Maniphest T8316

Kleopatra: Usage column smart card shows wrong info for auth key
Testing, NormalPublic
Actions

Assigned To
• ikloecker
Authored By
• ebo
Wed, Jul 1, 9:16 AM
Tags
Subscribers
• ebo
• ikloecker

Description

In the smart card window, the usage column for the auth key shows "sign, authenticate" although the subkey shows only "authenticate" in the certificate details:

ssb  brainpoolP256r1/1B1EDB6E99D48643
     erzeugt: 2026-06-30  verfällt: 2027-06-30  Nutzung: A
     Kartennummer:0006 15493291

I thought at first that maybe the slot capabilities are shown here instead of the key usage, but for an empty card only "authenticate" is shown:

Details

Version
gpd 5.0.2 and vsd 3.3.7

Revisions and Commits

rLIBKLEO Libkleo
rLIBKLEO90fc0154f15f Add helpers to get usage flags of key or subkey
rLIBKLEObb76ca6205f1 Add helpers to get usage flags of key or subkey
rKLEOPATRA Kleopatra
rKLEOPATRA721cdd60c6ba Show usage of key for card slot (if there is a key)
rKLEOPATRA6e234b372907 Show common usage of card slot and key for card keys
rKLEOPATRA859c9446a86a Add getter for key usage flags to KeyPairInfo
rKLEOPATRA2e3df20c80a4 Show usage of key for card slot (if there is a key)
rKLEOPATRA096470b6c398 Show common usage of card slot and key for card keys
rKLEOPATRAeb1689d63849 Add getter for key usage flags to KeyPairInfo

Event Timeline

• ebo triaged this task as Normal priority.Wed, Jul 1, 9:16 AM
• ebo created this task.
• ebo created this object with edit policy "Contributor (Project)".
• ebo edited projects, added scd; removed kleopatra.Wed, Jul 1, 12:03 PM
• ebo added a subscriber: • ikloecker.

@ikloecker asked me to provide the keypairinfo from debugview:

3724	20857.415167	7888	kleopatra.exe	org.kde.pim.kleopatra: KEYPAIRINFO : 1C49D83114A007D1D83CFE46FFC42C5BFB49707C OPENPGP.1 sc 1782824981 brainpoolP256r1
3725	20857.415254	7888	kleopatra.exe	org.kde.pim.kleopatra: KEYPAIRINFO : 3A99A453AFCE1020774C46658B9E7017488C24CD OPENPGP.2 e 1782824981 brainpoolP256r1
3726	20857.415326	7888	kleopatra.exe	org.kde.pim.kleopatra: KEYPAIRINFO : 2A0F7C05F34D2D3CE4BE10515AFA85A85E7B64C3 OPENPGP.3 sa 1782824981 brainpoolP256r1

This shows that the wrong info comes from scdaemon.

• ebo renamed this task from Kleopatra: Usage column smart card shows wrong info for auth key to scdaemon: Usage column smart card shows wrong info for auth key.Wed, Jul 1, 12:04 PM
• ebo added a project: gnupg26.Wed, Jul 1, 12:08 PM
• ebo renamed this task from scdaemon: Usage column smart card shows wrong info for auth key to Kleopatra: Usage column smart card shows wrong info for auth key.Wed, Jul 1, 1:24 PM
• ebo edited projects, added kleopatra; removed gnupg26, scd.

Scdaemon can only know the keyslot capabilties, the actual keys capablities can only be queried from gpg or gpgsm respectively.
Therefore we need to change the query in Kleopatra.

• ikloecker added a comment.Wed, Jul 1, 5:28 PM

The idea to fix this is to use the common capabilities of card slot and key (if a key exists for the slot).

There's a problem for PIV.9E (aka the Card Authentication Key) because scdaemon reports a (authentication) as usage (which makes sense given the name of the key), but gpgsm (or X.509) doesn't support authentication as usage for S/MIME certificates so that one can only write signing certificates to this slot. The common capability is nothing.

• ikloecker claimed this task.Wed, Jul 1, 5:37 PM
• ikloecker moved this task from Backlog to WIP on the gpd5x board.
• ikloecker added a commit: rKLEOPATRAeb1689d63849: Add getter for key usage flags to KeyPairInfo.Wed, Jul 1, 5:40 PM
• ikloecker added a commit: rKLEOPATRA096470b6c398: Show common usage of card slot and key for card keys.
• ikloecker added a commit: rLIBKLEObb76ca6205f1: Add helpers to get usage flags of key or subkey.Wed, Jul 1, 5:43 PM
• ebo added a comment.Thu, Jul 2, 10:26 AM

Werner said to only show the pubkey info. Only if no pubkey is available show the slot info given by scdaemon.

I guess for PIV.9E there should be no usage shown if I read the gpg-card man page correctly: "Note that GnuPG does currently not use the the Card authentication key".

• ikloecker added a commit: rKLEOPATRA2e3df20c80a4: Show usage of key for card slot (if there is a key).Thu, Jul 2, 11:24 AM
• ikloecker changed the task status from Open to Testing.Thu, Jul 2, 11:32 AM

The usage column now shows the usage of the certificate if there is a certificate for the card slot. Otherwise, the "default" usage (as reported by scdaemon) is shown.

• ikloecker mentioned this in Unknown Object (Maniphest Task).Mon, Jul 6, 9:23 AM
• ikloecker added a commit: rLIBKLEO90fc0154f15f: Add helpers to get usage flags of key or subkey.Tue, Jul 7, 10:34 AM
• ikloecker added a commit: rKLEOPATRA859c9446a86a: Add getter for key usage flags to KeyPairInfo.Tue, Jul 7, 10:48 AM
• ikloecker added a commit: rKLEOPATRA6e234b372907: Show common usage of card slot and key for card keys.
• ikloecker added a commit: rKLEOPATRA721cdd60c6ba: Show usage of key for card slot (if there is a key).
• ebo moved this task from WIP to QA on the gpd5x board.Wed, Jul 22, 12:25 PM
• ebo edited projects, added gpd5x (gpd-5.1.0); removed gpd5x.Thu, Jul 23, 11:28 AM

Looks good on Gpg4win-5.1.0-beta666 for OpenPGP:

Here the PIV part without keys, which should show the deafults for the slots. I didn't check them: