OpenPGP app overwrites Yubikey serial number
Open, Needs TriagePublic

Description

I'm using a Yubikey 5.

If the OpenPGP app is disabled, then gpg-card shows a "Displayed s/n" of the form "yk-1234567". If the OpenPGP app is enabled, then gpg-card shows a "Displayed s/n" of the form "MMMM01234567" (where MMMM is the manufacturer id).

Even worse: If the OpenPGP app is disabled, then scdaemon returns the nice Yubikey-specific display serial number:

$ gpg-connect-agent 'SCD SWITCHAPP piv' 'SCD GETATTR $DISPSERIALNO' /bye
S SERIALNO FF020001008A7796 piv
OK
S $DISPSERIALNO yk-9074582
OK

But, if the OpenPGP app is enabled, then the same command fails:

$ gpg-connect-agent 'SCD SWITCHAPP piv' 'SCD GETATTR $DISPSERIALNO' /bye
S SERIALNO D2760001240102010006090745820000 piv openpgp
OK
ERR 100663384 Invalid name <SCD>

I think the problem is that app_select_openpgp() overwrites card->serialno which was set by app_new_register(). This may make sense for non-Yubikey cards/tokens, but it doesn't seem to be sensible for Yubikey tokens.

ikloecker created this task.Thu, Oct 8, 1:29 PM
gniibe claimed this task.

(I don't know well about Yubikey specific serial number.)

To avoid overwriting, we would need following change:

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index a6c39ed68..9979df322 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -6079,9 +6079,15 @@ app_select_openpgp (app_t app)
       app->appversion |= buffer[7];
       manufacturer = (buffer[8]<<8 | buffer[9]);
 
-      xfree (app->card->serialno);
-      app->card->serialno = buffer;
-      app->card->serialnolen = buflen;
+      if (app->card->cardtype != CARDTYPE_YUBIKEY)
+        {
+          xfree (app->card->serialno);
+          app->card->serialno = buffer;
+          app->card->serialnolen = buflen;
+        }
+      else
+        xfree (buffer);
+
       buffer = NULL;
       app->app_local = xtrycalloc (1, sizeof *app->app_local);
       if (!app->app_local)

No, the above patch makes OpenPGP app stop working.

Because OpenPGP app checks its serial number.

werner added a subscriber: werner.Mon, Oct 19, 9:51 AM

But changing just the displayed S/N should not disturb anything.

I created this patch D509: Yubikey supports two (or more) apps, serial number problem.

I found this breaks current gpg-card, which expects receiving OpenPGP card's serialno (instead of PIV's) for "SCD card_list" command.