diff --git a/agent/call-scd.c b/agent/call-scd.c
index c58199539..3ede33c1d 100644
--- a/agent/call-scd.c
+++ b/agent/call-scd.c
@@ -1,1164 +1,1164 @@
 /* call-scd.c - fork of the scdaemon to do SC operations
  * Copyright (C) 2001, 2002, 2005, 2007, 2010,
  *               2011 Free Software Foundation, Inc.
  * Copyright (C) 2013 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
 #include <unistd.h>
 #ifdef HAVE_SIGNAL_H
 # include <signal.h>
 #endif
 #include <sys/stat.h>
 #include <sys/types.h>
 #ifndef HAVE_W32_SYSTEM
 #include <sys/wait.h>
 #endif
 #include <npth.h>
 
 #include "agent.h"
 #include <assuan.h>
 #include "../common/strlist.h"
 
 #ifdef _POSIX_OPEN_MAX
 #define MAX_OPEN_FDS _POSIX_OPEN_MAX
 #else
 #define MAX_OPEN_FDS 20
 #endif
 
 /* Definition of module local data of the CTRL structure.  */
 struct scd_local_s
 {
   /* We keep a list of all allocated context with an anchor at
      SCD_LOCAL_LIST (see below). */
   struct scd_local_s *next_local;
 
   assuan_context_t ctx;   /* NULL or session context for the SCdaemon
                              used with this connection. */
   unsigned int in_use: 1; /* CTX is in use.  */
   unsigned int invalid:1; /* CTX is invalid, should be released.  */
 };
 
 
 /* Callback parameter for learn card */
 struct learn_parm_s
 {
   void (*kpinfo_cb)(void*, const char *);
   void *kpinfo_cb_arg;
   void (*certinfo_cb)(void*, const char *);
   void *certinfo_cb_arg;
   void (*sinfo_cb)(void*, const char *, size_t, const char *);
   void *sinfo_cb_arg;
 };
 
 
 /* Callback parameter used by inq_getpin and inq_writekey_parms.  */
 struct inq_needpin_parm_s
 {
   assuan_context_t ctx;
   int (*getpin_cb)(void *, const char *, const char *, char*, size_t);
   void *getpin_cb_arg;
   const char *getpin_cb_desc;
   assuan_context_t passthru;  /* If not NULL, pass unknown inquiries
                                  up to the caller.  */
 
   /* The next fields are used by inq_writekey_parm.  */
   const unsigned char *keydata;
   size_t keydatalen;
 };
 
 
 
 
 static int
 start_scd (ctrl_t ctrl)
 {
   return daemon_start (DAEMON_SCD, ctrl);
 }
 
 
 static gpg_error_t
 unlock_scd (ctrl_t ctrl, gpg_error_t err)
 {
   return daemon_unlock (DAEMON_SCD, ctrl, err);
 }
 
 
 static assuan_context_t
 daemon_ctx (ctrl_t ctrl)
 {
   return daemon_type_ctx (DAEMON_SCD, ctrl);
 }
 
 
 
 /* This handler is a helper for pincache_put_cb but may also be called
  * directly for that status code with ARGS being the arguments after
  * the status keyword (and with white space removed).  */
 static gpg_error_t
 handle_pincache_put (const char *args)
 {
   gpg_error_t err;
   const char *s, *key, *pin;
   char *keybuf = NULL;
   size_t keylen;
 
   key = s = args;
   while (*s && !spacep (s))
     s++;
   keylen = s - key;
   if (keylen < 3)
     {
       /* At least we need 2 slashes and slot number.  */
       log_error ("%s: ignoring invalid key\n", __func__);
       err = 0;
       goto leave;
     }
 
   keybuf = xtrymalloc (keylen+1);
   if (!keybuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   memcpy (keybuf, key, keylen);
   keybuf[keylen] = 0;
   key = keybuf;
 
   while (spacep (s))
     s++;
   pin = s;
   if (!*pin)
     {
       /* No value - flush the cache.  The cache module knows aboput
        * the structure of the key to flush only parts.  */
       log_debug ("%s: flushing cache '%s'\n", __func__, key);
       agent_put_cache (NULL, key, CACHE_MODE_PIN, NULL, -1);
       err = 0;
       goto leave;
     }
 
   log_debug ("%s: caching '%s'->'%s'\n", __func__, key, pin);
   agent_put_cache (NULL, key, CACHE_MODE_PIN, pin, -1);
   err = 0;
 
  leave:
   xfree (keybuf);
   return err;
 }
 
 
 /* This status callback is to intercept the PINCACHE_PUT status
  * messages.  OPAQUE is not used.  */
 static gpg_error_t
 pincache_put_cb (void *opaque, const char *line)
 {
   const char *s;
 
   (void)opaque;
 
   s = has_leading_keyword (line, "PINCACHE_PUT");
   if (s)
     return handle_pincache_put (s);
   else
     return 0;
 }
 
 
 /* Handle a PINCACHE_GET inquiry.  ARGS are the arguments of the
  * inquiry which should be a single string with the key for the cached
  * value.  CTX is the Assuan handle.  */
 static gpg_error_t
 handle_pincache_get (const char *args, assuan_context_t ctx)
 {
   gpg_error_t err;
   const char *key;
   char *pin = NULL;
 
   log_debug ("%s: enter '%s'\n", __func__, args);
   key = args;
   if (strlen (key) < 5)
     {
       /* We need at least 2 slashes, one slot number and two 1 byte strings.*/
       err = gpg_error (GPG_ERR_INV_REQUEST);
       log_debug ("%s: key too short\n", __func__);
       goto leave;
     }
 
   pin = agent_get_cache (NULL, key, CACHE_MODE_PIN);
   if (!pin || !*pin)
     {
       xfree (pin);
       err = 0;  /* Not found is indicated by sending no data back.  */
       log_debug ("%s: not cached\n", __func__);
       goto leave;
     }
   log_debug ("%s: cache returned '%s'\n", __func__, pin);
   err = assuan_send_data (ctx, pin, strlen (pin));
 
  leave:
   xfree (pin);
   return err;
 }
 
 
 
 static gpg_error_t
 learn_status_cb (void *opaque, const char *line)
 {
   struct learn_parm_s *parm = opaque;
   gpg_error_t err = 0;
   const char *keyword = line;
   int keywordlen;
 
