Conversation
lrascao
force-pushed
the
sc-hsm-pka-registration
branch
from
September 17, 2026 09:11
0bb1231 to
9978169
Compare
Jakuje
reviewed
Sep 17, 2026
Comment on lines
+1491
to
+1494
| /* Only 6A88 ("referenced data not found") means the key is simply not | ||
| * known yet and may be imported below; any other status is an error. | ||
| * With && this rejected nothing whose SW1 was 0x6A or whose SW2 was | ||
| * 0x88, so e.g. 6A82 fell through and the import was attempted anyway. */ |
Member
There was a problem hiding this comment.
I think this comment should be in the commit message only. It does not add any useful context to the code, only to the change itself.
Author
There was a problem hiding this comment.
Agreed, moved to the commit message, and the remaining comment describes what
the check does rather than what it used to do.
…blic key verify_certificate() asks the card whether a CHR is already known and treats "referenced data not found" as "not yet -- import it below". The guard compared the raw status bytes with && where || was meant, so anything whose SW1 was 0x6A or whose SW2 was 0x88 satisfied it: 6A82, for instance, fell through and the import was attempted against a card that had reported something else entirely. sc_check_sw() already maps 6A88 to SC_ERROR_DATA_OBJECT_NOT_FOUND, so test that instead of the status bytes, and propagate the actual error rather than SC_ERROR_UNKNOWN.
The card requires an authenticated session before it will accept a public key for n-of-m authentication: PUK_AUTH 'Add' checks the security status and fails otherwise. register_public_key() never established one, so -g could not succeed regardless of the file passed to it. Call ensure_login() as the other write operations in this tool already do, which also gives -g the same --pin handling and interactive prompt as --unwrap-key and --import-dkek-share. Found while implementing the PKA challenge-response over PC/SC. Not reproducible end to end on the hardware available to me, where registration fails earlier because the device CVC chain is self-signed and cannot be verified.
lrascao
force-pushed
the
sc-hsm-pka-registration
branch
from
September 18, 2026 14:00
9978169 to
e069133
Compare
Author
|
sorry for the force push but wanted to keep clean history |
frankmorgner
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent bugs on the SmartCard-HSM M-of-N public key registration path,
found while implementing the PKA challenge-response over PC/SC.
card-sc-hsm: fixed status word check when probing for a registered public keyverify_certificate()asks the card whether a CHR is already known and treats6A88("referenced data not found") as "not yet — import it below". The guardused
&&where||was meant:so any status whose SW1 was
0x6Aor whose SW2 was0x88satisfied it.6A82, for instance, fell through and the import was attempted against a cardthat had reported something else entirely.
sc-hsm-tool: log in before registering a public keyThe card requires an authenticated session before accepting a public key —
PUK_AUTH 'Add'checks the security status and fails otherwise.register_public_key()never established one, so-gcould not succeedregardless of the file passed to it. This calls
ensure_login()as the otherwrite operations in the tool already do, which also gives
-gthe same--pinhandling and interactive prompt as--unwrap-keyand--import-dkek-share. The man page entry gains the same--pinnote thoseoptions carry.
Testing
opensc-tool -nreportsSmartCard-HSM version 6.6and6.4, but these arePico HSM (
polhenarejos/pico-hsm), a compatible reimplementation ratherthan genuine SmartCard-HSM hardware — flagging that explicitly, since the
driver name doesn't distinguish them.
Neither fix is reproducible end to end on this hardware, and I'd rather say so
than imply otherwise. Registration fails earlier for an unrelated reason: the
device CVC chain on these devices is self-signed, so
verify_certificate()cannot import it (the CHR is unknown, and selecting the issuer of a
self-signed CA selects itself). The
&&branch is therefore never reachedhere, and the missing login is masked by that earlier failure.
Both are visible by inspection against the card's documented behaviour, and
the second is confirmed at the firmware level: pico-hsm's
cmd_puk_authrejects
Addunlesshas_session_pin || has_session_sopin.Checklist