<div dir="auto">Do keytocard before setting passwords. Reason: there is nothing to encrypt. Seems some passwords are not stored. More secure.<div dir="auto"><br></div><div dir="auto">Regarding bricking: power off then power on then try swd flash.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jan 10, 2018 1:09 AM, <<a href="mailto:gnuk-users-request@lists.alioth.debian.org">gnuk-users-request@lists.alioth.debian.org</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send gnuk-users mailing list submissions to<br>
<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" rel="noreferrer" target="_blank">https://lists.alioth.debian.<wbr>org/mailman/listinfo/gnuk-<wbr>users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:gnuk-users-request@lists.alioth.debian.org">gnuk-users-request@lists.<wbr>alioth.debian.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:gnuk-users-owner@lists.alioth.debian.org">gnuk-users-owner@lists.alioth.<wbr>debian.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of gnuk-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Fwd: Conditions for changing admin PIN not clarified<br>
(GNUK) (NIIBE Yutaka)<br>
2. Re: Making use of FST-01 SPI flash in Gnuk token (NIIBE Yutaka)<br>
3. Alioth Shutdown (NIIBE Yutaka)<br>
4. Re: Alioth Shutdown (Daniel Kahn Gillmor)<br>
5. Re: Making use of FST-01 SPI flash in Gnuk token (Duncan)<br>
6. Bricked FST-01 running tip-of-tree gnuk (Mike Tsao)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Wed, 10 Jan 2018 06:09:36 +0900<br>
From: NIIBE Yutaka <<a href="mailto:gniibe@fsij.org">gniibe@fsij.org</a>><br>
To: Alexander Paetzelt | Nitrokey <<a href="mailto:alex@nitrokey.com">alex@nitrokey.com</a>><br>
Cc: Gnuk and NeuG <<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a>><br>
Subject: Re: [Gnuk-users] Fwd: Conditions for changing admin PIN not<br>
clarified (GNUK)<br>
Message-ID: <<a href="mailto:87a7xmwxgv.fsf@fsij.org">87a7xmwxgv.fsf@fsij.org</a>><br>
Content-Type: text/plain<br>
<br>
Alexander Paetzelt | Nitrokey <<a href="mailto:alex@nitrokey.com">alex@nitrokey.com</a>> wrote:<br>
> sorry for crossposting (see below), but as it has probably something to<br>
> do with Gnuk implementation I want to try here. Maybe someone has an idea.<br>
<br>
It is a bug of Gnuk. I'll fix.<br>
--<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 10 Jan 2018 06:21:04 +0900<br>
From: NIIBE Yutaka <<a href="mailto:gniibe@fsij.org">gniibe@fsij.org</a>><br>
To: Duncan <<a href="mailto:dguthrie@posteo.net">dguthrie@posteo.net</a>><br>
Cc: <a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a><br>
Subject: Re: [Gnuk-users] Making use of FST-01 SPI flash in Gnuk token<br>
Message-ID: <<a href="mailto:877esqwwxr.fsf@fsij.org">877esqwwxr.fsf@fsij.org</a>><br>
Content-Type: text/plain<br>
<br>
Duncan <<a href="mailto:dguthrie@posteo.net">dguthrie@posteo.net</a>> wrote:<br>
> As I understand it, the devices sold via Seeed Studio Bazaar had the<br>
> link to the documentation on this flash.<br>
><br>
> This strikes me as a useful thing. I'd like to accomplish the following:<br>
><br>
> 1. Build the latest Gnuk token firmware<br>
> 2. Install my public key and miscellaneous other data onto the SPI flash.<br>
> 3. Expand the size of the flash (I am thinking this might not be<br>
> possible, from glancing over certain datasheets).<br>
><br>
> In the original firmware, how did the flash appear? I assume it had a<br>
> filesystem on it, probably vFAT? If so, can we make use of a different<br>
> filesystem, just out of interest?<br>
<br>
No, the flash is not used at all by the firmware (Gnuk). We only have a<br>
little access code for that in gnuk/tool/stlinkv2.py. That's all.<br>
<br>
>From hardware point of view (wa have space on PCB), I put the serial<br>
flash to FST-01, hoping it will be useful. But, I was not able to find<br>
any useful way, in fact.<br>
<br>
In FST-01G (I manufactured last year), I drooped the serial flash (as<br>
the part is not available any more).<br>
<br>
Expanding the firmware, it would be somehow possible to give the access<br>
to the serial flash through USB Mass Storage Class to users, but it will<br>
be slow, given the condition of available memory size of STM32F103.<br>
<br>
If we do by USB Mass Storage Class, file system handling is done by host<br>
PC.<br>
--<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 10 Jan 2018 06:27:48 +0900<br>
From: NIIBE Yutaka <<a href="mailto:gniibe@fsij.org">gniibe@fsij.org</a>><br>
To: Gnuk and NeuG <<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a>><br>
Subject: [Gnuk-users] Alioth Shutdown<br>
Message-ID: <<a href="mailto:874lnuwwmj.fsf@fsij.org">874lnuwwmj.fsf@fsij.org</a>><br>
Content-Type: text/plain<br>
<br>
Hello,<br>
<br>
Alioth will shutdown, this year [0].<br>
<br>
I am going to copy Git repos to <a href="http://salsa.debian.org" rel="noreferrer" target="_blank">salsa.debian.org</a> under the group Debian,<br>
hoping we will have package in Debian too.<br>
<br>
Mailing list will be stopped. I don't know if we can move this list to<br>
<a href="http://lists.debian.org" rel="noreferrer" target="_blank">lists.debian.org</a> [1]. When I will attend FOSDEM, I will seek some<br>
place, if it's not.<br>
<br>
I will put information of mailing list on <a href="http://www.fsij.org/gnuk/" rel="noreferrer" target="_blank">www.fsij.org/gnuk/</a> .<br>
<br>
[0] <a href="https://wiki.debian.org/Alioth" rel="noreferrer" target="_blank">https://wiki.debian.org/Alioth</a><br>
[1] <a href="https://lists.debian.org/debian-devel-announce/2017/09/msg00004.html" rel="noreferrer" target="_blank">https://lists.debian.org/<wbr>debian-devel-announce/2017/09/<wbr>msg00004.html</a><br>
--<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Tue, 09 Jan 2018 18:36:19 -0500<br>
From: Daniel Kahn Gillmor <<a href="mailto:dkg@fifthhorseman.net">dkg@fifthhorseman.net</a>><br>
To: NIIBE Yutaka <<a href="mailto:gniibe@fsij.org">gniibe@fsij.org</a>>, Gnuk and NeuG<br>
<<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a>><br>
Subject: Re: [Gnuk-users] Alioth Shutdown<br>
Message-ID: <<a href="mailto:87shbe4nbg.fsf@fifthhorseman.net">87shbe4nbg.fsf@fifthhorseman.<wbr>net</a>><br>
Content-Type: text/plain<br>
<br>
On Wed 2018-01-10 06:27:48 +0900, NIIBE Yutaka wrote:<br>
> Hello,<br>
><br>
> Alioth will shutdown, this year [0].<br>
><br>
> I am going to copy Git repos to <a href="http://salsa.debian.org" rel="noreferrer" target="_blank">salsa.debian.org</a> under the group Debian,<br>
> hoping we will have package in Debian too.<br>
><br>
> Mailing list will be stopped. I don't know if we can move this list to<br>
> <a href="http://lists.debian.org" rel="noreferrer" target="_blank">lists.debian.org</a> [1]. When I will attend FOSDEM, I will seek some<br>
> place, if it's not.<br>
<br>
Werner Koch seemed willing to host related lists on the GnuPG mailing<br>
list infrastructure. Maybe you could ask him whether he'd be willing to<br>
host a <a href="mailto:gnuk-users@gnupg.org">gnuk-users@gnupg.org</a> list ?<br>
<br>
Regards,<br>
<br>
--dkg<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Wed, 10 Jan 2018 02:21:07 +0100<br>
From: Duncan <<a href="mailto:dguthrie@posteo.net">dguthrie@posteo.net</a>><br>
To: Gnuk and NeuG <<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a>><br>
Subject: Re: [Gnuk-users] Making use of FST-01 SPI flash in Gnuk token<br>
Message-ID: <<a href="mailto:1fe834f522e0151807ad003b62fb534d@posteo.net">1fe834f522e0151807ad003b62fb5<wbr>34d@posteo.net</a>><br>
Content-Type: text/plain; charset=US-ASCII; format=flowed<br>
<br>
Hello Mr. Niibe,<br>
<br>
Thank you for your helpful and considered reply.<br>
<br>
However, I think I was not very clear in my intent. While it would be<br>