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
     ;
   while (spacep (line))
     line++;
   if (keywordlen == 8 && !memcmp (keyword, "CERTINFO", keywordlen))
     {
       parm->certinfo_cb (parm->certinfo_cb_arg, line);
     }
   else if (keywordlen == 11 && !memcmp (keyword, "KEYPAIRINFO", keywordlen))
     {
       parm->kpinfo_cb (parm->kpinfo_cb_arg, line);
     }
   else if (keywordlen == 12 && !memcmp (keyword, "PINCACHE_PUT", keywordlen))
     err = handle_pincache_put (line);
   else if (keywordlen && *line)
     {
       parm->sinfo_cb (parm->sinfo_cb_arg, keyword, keywordlen, line);
     }
 
   return err;
 }
 
 /* Perform the LEARN command and return a list of all private keys
    stored on the card. */
 int
 agent_card_learn (ctrl_t ctrl,
                   void (*kpinfo_cb)(void*, const char *),
                   void *kpinfo_cb_arg,
                   void (*certinfo_cb)(void*, const char *),
                   void *certinfo_cb_arg,
                   void (*sinfo_cb)(void*, const char *, size_t, const char *),
                   void *sinfo_cb_arg)
 {
   int rc;
   struct learn_parm_s parm;
 
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   memset (&parm, 0, sizeof parm);
   parm.kpinfo_cb = kpinfo_cb;
   parm.kpinfo_cb_arg = kpinfo_cb_arg;
   parm.certinfo_cb = certinfo_cb;
   parm.certinfo_cb_arg = certinfo_cb_arg;
   parm.sinfo_cb = sinfo_cb;
   parm.sinfo_cb_arg = sinfo_cb_arg;
   rc = assuan_transact (daemon_ctx (ctrl), "LEARN --force",
                         NULL, NULL, NULL, NULL,
                         learn_status_cb, &parm);
   if (rc)
     return unlock_scd (ctrl, rc);
 
   return unlock_scd (ctrl, 0);
 }
 
 
 
 static gpg_error_t
 get_serialno_cb (void *opaque, const char *line)
 {
   gpg_error_t err = 0;
   char **serialno = opaque;
   const char *keyword = line;
   const char *s;
   int keywordlen, n;
 
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
     ;
   while (spacep (line))
     line++;
 
   if (keywordlen == 8 && !memcmp (keyword, "SERIALNO", keywordlen))
     {
       if (*serialno)
         return gpg_error (GPG_ERR_CONFLICT); /* Unexpected status line. */
       for (n=0,s=line; hexdigitp (s); s++, n++)
         ;
       if (!n || (n&1)|| !(spacep (s) || !*s) )
         return gpg_error (GPG_ERR_ASS_PARAMETER);
       *serialno = xtrymalloc (n+1);
       if (!*serialno)
         return out_of_core ();
       memcpy (*serialno, line, n);
       (*serialno)[n] = 0;
     }
   else if (keywordlen == 12 && !memcmp (keyword, "PINCACHE_PUT", keywordlen))
     err = handle_pincache_put (line);
 
   return err;
 }
 
 
 /* Return the serial number of the card or an appropriate error.  The
  * serial number is returned as a hexstring.  If the serial number is
  * not required by the caller R_SERIALNO can be NULL; this might be
  * useful to test whether a card is available. */
 int
 agent_card_serialno (ctrl_t ctrl, char **r_serialno, const char *demand)
 {
   int rc;
   char *serialno = NULL;
   char line[ASSUAN_LINELENGTH];
 
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   if (!demand)
     strcpy (line, "SERIALNO --all");
   else
     snprintf (line, DIM(line), "SERIALNO --demand=%s", demand);
 
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         NULL, NULL, NULL, NULL,
                         get_serialno_cb, &serialno);
   if (rc)
     {
       xfree (serialno);
       return unlock_scd (ctrl, rc);
     }
   if (r_serialno)
     *r_serialno = serialno;
   else
     xfree (serialno);
   return unlock_scd (ctrl, 0);
 }
 
 
 
 
 /* Handle the NEEDPIN inquiry. */
 static gpg_error_t
 inq_needpin (void *opaque, const char *line)
 {
   struct inq_needpin_parm_s *parm = opaque;
   const char *s;
   char *pin;
   size_t pinlen;
   int rc;
 
   if ((s = has_leading_keyword (line, "NEEDPIN")))
     {
       line = s;
       pinlen = 90;
       pin = gcry_malloc_secure (pinlen);
       if (!pin)
         return out_of_core ();
 
       rc = parm->getpin_cb (parm->getpin_cb_arg, parm->getpin_cb_desc,
                             line, pin, pinlen);
       if (!rc)
         rc = assuan_send_data (parm->ctx, pin, pinlen);
       xfree (pin);
     }
   else if ((s = has_leading_keyword (line, "POPUPPINPADPROMPT")))
     {
       rc = parm->getpin_cb (parm->getpin_cb_arg, parm->getpin_cb_desc,
                             s, NULL, 1);
     }
   else if ((s = has_leading_keyword (line, "DISMISSPINPADPROMPT")))
     {
       rc = parm->getpin_cb (parm->getpin_cb_arg, parm->getpin_cb_desc,
                             "", NULL, 0);
     }
   else if ((s = has_leading_keyword (line, "PINCACHE_GET")))
     {
       rc = handle_pincache_get (s, parm->ctx);
     }
   else if (parm->passthru)
     {
       unsigned char *value;
       size_t valuelen;
       int rest;
       int needrest = !strncmp (line, "KEYDATA", 8);
 
