CardOS 4.3B card - administration state

[Fabian Bertholm]

Hi,

Stupid question ;)
How to use a Siemens CardOS 4.3 card?
-> 1st get the Siemens Card API SW - ok I got it
-> 2nd format the card using the simens SW - ok
-> 3rd should be in Admin mode now and usable - no it isn't :(

This is what cardos-info says: (OpenSC 0.11.6, initialized card)

3b:f2:18:00:02:c1:0a:31:fe:58:c8:08:74
Info : CardOS V4.3B (C) Siemens AG 1994-2004
Chip type: 123
Serial number: 57 08 27 04 07 20
Full prom dump:
33 66 00 40 EB EB EB EB 7B FF 57 08 27 04 07 20 ***@....{.W.'..
00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
OS Version: 200.8 (that's CardOS M4.3b)
Current life cycle: 32 (administration)
Security Status of current DF:
Free memory : 879
ATR Status: 0x0 ROM-ATR
Packages installed:
E1 09 01 04 13 03 C8 08 8F 01 01 ...........
Ram size: 4, Eeprom size: 32, cpu type: 66, chip config: 63
Free eeprom memory: 25043
System keys: PackageLoadKey (version 0x00, retries 10)
System keys: StartKey (version 0xff, retries 10)
Path to current DF:

When I try to generate a private key:
pkcs15-init --generate-key rsa/1024 --auth-id 01
Unspecified PIN [reference 4] required.
Please enter Unspecified PIN [reference 4]:
[pkcs15-init] card-cardos.c:251:cardos_check_sw: function/mode not supported
[pkcs15-init] sec.c:201:sc_pin_cmd: returning with: Not supported
[pkcs15-init] pkcs15-lib.c:3105:do_get_and_verify_secret: Failed to verify
PIN (ref=0x4)
[pkcs15-init] card-cardos.c:251:cardos_check_sw: required access right not
granted
[pkcs15-init] card-cardos.c:940:cardos_put_data_oci: Card returned error:
Security status not satisfied
[pkcs15-init] card.c:678:sc_card_ctl: returning with: Security status not
satisfied
Failed to generate key: Security status not satisfied

I try the PIN I initialized with the Simens Software but that one does not
work.
Same happens for pkcs15-init -E

***@wintermute:~/sim$ pkcs15-tool -D
PKCS#15 Card [test1]:
Version : 1
Serial number : 167BFF570827040720
Manufacturer ID: Siemens AG (C)
Flags : Login required, PRN generation

PIN [PIN]
Com. Flags: 0x3
ID : 01
Flags : [0x11], case-sensitive, initialized
Length : min_len:4, max_len:16, stored_len:0
Pad char : 0x00
Reference : 129
Type : UTF-8
Path :

PIN [SO-PIN]
Com. Flags: 0x3
ID : 02
Flags : [0x99], case-sensitive, unblock-disabled, initialized,
soPin
Length : min_len:4, max_len:16, stored_len:0
Pad char : 0x00
Reference : 130
Type : UTF-8
Path :

PIN [Secondary Authentication PIN]
Com. Flags: 0x3
ID : 03
Flags : [0x13], case-sensitive, local, initialized
Length : min_len:4, max_len:16, stored_len:0
Pad char : 0x00
Reference : 144
Type : UTF-8
Path :

What to do?

greetings,
Fabe

[JP Szikora]

Post by Fabian Bertholm
Hi,
Stupid question ;)
How to use a Siemens CardOS 4.3 card?
-> 1st get the Siemens Card API SW - ok I got it
-> 2nd format the card using the simens SW - ok
-> 3rd should be in Admin mode now and usable - no it isn't :(

...

Post by Fabian Bertholm
What to do?

Hi Fabian,

The card initialized with Siemens Card API is not compatible with
OpenSC. To use OpenSC with CardOS cards, the card need to be "formatted"
(pkcs15-init -C) with OpenSC tools...

Now, erasing a Siemens Card API formatted card can be done if you know
the PUK. But once the card is erased, Siemens Card API will NEVER
recognized it again (becuse we can not restore the StartKey to the
Factory value, which is secret) and you will be forced to use OpenSC!

Cheers,

Jean-Pierre

[Fabian Bertholm]

Hi Jean-Pierre,

Thanks for the reply . I don't care if the card will be locked to OpenSC,
thats perfect.
I tried to erase the card with pkcs15-init -E but the two PINs I specify
with the Siemens SW are not the requested PIN.
Is there something like a default PUK?

pkcs15-init -E

Unspecified PIN [reference 4] required.
Please enter Unspecified PIN [reference 4]:
[pkcs15-init] card-cardos.c:251:cardos_check_sw: function/mode not supported
[pkcs15-init] sec.c:201:sc_pin_cmd: returning with: Not supported
[pkcs15-init] pkcs15-lib.c:3105:do_get_and_verify_secret: Failed to verify
PIN (ref=0x4)
Failed to erase card: Not supported

Greetings,
Fabe

Post by Fabian Bertholm
Hi,
Stupid question ;)
How to use a Siemens CardOS 4.3 card?
-> 1st get the Siemens Card API SW - ok I got it
-> 2nd format the card using the simens SW - ok
-> 3rd should be in Admin mode now and usable - no it isn't :(
...
What to do?
Hi Fabian,

The card initialized with Siemens Card API is not compatible with OpenSC.
To use OpenSC with CardOS cards, the card need to be "formatted"
(pkcs15-init -C) with OpenSC tools...
Now, erasing a Siemens Card API formatted card can be done if you know
the PUK. But once the card is erased, Siemens Card API will NEVER recognized
it again (becuse we can not restore the StartKey to the Factory value, which
is secret) and you will be forced to use OpenSC!
Cheers,
Jean-Pierre