<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
C_GenerateKeyPair on hardware ACS CryptoMate (T2),
<pre wrap="">idVendor: 0x072F
idProduct: 0xB106
</pre>
always fails with bit size > 3328 (... 4096), it succeeds <=
3328.<br>
As comparison, C_GenerateKeyPair on predecessor hardware <a
class="moz-txt-link-freetext"
href="https://pcsclite.alioth.debian.org/ccid/shouldwork.html#0x072F0x90DB">https://pcsclite.alioth.debian.org/ccid/shouldwork.html#0x072F0x90DB</a>
takes about 3-4 minutes for 4096 bit key pair to complete (with same
ccid-git, invoked through scriptor) and #0x072F0xB106 seems to be
slower,<br>
thus my assumption, it may be something time-related (or a bug in
card operating system?).<br>
<br>
Occasionally #0x072F0xB106 also shows some other strange behavior
like starting the Linux-User-Logout-countdown (Kubuntu 16.04 xenial)
after plugging out/removing the USB token.<br>
And once, after a failed C_GenerateKeyPair, card contents were
erased.<br>
<br>
My trial to change 'TIME_BEFORE_SUICIDE' from 60 to 300 and manually
installing 1.4.26 libpcsclite and pcscd ended in screwing my system,
then back with 1.8.14, omitting --auto-exit from pcscd start params
didn't change the failure issue.<br>
I hope, the following information is complete and a solution is
close? Thanks in advance, Regards<br>
<br>
Carsten Blüggel<br>
<br>
<h3>Versions</h3>
<ul>
<li>CCID driver version: git, commit
af00591a4a3c437045cc9923f6477e6f2e467bf4 (includes "Add ACS
CryptoMate (T2)" dated 2017-03-22, initiated by my eMail to L.
Rousseau)</li>
<li>pcsc-lite version: 1.8.14-1ubuntu1.16.04.1 , the latest
distribution's version<br>
</li>
<li>smart card reader name: ACS CryptoMate (T2), <a
class="moz-txt-link-freetext"
href="https://pcsclite.alioth.debian.org/ccid/shouldwork.html#0x072F0xB106">https://pcsclite.alioth.debian.org/ccid/shouldwork.html#0x072F0xB106</a></li>
<li>the output of the command "<code>/usr/sbin/pcscd --version</code>"</li>
</ul>
<h3><font size="-1">pcsc-lite version 1.8.14.<br>
Copyright (C) 1999-2002 by David Corcoran <a
class="moz-txt-link-rfc2396E"
href="mailto:corcoran@musclecard.com"><corcoran@musclecard.com></a>.<br>
Copyright (C) 2001-2011 by Ludovic Rousseau <a
class="moz-txt-link-rfc2396E"
href="mailto:ludovic.rousseau@free.fr"><ludovic.rousseau@free.fr></a>.<br>
Copyright (C) 2003-2004 by Damien Sauveron <a
class="moz-txt-link-rfc2396E" href="mailto:sauveron@labri.fr"><sauveron@labri.fr></a>.<br>
Report bugs to <a class="moz-txt-link-rfc2396E"
href="mailto:muscle@lists.musclecard.com"><muscle@lists.musclecard.com></a>.<br>
Enabled features: Linux x86_64-pc-linux-gnu serial usb libudev
usbdropdir=/usr/lib/pcsc/drivers ipcdir=/var/run/pcscd
configdir=/etc/reader.conf.d<br>
</font></h3>
<font size="-1"><br>
</font>
<h3>Platform</h3>
<ul>
<li>Operating system or GNU/Linux distribution name and version:
Kubuntu 16.04 (xenial), Linux tuxim 4.4.0-72-generic #93-Ubuntu
SMP Fri Mar 31 14:07:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
<br>
</li>
<li>Smart card middleware name and version: scriptor from
pcsc-tools (or same failure issue when using OpenSC + my driver
<a class="moz-txt-link-freetext"
href="https://github.com/carblue/acos5_64">https://github.com/carblue/acos5_64</a>)<br>
</li>
<li>Reader manufacturer name and reader model name: same as
before, also called Advanced Card Systems: CryptoMate Nano
Cryptographic USB token (ACOS5T2)</li>
<li>Smart card name: ACS ACOS5-64 V3.00, set to operation mode
Non-FIPS/64K, which allows up to 4096 bit RSA key pair in steps
of 256<br>
</li>
</ul>
<h3>Log</h3>
<p>I'll supply 3 logs, all with same software and Log-setup (pcscd
killed, restarted), except different key sizes and log3 is from
different USB token:<br>
</p>
<p>log1_failed_0x072F0xB106_CryptoMate_T2 shows the failure
reported; requests 3584-bit RSA key pair generation, CRT for
sign+decrypt APDU: 00 46 00 00 02 1C 06<br>
log2_succeeded_0x072F0xB106_CryptoMate_T2 requests 3328-bit RSA
key pair gen., CRT for sign+decrypt APDU: 00 46 00 00 02 1A 06</p>
<p>log3_succeeded_0x072F0x90DB_CryptoMate64, predecessor hardware as
comparison, requests 4096-bit RSA key pair gen., CRT for
sign+decrypt APDU: 00 46 00 00 02 20 06</p>
</body>
</html>