Page MenuHome GnuPG
Create Task
Maniphest T6082

Failed to decrypt with YubiKey on m1 mac
Closed, DuplicatePublic
Actions

Description

I use GnuPG installed via Homebrew on m1 macbook with OSX 12.4 (latest update)

~ gpg --version
gpg (GnuPG) 2.3.7
libgcrypt 1.10.1
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /Users/admin/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
AEAD: EAX, OCB
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Yubikey 5C NFC info

~ ykman info   
Device type: YubiKey 5C NFC
Serial number: ********
Firmware version: 5.4.3
Form factor: Keychain (USB-C)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled.

gpg --debug ipc --card-status
You can see error : gpg: DBG: chan_3 <- ERR 100663384 Invalid name <SCD>

~ gpg --debug ipc --card-status
gpg: reading options from '/Users/kusyka/.gnupg/gpg.conf'
gpg: reading options from '[cmdline]'
gpg: enabled debug flags: ipc
gpg: DBG: chan_3 <- OK Pleased to meet you, process 42953
gpg: DBG: connection to the gpg-agent established
gpg: DBG: chan_3 -> RESET
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION ttyname=/dev/ttys002
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION ttytype=xterm-256color
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION lc-ctype=UTF-8
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> GETINFO version
gpg: DBG: chan_3 <- D 2.3.7
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION allow-pinentry-notify
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION agent-awareness=2.1.0
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD GETINFO version
gpg: DBG: chan_3 <- D 2.3.7
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD SERIALNO
gpg: DBG: chan_3 <- S SERIALNO ********************************
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> LEARN --sendinfo
gpg: DBG: chan_3 <- S CHV-STATUS -2 3 -2
gpg: DBG: chan_3 <- S CHV-USAGE 40 00
gpg: DBG: chan_3 <- S APPVERSION 100
gpg: DBG: chan_3 <- S APPTYPE piv
gpg: DBG: chan_3 <- S CARDVERSION 50403
gpg: DBG: chan_3 <- S CARDTYPE yubikey
gpg: DBG: chan_3 <- S SERIALNO ********************************
gpg: DBG: chan_3 <- S READER Yubico YubiKey OTP+FIDO+CCID
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD GETATTR KEY-ATTR
gpg: DBG: chan_3 <- ERR 100663384 Invalid name <SCD>
gpg: secmem usage: 0/32768 bytes in 0 blocks
Reader ...........: Yubico YubiKey OTP FIDO CCID
Application ID ...: ********************************
Application type .: OpenPGP
Version ..........: 1.0
Manufacturer .....: ?
Serial number ....: ********
Name of cardholder: [not set]
Language prefs ...: [not set]
Salutation .......: 
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Max. PIN lengths .: 3 -2 0
PIN retry counter : 0 0 0
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

When I'm trying to decrypt something I see pinentry window asking to insert card.
But it continue work with my phone. Tested both (usb and NFC connection), so YubiKey is not broken.

Same time it works with my old YubiKey 5 nano.

~ ykman info                   
Device type: YubiKey 5 Nano
Serial number: ********
Firmware version: 5.2.4
Form factor: Nano (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID

