Page MenuHome GnuPG

Kleopatra: Smart card view does not show any certificates if one certficate could not be listed
Closed, ResolvedPublic

Description

With a NetKey-v15 test card (Signature Card V2.0) which contains S/MIME certificates with brainpool curves, loading of the certificates in the smart card view after clicking the button "load certificates" does not succeed. No certificates are shown and the button remains greyed out.

Debugview

[9440] org.kde.pim.kleopatra: Card 89490171500022806460 info:
[9440] org.kde.pim.kleopatra: READER : SCM Microsystems Inc. SPRx32 USB Smart Card Reader 0
[9440] org.kde.pim.kleopatra: SERIALNO : 89490171500022806460
[9440] org.kde.pim.kleopatra: APPTYPE : nks
[9440] org.kde.pim.kleopatra: APPVERSION : F
[9440] org.kde.pim.kleopatra: CHV-STATUS : 3 3 -4 0
[9440] org.kde.pim.kleopatra: KEYPAIRINFO : 4FE905D9AF633D134BB74109526CC762EC9BC8DC NKS-NKS3.4531 sa - brainpoolP256r1
[9440] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C000
[9440] org.kde.pim.kleopatra: KEYPAIRINFO : 9807C934B87DCAB103D5E8A4D69C3CFB600F75DA NKS-NKS3.45B1 e - brainpoolP256r1
[9440] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C200
[9440] org.kde.pim.kleopatra: CERTINFO : 111 NKS-NKS3.C20E
[9440] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C208
[9440] org.kde.pim.kleopatra: KEYPAIRINFO : 811564E41DF97BB799FF058E407CC88569BB7EEC NKS-NKS3.4571 a - brainpoolP256r1
[9440] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C500
[9440] org.kde.pim.kleopatra: KEYPAIRINFO : FFEFC219B3698D26B46A376533EB91ADD4609C8C NKS-ESIGN.4531 s - brainpoolP256r1
[9440] org.kde.pim.kleopatra: CERTINFO : 101 NKS-ESIGN.C000
[9440] org.kde.pim.kleopatra: CERTINFO : 100 NKS-ESIGN.C001
[9440] org.kde.pim.kleopatra: CERTINFO : 111 NKS-ESIGN.C00E
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &4FE905D9AF633D134BB74109526CC762EC9BC8DC
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &9807C934B87DCAB103D5E8A4D69C3CFB600F75DA
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &811564E41DF97BB799FF058E407CC88569BB7EEC
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 16383 ; key.isNull() true
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &FFEFC219B3698D26B46A376533EB91ADD4609C8C
[9440] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[9440] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4531"
[9440] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4531" : got ( )
[9440] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.45B1"
[9440] org.kde.pim.libkleo: "C:/Users/g10code.WIN-TEST3/AppData/Roaming/gnupg/private-keys-v1.d/4FE905D9AF633D134BB74109526CC762EC9BC8DC.key"
[9440] org.kde.pim.libkleo: "C:/Users/g10code.WIN-TEST3/AppData/Roaming/gnupg/private-keys-v1.d/9807C934B87DCAB103D5E8A4D69C3CFB600F75DA.key"
[9440] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.45B1" : got ( )
[9440] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4571"
[9440] org.kde.pim.libkleo: "C:/Users/g10code.WIN-TEST3/AppData/Roaming/gnupg/private-keys-v1.d/811564E41DF97BB799FF058E407CC88569BB7EEC.key"
[9440] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4571" : got ( )
[9440] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-ESIGN.4531"
[9440] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-ESIGN.4531" : got ( )
[9440] org.kde.pim.kleopatra: ReaderStatusThread[2nd]: waiting for commands
[9440] org.kde.pim.libkleo: "C:/Users/g10code.WIN-TEST3/AppData/Roaming/gnupg/private-keys-v1.d/FFEFC219B3698D26B46A376533EB91ADD4609C8C.key"

Details

Version
VS-Desktop-3.1.90.287-Beta

Event Timeline

ebo set Version to VS-Desktop-3.1.90.287-Beta.
ebo added a subscriber: ebo.

