scd: Support Nitrokey 3
Open, NormalPublic

Assigned To
Authored By
gniibe
Tue, Jul 7, 7:07 AM

Description

Artemii Bigdan suggested a patch for Nitorokey 3.

I found:
https://github.com/Nitrokey/nitrokey-3-firmware/blob/main/docs/index.md

So, we can support it better.

Revisions and Commits

Event Timeline

werner triaged this task as Normal priority.Wed, Jul 8, 9:57 AM
werner added projects: Feature Request, scd, gnupg.

Following the description of https://github.com/Nitrokey/nitrokey-3-firmware/blob/main/docs/usbip.md
I managed to run it by cargo run --features ccid.
I can see it by lsusb:

... ID 20a0:42b2 Clay Logic Nitrokey 3A Mini/3A NFC/3C NFC

But it fails (disappeared) when I do lsusb -v -d.
When I do usbip attach -r localhost -b 1-1 again, it appears again.

Unfortunately, it does not work out-of-box. I'm using in-stock CCID driver of GnuPG.

$ gpg --card-status
gpg: OpenPGP card not available: Invalid value

Let me debug it.

gniibe renamed this task from scd: Support Nitorokey 3 to scd: Support Nitrokey 3.Thu, Jul 9, 6:41 AM

I need this patch for ccid-driver.c (which is not clean, but device specific):

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 2e955ea52..df7bfefc2 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -2139,6 +2139,9 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
     return CCID_DRIVER_ERR_INV_VALUE;  /* Faulty libusb.  */
   *nread = msglen;
 
+  if (msglen == 0)
+    goto retry;
+
   if (msglen < 10)
     {
       DEBUGOUT_1 ("bulk-in msg too short (%u)\n", (unsigned int)msglen);

Wouldn't it be an idea to use a short delay and a retry count limit?

gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Jul 13, 8:28 AM

I decided to add a retry count (=1). I check the implementation of usbd-ccid-0.4.0, it's ZLP (zero length packet) handling mistake.

IIUC, CCID never uses ZLP for PC_to_RDR_XfrBlock nor RDR_to_PC_DataBlock. So, it's simple mistake.

I think that delay does not make much sense, since it's not timing problem.

gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Jul 20, 6:39 AM

Here is a patch for detecting Nitrokey:

Looking ATR doesn't work for the emulation of Nitrokey by USBIP.
It's because ATR is under control of ccid part in the Nitrokey implementation, while OpenPGP card part is in different library.
(It should be consistent, but not currently.)

So, I think that access to openpgp data object would be better.