       /* Pass the inquiry up to our caller.  We limit the maximum
          amount to an arbitrary value.  As we know that the KEYDATA
          enquiry is pretty sensitive we disable logging then */
       if ((rest = (needrest
                    && !assuan_get_flag (parm->passthru, ASSUAN_CONFIDENTIAL))))
         assuan_begin_confidential (parm->passthru);
       rc = assuan_inquire (parm->passthru, line, &value, &valuelen, 8096);
       if (rest)
         assuan_end_confidential (parm->passthru);
       if (!rc)
         {
           if ((rest = (needrest
                        && !assuan_get_flag (parm->ctx, ASSUAN_CONFIDENTIAL))))
             assuan_begin_confidential (parm->ctx);
           rc = assuan_send_data (parm->ctx, value, valuelen);
           if (rest)
             assuan_end_confidential (parm->ctx);
           xfree (value);
         }
       else
         log_error ("error forwarding inquiry '%s': %s\n",
                    line, gpg_strerror (rc));
     }
   else
     {
       log_error ("unsupported inquiry '%s'\n", line);
       rc = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
     }
 
   return rc;
 }
 
 
 /* Helper returning a command option to describe the used hash
    algorithm.  See scd/command.c:cmd_pksign.  */
 static const char *
 hash_algo_option (int algo)
 {
   switch (algo)
     {
     case GCRY_MD_MD5   : return "--hash=md5";
     case GCRY_MD_RMD160: return "--hash=rmd160";
     case GCRY_MD_SHA1  : return "--hash=sha1";
     case GCRY_MD_SHA224: return "--hash=sha224";
     case GCRY_MD_SHA256: return "--hash=sha256";
     case GCRY_MD_SHA384: return "--hash=sha384";
     case GCRY_MD_SHA512: return "--hash=sha512";
     default:             return "";
     }
 }
 
 
 /* Create a signature using the current card.  MDALGO is either 0 or
  * gives the digest algorithm.  DESC_TEXT is an additional parameter
  * passed to GETPIN_CB. */
 int
 agent_card_pksign (ctrl_t ctrl,
                    const char *keyid,
                    int (*getpin_cb)(void *, const char *,
                                     const char *, char*, size_t),
                    void *getpin_cb_arg,
                    const char *desc_text,
                    int mdalgo,
                    const unsigned char *indata, size_t indatalen,
                    unsigned char **r_buf, size_t *r_buflen)
 {
   int rc;
   char line[ASSUAN_LINELENGTH];
   membuf_t data;
   struct inq_needpin_parm_s inqparm;
 
   *r_buf = NULL;
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   /* FIXME: In the mdalgo case (INDATA,INDATALEN) might be long and
    * thus we can't convey it on a single Assuan line.  */
   if (!mdalgo)
     gpg_error (GPG_ERR_NOT_IMPLEMENTED);
 
   if (indatalen*2 + 50 > DIM(line))
     return unlock_scd (ctrl, gpg_error (GPG_ERR_GENERAL));
 
   bin2hex (indata, indatalen, stpcpy (line, "SETDATA "));
 
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         NULL, NULL, NULL, NULL, pincache_put_cb, NULL);
   if (rc)
     return unlock_scd (ctrl, rc);
 
   init_membuf (&data, 1024);
   inqparm.ctx = daemon_ctx (ctrl);
   inqparm.getpin_cb = getpin_cb;
   inqparm.getpin_cb_arg = getpin_cb_arg;
   inqparm.getpin_cb_desc = desc_text;
   inqparm.passthru = 0;
   inqparm.keydata = NULL;
   inqparm.keydatalen = 0;
 
   if (ctrl->use_auth_call)
     snprintf (line, sizeof line, "PKAUTH %s", keyid);
   else
     snprintf (line, sizeof line, "PKSIGN %s %s",
               hash_algo_option (mdalgo), keyid);
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         put_membuf_cb, &data,
                         inq_needpin, &inqparm,
                         pincache_put_cb, NULL);
 
   if (rc)
     {
       size_t len;
 
       xfree (get_membuf (&data, &len));
       return unlock_scd (ctrl, rc);
     }
 
   *r_buf = get_membuf (&data, r_buflen);
   return unlock_scd (ctrl, 0);
 }
 
 
 
 
 /* Check whether there is any padding info from scdaemon.  */
 static gpg_error_t
 padding_info_cb (void *opaque, const char *line)
 {
   gpg_error_t err = 0;
   int *r_padding = opaque;
   const char *s;
 
   if ((s=has_leading_keyword (line, "PADDING")))
     {
       *r_padding = atoi (s);
     }
   else if ((s=has_leading_keyword (line, "PINCACHE_PUT")))
     err = handle_pincache_put (line);
 
   return err;
 }
 
 
 /* Decipher INDATA using the current card.  Note that the returned
  * value is not an s-expression but the raw data as returned by
  * scdaemon.  The padding information is stored at R_PADDING with -1
  * for not known.  DESC_TEXT is an additional parameter passed to
  * GETPIN_CB.  */
 int
 agent_card_pkdecrypt (ctrl_t ctrl,
                       const char *keyid,
                       int (*getpin_cb)(void *, const char *,
                                        const char *, char*, size_t),
                       void *getpin_cb_arg,
                       const char *desc_text,
                       const unsigned char *indata, size_t indatalen,
                       char **r_buf, size_t *r_buflen, int *r_padding)
 {
   int rc, i;
   char *p, line[ASSUAN_LINELENGTH];
   membuf_t data;
   struct inq_needpin_parm_s inqparm;
   size_t len;
 
