw_status: &PWStatusBytes,
    long: bool
) -> Result<Response, Error>

Set PW Status Bytes.

If long is false, send 1 byte to the card, otherwise 4. According to the spec, length information should not be changed.

So, effectively, with ‘long == false’ the setting pw1_cds_multi can be changed. With ‘long == true’, the settings pw1_pin_block and pw3_pin_block can also be changed.

(See OpenPGP card spec, pg. 28)

pub fn set_cardholder_certificate(
    &mut self,
    data: Vec<u8>
) -> Result<Response, Error>

Set cardholder certificate (for AUT, DEC or SIG).

Call select_data() before calling this fn, to select a particular certificate (if the card supports multiple certificates).

pub fn set_algorithm_attributes(
    &mut self,
    key_type: KeyType,
    algo: &Algo
) -> Result<Response, Error>

Set algorithm attributes (4.4.3.9 Algorithm Attributes)

pub fn set_resetting_code(
    &mut self,
    resetting_code: Vec<u8>
) -> Result<Response, Error>

Set resetting code (4.3.4 Resetting Code)

pub fn key_import(
    &mut self,
    key: Box<dyn CardUploadableKey>,
    key_type: KeyType
) -> Result<(), Error>

Import an existing private key to the card. (This implicitly sets the algorithm info, fingerprint and timestamp)

pub fn generate_key(
    &mut self,
    fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
    key_type: KeyType,
    algo: Option<&Algo>
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>

Generate a key on the card. (7.2.14 GENERATE ASYMMETRIC KEY PAIR)

If the algo parameter is Some, then this algorithm will be set on the card for “key_type”.

Note: algo needs to precisely specify the RSA bitsize of e (if applicable), and import format, with values that the current card supports.

pub fn generate_key_simple(
    &mut self,
    fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
    key_type: KeyType,
    simple: AlgoSimple
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>

Generate a key on the card. (7.2.14 GENERATE ASYMMETRIC KEY PAIR)

This is a wrapper around generate_key() which allows using the simplified AlgoSimple algorithm selector enum.

Note: AlgoSimple doesn’t specify card specific details (such as bitsize of e for RSA, and import format). This function determines these values based on information from the card.

pub fn public_key(
    &mut self,
    key_type: KeyType
) -> Result<PublicKeyMaterial, Error>

Get public key material from the card.

Note: this fn returns a set of raw public key data (not an OpenPGP data structure).

Note also that the information from the card is insufficient to reconstruct a pre-existing OpenPGP public key that corresponds to the private key on the card.