after enable kdf-setup impossible change user/admin pin
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Andry
	Nov 27 2023, 12:12 PM

Description

Greetings,
after enabling kdf(kdf-setup)
I have strange behavior:

I change the admin pin from the default 12345678 to 654321 - I get "PIN changed."
I change the name - I get "gpg: error setting Name: Bad PIN", PIN retry counter: 3 0 3 - has not decreased
I try to change the admin pin, enter the current one - then I get - "Error changing the PIN: Bad PIN"
I change the user PIN from 123456 to 123123 - PIN changed.
I change the user’s PIN, enter the current one - then I get Error changing the PIN: Bad PIN
PIN retry counter - still 3 0 3

then just reset the card

Details

Version: gpg (GnuPG) 2.4.0

Revisions and Commits

rG GnuPG
	rGefe325ffdf21 scd:openpgp: Add the length check for new PIN.
	rG2376cdff1318 scd:openpgp: Add the length check for new PIN.

Related Objects

Mentioned In: T7189: Release GnuPG 2.5.0
T6849: Release GnuPG 2.2.43
T6960: Release GnuPG 2.4.5
T6578: Release GnuPG 2.4.4
T6811: gpgv: Read-only trustedkeys.kbx should not be compressed
Mentioned Here: rG40b85d8e8cec: scd:openpgp: Allow PIN length of 6 also with a reset code.

Event Timeline

Andry created this task.Nov 27 2023, 12:12 PM

Andry created this object in space S1 Public.

• werner edited projects, added Support; removed Bug Report.Nov 28 2023, 1:25 PM

• gniibe claimed this task.Dec 22 2023, 3:16 AM

• gniibe triaged this task as Normal priority.

• gniibe added a subscriber: • gniibe.

This comment was removed by • gniibe.

Thank you for the bug report. Although it's a corner case, it is a discrepancy in the implementation which results unrecoverable situation of the device.

Please use longer admin PIN at the step 1. The admin PIN should be more than or equals to 8 characters.

Since the OpenPGP card specification requires longer PIN, GnuPG has the check if admin PIN length is >= 8, when a user tries to verify.
The check is done before actually sending the command to card (thus, no error counter change in the card).

However, with KDF setup enabled, it is possible to change to the shorter PIN using current buggy GnuPG (because the data itself is a hash, which is longer).
After changing the PIN, (because GnuPG checks the PIN length), there is no way to authenticate with device using buggy GnuPG.

I think that we should add the check of PIN length for new PIN.

• gniibe added a commit: rG2376cdff1318: scd:openpgp: Add the length check for new PIN..Dec 22 2023, 5:35 AM