   *r_buf = NULL;
   *r_padding = -1; /* Unknown.  */
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   /* FIXME: use secure memory where appropriate */
 
   for (len = 0; len < indatalen;)
     {
       p = stpcpy (line, "SETDATA ");
       if (len)
         p = stpcpy (p, "--append ");
       for (i=0; len < indatalen && (i*2 < DIM(line)-50); i++, len++)
         {
           sprintf (p, "%02X", indata[len]);
           p += 2;
         }
       rc = assuan_transact (daemon_ctx (ctrl), line,
                             NULL, NULL, NULL, NULL, NULL, NULL);
       if (rc)
         return unlock_scd (ctrl, rc);
     }
 
   init_membuf (&data, 1024);
   inqparm.ctx = daemon_ctx (ctrl);
   inqparm.getpin_cb = getpin_cb;
   inqparm.getpin_cb_arg = getpin_cb_arg;
   inqparm.getpin_cb_desc = desc_text;
   inqparm.passthru = 0;
   inqparm.keydata = NULL;
   inqparm.keydatalen = 0;
   snprintf (line, DIM(line), "PKDECRYPT %s", keyid);
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         put_membuf_cb, &data,
                         inq_needpin, &inqparm,
                         padding_info_cb, r_padding);
 
   if (rc)
     {
       xfree (get_membuf (&data, &len));
       return unlock_scd (ctrl, rc);
     }
   *r_buf = get_membuf (&data, r_buflen);
   if (!*r_buf)
     return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));
 
   return unlock_scd (ctrl, 0);
 }
 
 
 
 /* Read a certificate with ID into R_BUF and R_BUFLEN. */
 int
 agent_card_readcert (ctrl_t ctrl,
                      const char *id, char **r_buf, size_t *r_buflen)
 {
   int rc;
   char line[ASSUAN_LINELENGTH];
   membuf_t data;
   size_t len;
 
   *r_buf = NULL;
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   init_membuf (&data, 1024);
   snprintf (line, DIM(line), "READCERT %s", id);
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         put_membuf_cb, &data,
                         NULL, NULL,
                         pincache_put_cb, NULL);
   if (rc)
     {
       xfree (get_membuf (&data, &len));
       return unlock_scd (ctrl, rc);
     }
   *r_buf = get_membuf (&data, r_buflen);
   if (!*r_buf)
     return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));
 
   return unlock_scd (ctrl, 0);
 }
 
 
 
 struct readkey_status_parm_s
 {
   char *keyref;
 };
 
 static gpg_error_t
 readkey_status_cb (void *opaque, const char *line)
 {
   struct readkey_status_parm_s *parm = opaque;
   gpg_error_t err = 0;
   char *line_buffer = NULL;
   const char *s;
 
   if ((s = has_leading_keyword (line, "KEYPAIRINFO"))
       && !parm->keyref)
     {
       /* The format of such a line is:
-       *   KEYPAIRINFO <hexgrip> <keyref> [usage] [keytime]
+       *   KEYPAIRINFO <hexgrip> <keyref> [usage] [keytime] [algostr]
        *
        * Here we only need the keyref.  We use only the first received
        * KEYPAIRINFO; it is possible to receive several if there are
        * two or more active cards with the same key.  */
       const char *fields[2];
       int nfields;
 
       line_buffer = xtrystrdup (line);
       if (!line_buffer)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
 
       if ((nfields = split_fields (line_buffer, fields, DIM (fields))) < 2)
         goto leave;  /* Not enough args; invalid status line - skip.  */
 
       parm->keyref = xtrystrdup (fields[1]);
       if (!parm->keyref)
         err = gpg_error_from_syserror ();
     }
   else
     err = pincache_put_cb (NULL, line);
 
  leave:
   xfree (line_buffer);
   return err;
 }
 
 
 /* Read a key with ID (keyref or keygrip) and return it in a malloced
  * buffer pointed to by R_BUF as a valid S-expression.  If R_KEYREF is
  * not NULL the keyref is stored there. */
 int
 agent_card_readkey (ctrl_t ctrl, const char *id,
                     unsigned char **r_buf, char **r_keyref)
 {
   int rc;
   char line[ASSUAN_LINELENGTH];
   membuf_t data;
   size_t len, buflen;
   struct readkey_status_parm_s parm;
 
   memset (&parm, 0, sizeof parm);
 
   *r_buf = NULL;
   if (r_keyref)
     *r_keyref = NULL;
 
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   init_membuf (&data, 1024);
   snprintf (line, DIM(line), "READKEY%s -- %s",
             r_keyref? " --info":"", id);
   rc = assuan_transact (daemon_ctx (ctrl), line,
                         put_membuf_cb, &data,
                         NULL, NULL,
                         readkey_status_cb, &parm);
   if (rc)
     {
       xfree (get_membuf (&data, &len));
       xfree (parm.keyref);
       return unlock_scd (ctrl, rc);
     }
   *r_buf = get_membuf (&data, &buflen);
   if (!*r_buf)
     {
       xfree (parm.keyref);
       return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));
     }
 
   if (!gcry_sexp_canon_len (*r_buf, buflen, NULL, NULL))
     {
       xfree (parm.keyref);
       xfree (*r_buf); *r_buf = NULL;
       return unlock_scd (ctrl, gpg_error (GPG_ERR_INV_VALUE));
     }
   if (r_keyref)
     *r_keyref = parm.keyref;
   else
     xfree (parm.keyref);
 
   return unlock_scd (ctrl, 0);
 }
 
 
 /* Handle a KEYDATA inquiry.  Note, we only send the data,
    assuan_transact takes care of flushing and writing the end */
 static gpg_error_t
 inq_writekey_parms (void *opaque, const char *line)
 {
   struct inq_needpin_parm_s *parm = opaque;
 
   if (has_leading_keyword (line, "KEYDATA"))
     return assuan_send_data (parm->ctx, parm->keydata, parm->keydatalen);
   else
     return inq_needpin (opaque, line);
 }
 