~ gpg --debug ipc --card-status
gpg: reading options from '/Users/*****/.gnupg/gpg.conf'
gpg: reading options from '[cmdline]'
gpg: enabled debug flags: ipc
gpg: DBG: chan_3 <- OK Pleased to meet you, process 42144
gpg: DBG: connection to the gpg-agent established
gpg: DBG: chan_3 -> RESET
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION ttyname=/dev/ttys002
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION ttytype=xterm-256color
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION lc-ctype=UTF-8
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> GETINFO version
gpg: DBG: chan_3 <- D 2.3.7
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION allow-pinentry-notify
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION agent-awareness=2.1.0
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD GETINFO version
gpg: DBG: chan_3 <- D 2.3.7
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD SERIALNO
gpg: DBG: chan_3 <- S SERIALNO ********************************
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> LEARN --sendinfo
gpg: DBG: chan_3 <- S PROGRESS learncard k 0 0
gpg: DBG: chan_3 <- S PROGRESS learncard k 0 0
gpg: DBG: chan_3 <- S PROGRESS learncard k 0 0
gpg: DBG: chan_3 <- S UIF-3 %00+
gpg: DBG: chan_3 <- S UIF-2 %01+
gpg: DBG: chan_3 <- S UIF-1 %00+
gpg: DBG: chan_3 <- S KDF ?%01%03?%01%08?%04%01?%00%00?%08??$%1Cj?{?%08?%00?:%1A%0B`Ć%08%0B?%1C%13??%0C]?+?%12???f????%2B%11~?%1AU??l?%0D҅??????C?+f??%11k??%19?9!5??㞇?5W%1B˅?[D%19/;?j
gpg: DBG: chan_3 <- S SIG-COUNTER 8
gpg: DBG: chan_3 <- S CHV-STATUS +255+127+127+127+3+0+3
gpg: DBG: chan_3 <- S KEY-TIME 3 **********
gpg: DBG: chan_3 <- S KEY-TIME 2 **********
gpg: DBG: chan_3 <- S KEY-TIME 1 **********
gpg: DBG: chan_3 <- S KEY-FPR 3 ****************************************
gpg: DBG: chan_3 <- S KEY-FPR 2 ****************************************
gpg: DBG: chan_3 <- S KEY-FPR 1 ****************************************
gpg: DBG: chan_3 <- S DISP-SEX 9
gpg: DBG: chan_3 <- S MANUFACTURER 6 Yubico
gpg: DBG: chan_3 <- S EXTCAP gc=1+ki=1+fc=1+pd=1+mcl3=2048+aac=1+sm=0+si=5+dec=0+bt=1+kdf=1
gpg: DBG: chan_3 <- S APPVERSION 304
gpg: DBG: chan_3 <- S APPTYPE openpgp
gpg: DBG: chan_3 <- S CARDVERSION 50204
gpg: DBG: chan_3 <- S CARDTYPE yubikey
gpg: DBG: chan_3 <- S SERIALNO ********************************
gpg: DBG: chan_3 <- S READER Yubico YubiKey OTP+FIDO+CCID
gpg: DBG: chan_3 <- S KEYPAIRINFO **************************************** OPENPGP.3
gpg: DBG: chan_3 <- S KEYPAIRINFO **************************************** OPENPGP.2
gpg: DBG: chan_3 <- S KEYPAIRINFO **************************************** OPENPGP.1
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> SCD GETATTR KEY-ATTR
gpg: DBG: chan_3 <- S KEY-ATTR 1 22 Ed25519
gpg: DBG: chan_3 <- S KEY-ATTR 2 18 Curve25519
gpg: DBG: chan_3 <- S KEY-ATTR 3 22 Ed25519
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> KEYINFO ****************************************
gpg: DBG: chan_3 <- S KEYINFO **************************************** T ******************************** OPENPGP.1 - - - - A
gpg: DBG: chan_3 <- OK
Reader ...........: Yubico YubiKey OTP FIDO CCID
Application ID ...: ********************************
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: Yubico
Serial number ....: ********
Name of cardholder: [not set]
Language prefs ...: [not set]
Salutation .......: 
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: ed25519 cv25519 ed25519
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 8
KDF setting ......: on
UIF setting ......: Sign=off Decrypt=on Auth=off
Signature key ....: **** **** **** **** ****  **** **** **** **** ****
      created ....: 2021-**-** **:**:**
Encryption key....: **** **** **** **** ****  **** **** **** **** ****
      created ....: 2021-**-** **:**:**
Authentication key: **** **** **** **** ****  **** **** **** **** ****
      created ....: 2021-**-** **:**:**
General key info..: pub  ed25519/**************** 2021-**-** **** <****@****>
sec>  ed25519/********gpg: DBG: chan_3 -> KEYINFO ****************************************
gpg: DBG: chan_3 <- S KEYINFO **************************************** T ******************************** OPENPGP.3 - - - - A
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> KEYINFO ****************************************
gpg: DBG: chan_3 <- S KEYINFO **************************************** T ******************************** OPENPGP.2 - - - - A
gpg: DBG: chan_3 <- OK
gpg: secmem usage: 0/32768 bytes in 0 blocks
57DDBE78  created: 2021-**-**  expires: 2026-**-**
                                card-no: 0006 ********
ssb>  ed25519/****************  created: 2021-**-**  expires: 2026-**-**
                                card-no: 0006 ********
ssb>  cv25519/****************  created: 2021-**-**  expires: 2026-**-**
                                card-no: 0006 ********

Details

Version
2.3.7

Related Objects

Event Timeline

kusyka911 created this task.Jul 14 2022, 3:00 PM
This comment was removed by kusyka911.
kusyka911 updated the task description. (Show Details)Jul 14 2022, 3:04 PM
kusyka911 renamed this task from failed to decrypt with yubikey on m1 mac to Failed to decrypt with YubiKey on m1 mac.Jul 14 2022, 3:06 PM
kusyka911 updated the task description. (Show Details)
• gniibe added a subscriber: • gniibe.Jul 15 2022, 2:48 AM

Thank you for your report.

I confirmed that the firmware 5.4 has the issue, while 5.2 doesn't.

Please see: T6070: Yubikey 5C 'not available: card error' regression

• gniibe closed this task as a duplicate of T6070: Yubikey 5C 'not available: card error' regression.Jul 15 2022, 2:50 AM
• gniibe added a subscriber: mistydemeo.Jul 15 2022, 2:58 AM

Thanks to @mistydemeo
The patch was quickly applied to homebrew.
https://github.com/Homebrew/homebrew-core/commits/9f1ab1ce5c5d2edbe954644a52dc9ef60df5bfa2/Formula/gnupg.rb

kusyka911 added a comment.Aug 3 2022, 2:14 PM

@gniibe thanks for help.