nice if the firmware were able to make use of the flash, I am wondering<br>
how one can allow the host computer to access the flash, like a mass<br>
storage device.<br>
<br>
For instance, I would like to be able to plug in my FST-01 device into<br>
my laptop computer, and then have a mass storage device appear, on which<br>
I could deposit files of my choosing. I don't really mind about the<br>
speed, considering the space is constrained in the first place.<br>
<br>
However, from your email it appears that this is not implemented<br>
properly yet, and it sounds like it wouldn't be a priority, for<br>
understandable reasons.<br>
<br>
I'm sorry if I wasn't very clear.<br>
<br>
Thank you,<br>
Duncan<br>
<br>
On 09.01.2018 22:21, NIIBE Yutaka wrote:<br>
> Duncan <<a href="mailto:dguthrie@posteo.net">dguthrie@posteo.net</a>> wrote:<br>
>> As I understand it, the devices sold via Seeed Studio Bazaar had the<br>
>> link to the documentation on this flash.<br>
>><br>
>> This strikes me as a useful thing. I'd like to accomplish the<br>
>> following:<br>
>><br>
>> 1. Build the latest Gnuk token firmware<br>
>> 2. Install my public key and miscellaneous other data onto the SPI<br>
>> flash.<br>
>> 3. Expand the size of the flash (I am thinking this might not be<br>
>> possible, from glancing over certain datasheets).<br>
>><br>
>> In the original firmware, how did the flash appear? I assume it had a<br>
>> filesystem on it, probably vFAT? If so, can we make use of a different<br>
>> filesystem, just out of interest?<br>
><br>
> No, the flash is not used at all by the firmware (Gnuk). We only have<br>
> a<br>
> little access code for that in gnuk/tool/stlinkv2.py. That's all.<br>
><br>
> From hardware point of view (wa have space on PCB), I put the serial<br>
> flash to FST-01, hoping it will be useful. But, I was not able to find<br>
> any useful way, in fact.<br>
><br>
> In FST-01G (I manufactured last year), I drooped the serial flash (as<br>
> the part is not available any more).<br>
><br>
> Expanding the firmware, it would be somehow possible to give the access<br>
> to the serial flash through USB Mass Storage Class to users, but it<br>
> will<br>
> be slow, given the condition of available memory size of STM32F103.<br>
><br>
> If we do by USB Mass Storage Class, file system handling is done by<br>
> host<br>
> PC.<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 6<br>
Date: Wed, 10 Jan 2018 07:09:19 +0000<br>
From: Mike Tsao <<a href="mailto:mike@sowbug.com">mike@sowbug.com</a>><br>
To: <a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a><br>
Subject: [Gnuk-users] Bricked FST-01 running tip-of-tree gnuk<br>
Message-ID:<br>
<<a href="mailto:CACi%2BkjqVcSEjoEyEBU3vdZm3bo9Rw60ANBx0RXWTD8ZTEV8Okg@mail.gmail.com">CACi+<wbr>kjqVcSEjoEyEBU3vdZm3bo9Rw60ANB<wbr>x0RXWTD8ZTEV8Okg@mail.gmail.<wbr>com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
My FST-01 is in a state where it can't be unblocked using gpg, nor can it<br>
be reflashed using an SWD connection. Here is my story.<br>
<br>
I ordered two FST-01 devices from SeeedStudio. They arrived today. I<br>
inserted one into my Linux machine and updated the firmware to the latest<br>
version using this guide:<br>
<a href="https://raymii.org/s/tutorials/FST-01_firmware_upgrade_via_usb.html" rel="noreferrer" target="_blank">https://raymii.org/s/<wbr>tutorials/FST-01_firmware_<wbr>upgrade_via_usb.html</a>. The<br>
most recent commit was this:<br>
<br>
commit 4ff0b3c5f896750a14b6a5d1853ac9<wbr>246ecc506e<br>
Author: NIIBE Yutaka <<a href="mailto:gniibe@fsij.org">gniibe@fsij.org</a>><br>
Date: Tue Jan 9 09:39:42 2018 +0900<br>
<br>
tests: Fix for card readers.<br>
<br>
gpg2 --card-status seemed to work fine, and usb_strings.py reported version<br>
1.2.7:<br>
<br>
$ ./tool/usb_strings.py<br>
Vendor: Free Software Initiative of Japan<br>
Product: Gnuk Token<br>