I guess this was high priority.

ikloecker changed the task status from Open to Testing.Nov 22 2023, 10:35 AM
ikloecker moved this task from Backlog to WiP on the vsd32 board.
ikloecker added a project: Restricted Project.
ikloecker moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.

VS-Desktop-3.1.90.295-Beta: now there is no button any more... So still no learn key possible.

This issue can only be seen when the keys are not already in the keyring.

ebo changed the task status from Testing to Open.Nov 23 2023, 4:58 PM
ebo moved this task from QA to WiP on the vsd32 board.
ikloecker changed the task status from Open to Testing.Nov 23 2023, 6:01 PM

Now the Learn Certificates button is shown if at least one card key is unknown. And the list of certificates is shown if at least one certificate of a card key is known.

For the X509 brainpool test cards I used it does not work in VS-Desktop-3.1.90.300-Beta . After clicking "load certificates" the button remains greyed out:

[8156] org.kde.pim.libkleo: sendCommand "SCD LEARN --force"
[8156] org.kde.pim.libkleo: Reading config group "UpdateNotification"
[8156] org.kde.pim.libkleo: Reading config group "KDE Action Restrictions"
[8156] org.kde.pim.libkleo: Reading config group "Icons"
[8156] org.kde.pim.libkleo: Reading config group "General"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD LEARN --force" : got ( status( "READER" ) = "SCM Microsystems Inc. SPRx32 USB Smart Card Reader 0" 
[8156]  status( "SERIALNO" ) = "89490171500022806460" 
[8156]  status( "APPTYPE" ) = "nks" 
[8156]  status( "APPVERSION" ) = "F" 
[8156]  status( "CHV-STATUS" ) = "3 3 -4 0" 
[8156]  status( "KEYPAIRINFO" ) = "4FE905D9AF633D134BB74109526CC762EC9BC8DC NKS-NKS3.4531 sa - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C000" 
[8156]  status( "KEYPAIRINFO" ) = "9807C934B87DCAB103D5E8A4D69C3CFB600F75DA NKS-NKS3.45B1 e - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C200" 
[8156]  status( "CERTINFO" ) = "111 NKS-NKS3.C20E" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C208" 
[8156]  status( "KEYPAIRINFO" ) = "811564E41DF97BB799FF058E407CC88569BB7EEC NKS-NKS3.4571 a - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C500" 
[8156]  status( "KEYPAIRINFO" ) = "FFEFC219B3698D26B46A376533EB91ADD4609C8C NKS-ESIGN.4531 s - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-ESIGN.C000" 
[8156]  status( "CERTINFO" ) = "100 NKS-ESIGN.C001" 
[8156]  status( "CERTINFO" ) = "111 NKS-ESIGN.C00E" 
[8156]  )
[8156] org.kde.pim.kleopatra: Card 89490171500022806460 info:
[8156] org.kde.pim.kleopatra: READER : SCM Microsystems Inc. SPRx32 USB Smart Card Reader 0
[8156] org.kde.pim.kleopatra: SERIALNO : 89490171500022806460
[8156] org.kde.pim.kleopatra: APPTYPE : nks
[8156] org.kde.pim.kleopatra: APPVERSION : F
[8156] org.kde.pim.kleopatra: CHV-STATUS : 3 3 -4 0
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 4FE905D9AF633D134BB74109526CC762EC9BC8DC NKS-NKS3.4531 sa - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C000
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 9807C934B87DCAB103D5E8A4D69C3CFB600F75DA NKS-NKS3.45B1 e - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C200
[8156] org.kde.pim.kleopatra: CERTINFO : 111 NKS-NKS3.C20E
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C208
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 811564E41DF97BB799FF058E407CC88569BB7EEC NKS-NKS3.4571 a - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C500
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : FFEFC219B3698D26B46A376533EB91ADD4609C8C NKS-ESIGN.4531 s - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-ESIGN.C000
[8156] org.kde.pim.kleopatra: CERTINFO : 100 NKS-ESIGN.C001
[8156] org.kde.pim.kleopatra: CERTINFO : 111 NKS-ESIGN.C00E
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &4FE905D9AF633D134BB74109526CC762EC9BC8DC
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &9807C934B87DCAB103D5E8A4D69C3CFB600F75DA
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &811564E41DF97BB799FF058E407CC88569BB7EEC
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 16383 ; key.isNull() true
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &FFEFC219B3698D26B46A376533EB91ADD4609C8C
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4531"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4531" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.45B1"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.45B1" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4571"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4571" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-ESIGN.4531"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-ESIGN.4531" : got ( )
[8156] org.kde.pim.kleopatra: false -> true
[8156] org.kde.pim.kleopatra: ReaderStatusThread[2nd]: new iteration command= "__update__"  ; nullSlot= true
[8156] org.kde.pim.kleopatra: update_cardinfo()