 
 /* Call scd to write a key to a card under the id KEYREF.  */
 gpg_error_t
 agent_card_writekey (ctrl_t ctrl,  int force, const char *serialno,
                      const char *keyref,
                      const char *keydata, size_t keydatalen,
                      int (*getpin_cb)(void *, const char *,
                                       const char *, char*, size_t),
                      void *getpin_cb_arg)
 {
   gpg_error_t err;
   char line[ASSUAN_LINELENGTH];
   struct inq_needpin_parm_s parms;
 
   (void)serialno; /* NULL or a number to check for the correct card.
                    * But is is not implemented.  */
 
   err = start_scd (ctrl);
   if (err)
     return err;
 
   snprintf (line, DIM(line), "WRITEKEY %s%s", force ? "--force " : "", keyref);
   parms.ctx = daemon_ctx (ctrl);
   parms.getpin_cb = getpin_cb;
   parms.getpin_cb_arg = getpin_cb_arg;
   parms.getpin_cb_desc= NULL;
   parms.passthru = 0;
   parms.keydata = keydata;
   parms.keydatalen = keydatalen;
 
   err = assuan_transact (daemon_ctx (ctrl), line, NULL, NULL,
                          inq_writekey_parms, &parms,
                          pincache_put_cb, NULL);
   return unlock_scd (ctrl, err);
 }
 
 
 
 /* Type used with the card_getattr_cb.  */
 struct card_getattr_parm_s {
   const char *keyword;  /* Keyword to look for.  */
   size_t keywordlen;    /* strlen of KEYWORD.  */
   char *data;           /* Malloced and unescaped data.  */
   int error;            /* ERRNO value or 0 on success. */
 };
 
 /* Callback function for agent_card_getattr.  */
 static gpg_error_t
 card_getattr_cb (void *opaque, const char *line)
 {
   gpg_error_t err = 0;
   struct card_getattr_parm_s *parm = opaque;
   const char *keyword = line;
   int keywordlen;
 
   if (parm->data)
     return 0; /* We want only the first occurrence.  */
 
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
     ;
   while (spacep (line))
     line++;
 
   if (keywordlen == parm->keywordlen
       && !memcmp (keyword, parm->keyword, keywordlen))
     {
       parm->data = percent_plus_unescape ((const unsigned char*)line, 0xff);
       if (!parm->data)
         parm->error = errno;
     }
   else if (keywordlen == 12 && !memcmp (keyword, "PINCACHE_PUT", keywordlen))
     err = handle_pincache_put (line);
 
   return err;
 }
 
 
 /* Call the agent to retrieve a single line data object. On success
    the object is malloced and stored at RESULT; it is guaranteed that
    NULL is never stored in this case.  On error an error code is
    returned and NULL stored at RESULT. */
 gpg_error_t
 agent_card_getattr (ctrl_t ctrl, const char *name, char **result,
                     const char *keygrip)
 {
   int err;
   struct card_getattr_parm_s parm;
   char line[ASSUAN_LINELENGTH];
 
   *result = NULL;
 
   if (!*name)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   memset (&parm, 0, sizeof parm);
   parm.keyword = name;
   parm.keywordlen = strlen (name);
 
   /* We assume that NAME does not need escaping. */
   if (8 + strlen (name) > DIM(line)-1)
     return gpg_error (GPG_ERR_TOO_LARGE);
   if (keygrip == NULL)
     stpcpy (stpcpy (line, "GETATTR "), name);
   else
     snprintf (line, sizeof line, "GETATTR %s %s", name, keygrip);
 
   err = start_scd (ctrl);
   if (err)
     return err;
 
   err = assuan_transact (daemon_ctx (ctrl), line,
                          NULL, NULL, NULL, NULL,
                          card_getattr_cb, &parm);
   if (!err && parm.error)
     err = gpg_error_from_errno (parm.error);
 
   if (!err && !parm.data)
     err = gpg_error (GPG_ERR_NO_DATA);
 
   if (!err)
     *result = parm.data;
   else
     xfree (parm.data);
 
   return unlock_scd (ctrl, err);
 }
 
 
 
 struct card_keyinfo_parm_s {
   int error;
   struct card_key_info_s *list;
 };
 
 /* Callback function for agent_card_keylist.  */
 static gpg_error_t
 card_keyinfo_cb (void *opaque, const char *line)
 {
   gpg_error_t err = 0;
   struct card_keyinfo_parm_s *parm = opaque;
   const char *keyword = line;
   int keywordlen;
 
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
     ;
   while (spacep (line))
     line++;
 
   if (keywordlen == 7 && !memcmp (keyword, "KEYINFO", keywordlen))
     {
       const char *s;
       int n;
       struct card_key_info_s *keyinfo;
       struct card_key_info_s **l_p = &parm->list;
 
       while ((*l_p))
         l_p = &(*l_p)->next;
 
       keyinfo = xtrycalloc (1, sizeof *keyinfo);
       if (!keyinfo)
         {
         alloc_error:
           if (!parm->error)
             parm->error = gpg_error_from_syserror ();
           return 0;
         }
 
       for (n=0,s=line; hexdigitp (s); s++, n++)
         ;
 
       if (n != 40)
         {
         parm_error:
           if (!parm->error)
             parm->error = gpg_error (GPG_ERR_ASS_PARAMETER);
           return 0;
         }
 
       memcpy (keyinfo->keygrip, line, 40);
       keyinfo->keygrip[40] = 0;
 
       line = s;
 
       if (!*line)
         goto parm_error;
 
       while (spacep (line))
         line++;
 
       if (*line++ != 'T')
         goto parm_error;
 
       if (!*line)
         goto parm_error;
 
       while (spacep (line))
         line++;
 
       for (n=0,s=line; hexdigitp (s); s++, n++)
         ;
 
       if (!n)
         goto parm_error;
 
       keyinfo->serialno = xtrymalloc (n+1);
       if (!keyinfo->serialno)
         goto alloc_error;
 
       memcpy (keyinfo->serialno, line, n);
       keyinfo->serialno[n] = 0;
 
       line = s;
 
       if (!*line)
         goto parm_error;
 
       while (spacep (line))
         line++;
 
       if (!*line)
         goto parm_error;
 
       keyinfo->idstr = xtrystrdup (line);
       if (!keyinfo->idstr)
         goto alloc_error;
 