Serial: FSIJ-1.2.7-87061942<br>
Revision: release/1.2.7-3-g4ff0b3c<br>
Config: FST_01:dfu=no:debug=no:pinpad=<wbr>no:certdo=no:factory_reset=no<br>
Sys: 1.0<br>
<br>
I then began configuring the device as a normal OpenPGP smart card. I set<br>
the admin PIN, reset code, and user PIN. I then attempted a "keytocard"<br>
operation with my existing RSA-4096 encryption key, but when I was prompted<br>
for the admin PIN, it failed. I entered it again, being careful that it was<br>
the same one that I had set minutes earlier. It didn't work. I eventually<br>
locked myself out of the device:<br>
<br>
$ gpg2 --card-status<br>
Reader ...........: 234B:0000:FSIJ-1.2.7-87061942:<wbr>0<br>
Application ID ...: D276000124010200FFFE8706194200<wbr>00<br>
Version ..........: 2.0<br>
Manufacturer .....: unmanaged S/N range<br>
Serial number ....: 87061942<br>
Name of cardholder: Mike Tsao<br>
Language prefs ...: [not set]<br>
Sex ..............: unspecified<br>
URL of public key : <a href="https://keybase.io/sowbug/key.asc" rel="noreferrer" target="_blank">https://keybase.io/sowbug/key.<wbr>asc</a><br>
Login data .......: [not set]<br>
Signature PIN ....: forced<br>
Key attributes ...: rsa2048 rsa4096 rsa2048<br>
Max. PIN lengths .: 127 127 127<br>
PIN retry counter : 0 3 0<br>
Signature counter : 0<br>
Signature key ....: [none]<br>
Encryption key....: [none]<br>
Authentication key: [none]<br>
General key info..: [none]<br>
<br>
I concluded that I would have to reflash the device using stlinkv2.py -u,<br>
but it gave an unexpected error:<br>
<br>
$ sudo ./tool/stlinkv2.py -u<br>
ST-Link/V2 version info: 2 29 7<br>
Change ST-Link/V2 mode 0002 -> 0002<br>
Core does not halt, try API V2 halt.<br>
ValueError('Status of core is not halt.', 128)<br>
<br>
I attempted to connect to the device using a Windows machine and the<br>
official STM STLink utility. It didn't work. I then connected to the second<br>
FST-01, which was still new. The Windows STLink utility recognized it.<br>
usb_strings.py also recognizes it:<br>
<br>
$ ./tool/usb_strings.py<br>
Vendor: Free Software Initiative of Japan<br>
Product: FSIJ USB Token<br>
Serial: FSIJ-1.0.1-50FF6E06<br>
Revision: release/1.0.1<br>
Config: FST_01:dfu=no:debug=no:pinpad=<wbr>no:certdo=yes:keygen=yes<br>
Sys: 1.0<br>
<br>
At this point I know the following:<br>
<br>
- My ST-Link v2 programmer works.<br>
- My jumper connections are correct.<br>
- The second FST-01 is able to talk to the ST-Link programmer and utility.<br>
- The first FST-01 is not able to connect to the ST-Link or be reflashed.<br>
- I believe I fell victim to the issue where PINs cannot be set until the<br>
FST-01 has at least one key loaded on it (I read about this after making<br>
the mistake).<br>
- I do not understand why the first FST-01 no longer responds to the<br>
ST-Link SWD connection.<br>
- I built the gnuk software with its defaults, so it doesn't have the<br>
factory reset option.<br>
- My FST-01 is now useless, because it is running gnuk with PIN retry<br>
counter : 0 3 0<br>
<br>
What can I do to unbrick this device?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.alioth.debian.org/pipermail/gnuk-users/attachments/20180110/2c30d091/attachment.html" rel="noreferrer" target="_blank">http://lists.alioth.debian.<wbr>org/pipermail/gnuk-users/<wbr>attachments/20180110/2c30d091/<wbr>attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
gnuk-users mailing list<br>
<a href="mailto:gnuk-users@lists.alioth.debian.org">gnuk-users@lists.alioth.<wbr>debian.org</a><br>
<a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users" rel="noreferrer" target="_blank">https://lists.alioth.debian.<wbr>org/mailman/listinfo/gnuk-<wbr>users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of gnuk-users Digest, Vol 107, Issue 3<br>
******************************<wbr>************<br>
</blockquote></div></div>