[8156] org.kde.pim.libkleo: sendCommand "SCD SERIALNO"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD SERIALNO" : got ( status( "SERIALNO" ) = "89490171500022806460" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD SERIALNO"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD SERIALNO" : got ( status( "SERIALNO" ) = "89490171500022806460" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR APPTYPE"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR APPTYPE" : got ( status( "APPTYPE" ) = "nks" 
[8156]  )
[8156] org.kde.pim.kleopatra: get_card_status( "89490171500022806460" , "nks" , 0x9bb6ee8 )
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR $SIGNKEYID"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR $SIGNKEYID" : got ( status( "$SIGNKEYID" ) = "NKS-NKS3.4531" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR $ENCRKEYID"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR $ENCRKEYID" : got ( status( "$ENCRKEYID" ) = "NKS-NKS3.45B1" 
[8156]  )
[8156] org.kde.pim.kleopatra: get_card_status: found Netkey card 89490171500022806460 end
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR NKS-VERSION"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR NKS-VERSION" : got ( status( "NKS-VERSION" ) = "15" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR $DISPSERIALNO"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR $DISPSERIALNO" : got ( status( "$DISPSERIALNO" ) = "8949017150002280646" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD GETATTR CHV-STATUS"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD GETATTR CHV-STATUS" : got ( status( "CHV-STATUS" ) = "3 3 -4 0" 
[8156]  )
[8156] org.kde.pim.libkleo: sendCommand "SCD LEARN --force"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "SCD LEARN --force" : got ( status( "READER" ) = "SCM Microsystems Inc. SPRx32 USB Smart Card Reader 0" 
[8156]  status( "SERIALNO" ) = "89490171500022806460" 
[8156]  status( "APPTYPE" ) = "nks" 
[8156]  status( "APPVERSION" ) = "F" 
[8156]  status( "CHV-STATUS" ) = "3 3 -4 0" 
[8156]  status( "KEYPAIRINFO" ) = "4FE905D9AF633D134BB74109526CC762EC9BC8DC NKS-NKS3.4531 sa - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C000" 
[8156]  status( "KEYPAIRINFO" ) = "9807C934B87DCAB103D5E8A4D69C3CFB600F75DA NKS-NKS3.45B1 e - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C200" 
[8156]  status( "CERTINFO" ) = "111 NKS-NKS3.C20E" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C208" 
[8156]  status( "KEYPAIRINFO" ) = "811564E41DF97BB799FF058E407CC88569BB7EEC NKS-NKS3.4571 a - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-NKS3.C500" 
[8156]  status( "KEYPAIRINFO" ) = "FFEFC219B3698D26B46A376533EB91ADD4609C8C NKS-ESIGN.4531 s - brainpoolP256r1" 
[8156]  status( "CERTINFO" ) = "101 NKS-ESIGN.C000" 
[8156]  status( "CERTINFO" ) = "100 NKS-ESIGN.C001" 
[8156]  status( "CERTINFO" ) = "111 NKS-ESIGN.C00E" 
[8156]  )
[8156] org.kde.pim.kleopatra: Card 89490171500022806460 info:
[8156] org.kde.pim.kleopatra: READER : SCM Microsystems Inc. SPRx32 USB Smart Card Reader 0
[8156] org.kde.pim.kleopatra: SERIALNO : 89490171500022806460
[8156] org.kde.pim.kleopatra: APPTYPE : nks
[8156] org.kde.pim.kleopatra: APPVERSION : F
[8156] org.kde.pim.kleopatra: CHV-STATUS : 3 3 -4 0
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 4FE905D9AF633D134BB74109526CC762EC9BC8DC NKS-NKS3.4531 sa - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C000
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 9807C934B87DCAB103D5E8A4D69C3CFB600F75DA NKS-NKS3.45B1 e - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C200
[8156] org.kde.pim.kleopatra: CERTINFO : 111 NKS-NKS3.C20E
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C208
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : 811564E41DF97BB799FF058E407CC88569BB7EEC NKS-NKS3.4571 a - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-NKS3.C500
[8156] org.kde.pim.kleopatra: KEYPAIRINFO : FFEFC219B3698D26B46A376533EB91ADD4609C8C NKS-ESIGN.4531 s - brainpoolP256r1
[8156] org.kde.pim.kleopatra: CERTINFO : 101 NKS-ESIGN.C000
[8156] org.kde.pim.kleopatra: CERTINFO : 100 NKS-ESIGN.C001
[8156] org.kde.pim.kleopatra: CERTINFO : 111 NKS-ESIGN.C00E
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &4FE905D9AF633D134BB74109526CC762EC9BC8DC
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &9807C934B87DCAB103D5E8A4D69C3CFB600F75DA
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &811564E41DF97BB799FF058E407CC88569BB7EEC
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 16383 ; key.isNull() true
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: pattern= &FFEFC219B3698D26B46A376533EB91ADD4609C8C
[8156] org.kde.pim.kleopatra: parse_keypairinfo_and_lookup_key: e= 0 ; key.isNull() false
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4531"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4531" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.45B1"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.45B1" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-NKS3.4571"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-NKS3.4571" : got ( )
[8156] org.kde.pim.libkleo: sendCommand "READKEY --card --no-data -- NKS-ESIGN.4531"
[8156] org.kde.pim.libkleo: sendStatusLinesCommand "READKEY --card --no-data -- NKS-ESIGN.4531" : got ( )
[8156] org.kde.pim.kleopatra: ReaderStatusThread[2nd]: waiting for commands