       *l_p = keyinfo;
     }
   else if (keywordlen == 12 && !memcmp (keyword, "PINCACHE_PUT", keywordlen))
     err = handle_pincache_put (line);
 
   return err;
 }
 
 
 void
 agent_card_free_keyinfo (struct card_key_info_s *l)
 {
   struct card_key_info_s *l_next;
 
   for (; l; l = l_next)
     {
       l_next = l->next;
       xfree (l->serialno);
       xfree (l->idstr);
       xfree (l);
     }
 }
 
 /* Call the scdaemon to check if a key of KEYGRIP is available, or
    retrieve list of available keys on cards.  With CAP, we can limit
    keys with specified capability.  On success, the allocated
    structure is stored at RESULT.  On error, an error code is returned
    and NULL is stored at RESULT.  */
 gpg_error_t
 agent_card_keyinfo (ctrl_t ctrl, const char *keygrip, int cap,
                     struct card_key_info_s **result)
 {
   int err;
   struct card_keyinfo_parm_s parm;
   char line[ASSUAN_LINELENGTH];
   char *list_option;
 
   *result = NULL;
 
   switch (cap)
     {
     case                  0: list_option = "--list";      break;
     case GCRY_PK_USAGE_SIGN: list_option = "--list=sign"; break;
     case GCRY_PK_USAGE_ENCR: list_option = "--list=encr"; break;
     case GCRY_PK_USAGE_AUTH: list_option = "--list=auth"; break;
     default:                 return gpg_error (GPG_ERR_INV_VALUE);
     }
 
   memset (&parm, 0, sizeof parm);
   snprintf (line, sizeof line, "KEYINFO %s", keygrip ? keygrip : list_option);
 
   err = start_scd (ctrl);
   if (err)
     return err;
 
   err = assuan_transact (daemon_ctx (ctrl), line,
                          NULL, NULL, NULL, NULL,
                          card_keyinfo_cb, &parm);
   if (!err && parm.error)
     err = parm.error;
 
   if (!err)
     *result = parm.list;
   else
     agent_card_free_keyinfo (parm.list);
 
   return unlock_scd (ctrl, err);
 }
 
 static gpg_error_t
 pass_status_thru (void *opaque, const char *line)
 {
   gpg_error_t err = 0;
   assuan_context_t ctx = opaque;
   char keyword[200];
   int i;
 
   if (line[0] == '#' && (!line[1] || spacep (line+1)))
     {
       /* We are called in convey comments mode.  Now, if we see a
          comment marker as keyword we forward the line verbatim to the
          the caller.  This way the comment lines from scdaemon won't
          appear as status lines with keyword '#'.  */
       assuan_write_line (ctx, line);
     }
   else
     {
       for (i=0; *line && !spacep (line) && i < DIM(keyword)-1; line++, i++)
         keyword[i] = *line;
       keyword[i] = 0;
 
       /* Truncate any remaining keyword stuff.  */
       for (; *line && !spacep (line); line++)
         ;
       while (spacep (line))
         line++;
 
       /* We do not want to pass PINCACHE_PUT through.  */
       if (!strcmp (keyword, "PINCACHE_PUT"))
         err = handle_pincache_put (line);
       else
         assuan_write_status (ctx, keyword, line);
     }
   return err;
 }
 
 static gpg_error_t
 pass_data_thru (void *opaque, const void *buffer, size_t length)
 {
   assuan_context_t ctx = opaque;
 
   assuan_send_data (ctx, buffer, length);
   return 0;
 }
 
 
 /* Send the line CMDLINE with command for the SCDdaemon to it and send
    all status messages back.  This command is used as a general quoting
    mechanism to pass everything verbatim to SCDAEMON.  The PIN
    inquiry is handled inside gpg-agent.  */
 int
 agent_card_scd (ctrl_t ctrl, const char *cmdline,
                 int (*getpin_cb)(void *, const char *,
                                  const char *, char*, size_t),
                 void *getpin_cb_arg, void *assuan_context)
 {
   int rc;
   struct inq_needpin_parm_s inqparm;
   int saveflag;
 
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
   inqparm.ctx = daemon_ctx (ctrl);
   inqparm.getpin_cb = getpin_cb;
   inqparm.getpin_cb_arg = getpin_cb_arg;
   inqparm.getpin_cb_desc = NULL;
   inqparm.passthru = assuan_context;
   inqparm.keydata = NULL;
   inqparm.keydatalen = 0;
 
   saveflag = assuan_get_flag (daemon_ctx (ctrl), ASSUAN_CONVEY_COMMENTS);
   assuan_set_flag (daemon_ctx (ctrl), ASSUAN_CONVEY_COMMENTS, 1);
   rc = assuan_transact (daemon_ctx (ctrl), cmdline,
                         pass_data_thru, assuan_context,
                         inq_needpin, &inqparm,
                         pass_status_thru, assuan_context);
 
   assuan_set_flag (daemon_ctx (ctrl), ASSUAN_CONVEY_COMMENTS, saveflag);
   if (rc)
     {
       return unlock_scd (ctrl, rc);
     }
 
   return unlock_scd (ctrl, 0);
 }
diff --git a/doc/DETAILS b/doc/DETAILS
index 728239e19..98f4af511 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -1,1682 +1,1683 @@
 # doc/DETAILS                                                -*- org -*-
 #+TITLE: GnuPG Details
 # Globally disable superscripts and subscripts:
 #+OPTIONS: ^:{}
-#
+#+STARTUP: showall
 
 # Note: This file uses org-mode; it should be easy to read as plain
 # text but be aware of some markup peculiarities: Verbatim code is
 # enclosed in #+begin-example, #+end-example blocks or marked by a
 # colon as the first non-white-space character, words bracketed with
 # equal signs indicate a monospace font, and the usual /italics/,
 # *bold*, and _underline_ conventions are recognized.
 
