From carsten.fuchs at cafu.de  Sun Jul 17 09:29:49 2022
From: carsten.fuchs at cafu.de (Carsten Fuchs)
Date: Sun, 17 Jul 2022 18:29:49 +0200
Subject: [Pcsclite-muscle] Using pyscard to read Hitag 2 cards
Message-ID: <9d464093-6228-95e0-33f4-1a17eee3cf4f@cafu.de>

Dear group,

please forgive me if this is off-topic here. In this case, any kind note to where I should instead be posting would very much be appreciated.

Using Ubuntu 20.04 LTS, Python 3.8.10, pyscard 2.0.2, I try to read Hitag 2 cards:



$ pcsc_scan 
Using reader plug'n play mechanism
Scanning present readers...
0: Elatec TWN4/B1.06/CPF3.05/S1SC1.32/P (Beta 3) 00 00
 
Sun Jul 17 10:35:59 2022
 Reader 0: Elatec TWN4/B1.06/CPF3.05/S1SC1.32/P (Beta 3) 00 00
  Event number: 0
  Card state: Card removed, 
   
Sun Jul 17 10:36:06 2022
 Reader 0: Elatec TWN4/B1.06/CPF3.05/S1SC1.32/P (Beta 3) 00 00
  Event number: 1
  Card state: Card inserted, 
  ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00 28

ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00 28
+ TS = 3B --> Direct Convention
+ T0 = 8F, Y(1): 1000, K: 15 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0 
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1 
-----
+ Historical bytes: 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00
  Category indicator byte: 80 (compact TLV data object)
    Tag: 4, len: F (initial access data)
      Initial access data: 0C A0 00 00 03 06 40 00 00 00 00 00 00
+ TCK = 28 (correct checksum)

Possibly identified card (using /usr/local/share/pcsc/smartcard_list.txt):
3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00 28
3B 8F 80 01 80 4F 0C A0 00 00 03 06 .. 00 00 00 00 00 00 ..
    Card name not given (as per PCSC std part3)
3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00 28
3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 .. .. 00 00 00 00 ..
    RFID - Low Frequency < 135 kHz (as per PCSC std part3)
3B 8F 80 01 80 4F 0C A0 00 00 03 06 40 00 00 00 00 00 00 28
    HID Proximity. Used to access buildings. Reference on the card "HID0008P".
    http://www.hidglobal.com/product-display/cards-and-credentials/hid-proximity
   
Sun Jul 17 10:36:07 2022
 Reader 0: Elatec TWN4/B1.06/CPF3.05/S1SC1.32/P (Beta 3) 00 00
  Event number: 2
  Card state: Card removed, 



I understand how I can use pyscard to send APDU commands and receive replies, e.g. for reading the UID. However, Hitag 2 cards don't seem to use ISO APDU commands and from the data reference sheets that I can find I'm not sure how to proceed. The intention is to read the card's data blocks and to possibly use the encryption features (I know that Hitag 2 encryption is broken).

Can someone please give me a clue on how to proceed?

Best regards,
Carsten



From ludovic.rousseau at gmail.com  Fri Jul 29 07:32:58 2022
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Fri, 29 Jul 2022 16:32:58 +0200
Subject: [Pcsclite-muscle] Change the error code when PC/SC access is
 refused by polkit?
Message-ID: <CAGstE8CH-bVuDVf=81XuXw8DWCWUL9p-+YGtrm44qWKvTvOWHA@mail.gmail.com>

Hello,

I am using PC/SC on CentOS/RedHat and I am often surprised when I get the error:
$ pcsc_scan
SCardEstablishContext: RPC transport error.

The error code is SCARD_F_COMM_ERROR
https://pcsclite.apdu.fr/api/group__ErrorCodes.html#ga93d3cf468d69423eab1d478a7a870408

>From the pcscd logs I see:
00000003 [139737213696960] pcscdaemon.c:133:SVCServiceRunLoop() A new
context thread creation is requested: 10
00019807 [139737012623104] auth.c:139:IsClientAuthorized() Process
41685 (user: 1000) is NOT authorized for action: access_pcsc
00000107 [139737012623104] winscard_svc.c:335:ContextThread() Rejected
unauthorized PC/SC client

So I get SCARD_F_COMM_ERROR because auth.c (in fact polkit) decided I
should not have access to PC/SC.
For example this happens when I connect to the computer using ssh, and
not from the console.

The error is even more confusing if you enable logs in the client:
$ PCSCLITE_DEBUG=0 pcsc_scan
winscard_clnt.c:605:SCardEstablishContextTH() Your pcscd is too old
and does not support CMD_VERSION
SCardEstablishContext: RPC transport error.

The problem is NOT that pcscd is too old :-)


I was thinking: maybe a more explicit error code would be better?
Maybe SCARD_E_SYSTEM_CANCELLED or SCARD_W_SECURITY_VIOLATION

I do not want to invent a new WinSCard return value.
We should use one form the list
https://docs.microsoft.com/en-us/windows/win32/secauthn/authentication-return-values

I don't know if it is easy to implement. When polkit refuses the
connection the pcscd server just closes the socket without sending
*anything* to the client.

Any comment?

Regards,

-- 
 Dr. Ludovic Rousseau