Aha, the certificates are listed in the certificate view, though. And when you remove the smart card and re-insert it the keys are then listed without having to press the "load certificates" button.

So this seems to be a display issue only.

When you press the "load certificates" button again, it will then remain greyed out again. (Which might be the expected behavior in this case)

Looks like ReaderStatusThread assumes that the data for the card didn't change. Therefore the card view is not updated (as before the changes for this issue).

The reason for the wrong assumption is that the check whether the card changed doesn't consider the keys stored by NetKeyCard.

ebo changed the task status from Testing to Open.Nov 27 2023, 1:39 PM
ebo assigned this task to ikloecker.
ebo moved this task from QA to WiP on the vsd32 board.
ikloecker changed the task status from Open to Testing.Nov 27 2023, 1:58 PM

Should really work now.

The "Load Certificates" button still remains greyed out if nothing changed, i.e. if no new certificates could be loaded from the card. This could be changed, but pressing "Load Certificates" multiple times won't magically fix loading the broken certificates.

works with VS-Desktop-3.1.90.302-Beta, very nice!

The greyed out button if nothing has changed is fine with me.

I'll make a new ticket for my wish to keep the "loading certificates" info window longer open as subticket to T6785

ebo moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.

The certificates from the same test smart card work in Version 3.2.2.231170 (Gpg4win-4.3.1), too, but there all certificates are shown, that is one more than in the VSD version. Seems gpg2.4 can handle certificates which 2.2 does not accept. But that is nothing to complain about.