 This is the DETAILS file for GnuPG which specifies some internals and
 parts of the external API for GPG and GPGSM.
 
 * Format of the colon listings
 
   The format is a based on colon separated record, each recods starts
   with a tag string and extends to the end of the line.  Here is an
   example:
 #+begin_example
 $ gpg --with-colons --list-keys \
       --with-fingerprint --with-fingerprint wk@gnupg.org
 pub:f:1024:17:6C7EE1B8621CC013:899817715:1055898235::m:::scESC:
 fpr:::::::::ECAF7590EB3443B5C7CF3ACB6C7EE1B8621CC013:
 uid:f::::::::Werner Koch <wk@g10code.com>:
 uid:f::::::::Werner Koch <wk@gnupg.org>:
 sub:f:1536:16:06AD222CADF6A6E1:919537416:1036177416:::::e:
 fpr:::::::::CF8BCC4B18DE08FCD8A1615906AD222CADF6A6E1:
 sub:r:1536:20:5CE086B5B5A18FF4:899817788:1025961788:::::esc:
 fpr:::::::::AB059359A3B81F410FCFF97F5CE086B5B5A18FF4:
 #+end_example
 
 Note that new version of GnuPG or the use of certain options may add
 new fields to the output.  Parsers should not assume a limit on the
 number of fields per line.  Some fields are not yet used or only used
 with certain record types; parsers should ignore fields they are not
 aware of.  New versions of GnuPG or the use of certain options may add
 new types of records as well.  Parsers should ignore any record whose
 type they do not recognize for forward-compatibility.
 
 The double =--with-fingerprint= prints the fingerprint for the subkeys
 too.  Old versions of gpg used a slightly different format and required
 the use of the option =--fixed-list-mode= to conform to the format
 described here.
 
 
 ** Description of the fields
 *** Field 1 - Type of record
 
     - pub :: Public key
     - crt :: X.509 certificate
     - crs :: X.509 certificate and private key available
     - sub :: Subkey (secondary key)
     - sec :: Secret key
     - ssb :: Secret subkey (secondary key)
     - uid :: User id
     - uat :: User attribute (same as user id except for field 10).
     - sig :: Signature
     - rev :: Revocation signature
     - rvs :: Revocation signature (standalone) [since 2.2.9]
     - fpr :: Fingerprint (fingerprint is in field 10)
     - fp2 :: SHA-256 fingerprint (fingerprint is in field 10)
     - pkd :: Public key data [*]
     - grp :: Keygrip
     - rvk :: Revocation key
     - tfs :: TOFU statistics [*]
     - tru :: Trust database information [*]
     - spk :: Signature subpacket [*]
     - cfg :: Configuration data [*]
 
     Records marked with an asterisk are described at [[*Special%20field%20formats][*Special fields]].
 
 *** Field 2 - Validity
 
     This is a letter describing the computed validity of a key.
     Currently this is a single letter, but be prepared that additional
     information may follow in some future versions. Note that GnuPG <
     2.1 does not set this field for secret key listings.
 
     - o :: Unknown (this key is new to the system)
     - i :: The key is invalid (e.g. due to a missing self-signature)
     - d :: The key has been disabled
 	   (deprecated - use the 'D' in field 12 instead)
     - r :: The key has been revoked
     - e :: The key has expired
     - - :: Unknown validity (i.e. no value assigned)
     - q :: Undefined validity.  '-' and 'q' may safely be treated as
            the same value for most purposes
     - n :: The key is not valid
     - m :: The key is marginal valid.
     - f :: The key is fully valid
     - u :: The key is ultimately valid.  This often means that the
            secret key is available, but any key may be marked as
            ultimately valid.
     - w :: The key has a well known private part.
     - s :: The key has special validity.  This means that it might be
            self-signed and expected to be used in the STEED system.
 
     If the validity information is given for a UID or UAT record, it
     describes the validity calculated based on this user ID.  If given
     for a key record it describes the validity taken from the best
     rated user ID.
 
     For X.509 certificates a 'u' is used for a trusted root
     certificate (i.e. for the trust anchor) and an 'f' for all other
     valid certificates.
 
     In "sig" records, this field may have one of these values as first
     character:
 
     - ! :: Signature is good.
     - - :: Signature is bad.
     - ? :: No public key to verify signature or public key is not usable.
     - % :: Other error verifying a signature
 
     More values may be added later.  The field may also be empty if
     gpg has been invoked in a non-checking mode (--list-sigs) or in a
     fast checking mode.  Since 2.2.7 '?' will also be printed by the
     command --list-sigs if the key is not in the local keyring.
 
 *** Field 3 - Key length
 
     The length of key in bits.
 
 *** Field 4 - Public key algorithm
 
     The values here are those from the OpenPGP specs or if they are
     greater than 255 the algorithm ids as used by Libgcrypt.
 
 *** Field 5 - KeyID
 
     This is the 64 bit keyid as specified by OpenPGP and the last 64
     bit of the SHA-1 fingerprint of an X.509 certifciate.
 
 *** Field 6 - Creation date
 
     The creation date of the key is given in UTC.  For UID and UAT
     records, this is used for the self-signature date.  Note that the
     date is usually printed in seconds since epoch, however, we are
     migrating to an ISO 8601 format (e.g. "19660205T091500").  This is
     currently only relevant for X.509.  A simple way to detect the new
     format is to scan for the 'T'.  Note that old versions of gpg
     without using the =--fixed-list-mode= option used a "yyyy-mm-tt"
     format.
 
 *** Field 7 - Expiration date
 
     Key or UID/UAT expiration date or empty if it does not expire.
 
 *** Field 8 - Certificate S/N, UID hash, trust signature info
 
     Used for serial number in crt records.  For UID and UAT records,
     this is a hash of the user ID contents used to represent that
     exact user ID.  For trust signatures, this is the trust depth
     separated by the trust value by a space.
 
 *** Field 9 -  Ownertrust
 
     This is only used on primary keys.  This is a single letter, but
     be prepared that additional information may follow in future
     versions.  For trust signatures with a regular expression, this is
     the regular expression value, quoted as in field 10.
 
 *** Field 10 - User-ID
 
     The value is quoted like a C string to avoid control characters
     (the colon is quoted =\x3a=).  For a "pub" record this field is
     not used on --fixed-list-mode.  A UAT record puts the attribute
     subpacket count here, a space, and then the total attribute
     subpacket size.  In gpgsm the issuer name comes here.  The FPR and FP2
     records store the fingerprints here.  The fingerprint of a
     revocation key is stored here.
 
 *** Field 11 - Signature class
 
     Signature class as per RFC-4880.  This is a 2 digit hexnumber
     followed by either the letter 'x' for an exportable signature or
     the letter 'l' for a local-only signature.  The class byte of an
     revocation key is also given here, by a 2 digit hexnumber and
     optionally followed by the letter 's' for the "sensitive"
     flag.  This field is not used for X.509.
 
     "rev" and "rvs" may be followed by a comma and a 2 digit hexnumber
     with the revocation reason.
 
 *** Field 12 - Key capabilities
 
     The defined capabilities are:
 
     - e :: Encrypt
     - s :: Sign
     - c :: Certify
     - a :: Authentication
     - ? :: Unknown capability
 
     A key may have any combination of them in any order.  In addition
     to these letters, the primary key has uppercase versions of the
     letters to denote the _usable_ capabilities of the entire key, and
     a potential letter 'D' to indicate a disabled key.
 
 *** Field 13 - Issuer certificate fingerprint or other info
 
     Used in FPR records for S/MIME keys to store the fingerprint of
     the issuer certificate.  This is useful to build the certificate
     path based on certificates stored in the local key database it is
     only filled if the issuer certificate is available. The root has
     been reached if this is the same string as the fingerprint. The
     advantage of using this value is that it is guaranteed to have
     been built by the same lookup algorithm as gpgsm uses.
 
     For "uid" records this field lists the preferences in the same way
     gpg's --edit-key menu does.
 
     For "sig", "rev" and "rvs" records, this is the fingerprint of the
     key that issued the signature.  Note that this may only be filled
     if the signature verified correctly.  Note also that for various
     technical reasons, this fingerprint is only available if
     --no-sig-cache is used.  Since 2.2.7 this field will also be set
     if the key is missing but the signature carries an issuer
     fingerprint as meta data.
 
 *** Field 14 - Flag field
 
     Flag field used in the --edit menu output
 
 *** Field 15 - S/N of a token
 
     Used in sec/ssb to print the serial number of a token (internal
     protect mode 1002) or a '#' if that key is a simple stub (internal
     protect mode 1001).  If the option --with-secret is used and a
     secret key is available for the public key, a '+' indicates this.
 
 *** Field 16 - Hash algorithm
 
     For sig records, this is the used hash algorithm.  For example:
     2 = SHA-1, 8 = SHA-256.
 
 *** Field 17 - Curve name
 
     For pub, sub, sec, ssb, crt, and crs records this field is used
     for the ECC curve name.
 
 *** Field 18 - Compliance flags
 
     Space separated list of asserted compliance modes and
     screening result for this key.
 
     Valid values are:
 
     - 8  :: The key is compliant with RFC4880bis
     - 23 :: The key is compliant with compliance mode "de-vs".
     - 6001 :: Screening hit on the ROCA vulnerability.
 
 *** Field 19 - Last update
 
     The timestamp of the last update of a key or user ID.  The update
     time of a key is defined a lookup of the key via its unique
     identifier (fingerprint); the field is empty if not known.  The
     update time of a user ID is defined by a lookup of the key using a
     trusted mapping from mail address to key.
 
 *** Field 20 - Origin
 
     The origin of the key or the user ID.  This is an integer
     optionally followed by a space and an URL.  This goes along with
     the previous field.  The URL is quoted in C style.
 
 *** Field 21 - Comment
 
     This is currently only used in "rev" and "rvs" records to carry
     the the comment field of the recocation reason.  The value is
     quoted in C style.
 
 ** Special fields
 
 *** PKD - Public key data
 
     If field 1 has the tag "pkd", a listing looks like this:
 #+begin_example
 pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     !  !   !-- the value
     !  !------ for information number of bits in the value
     !--------- index (eg. DSA goes from 0 to 3: p,q,g,y)
 #+end_example
 
 *** TFS - TOFU statistics
 
     This field may follows a UID record to convey information about
     the TOFU database.  The information is similar to a TOFU_STATS
     status line.
 
     - Field 2 :: tfs record version (must be 1)
     - Field 3 :: validity -  A number with validity code.
     - Field 4 :: signcount - The number of signatures seen.
     - Field 5 :: encrcount - The number of encryptions done.
     - Field 6 :: policy - A string with the policy
     - Field 7 :: signture-first-seen - a timestamp or 0 if not known.
     - Field 8 :: signature-most-recent-seen - a timestamp or 0 if not known.
     - Field 9 :: encryption-first-done - a timestamp or 0 if not known.
     - Field 10 :: encryption-most-recent-done - a timestamp or 0 if not known.
 
 *** TRU - Trust database information
     Example for a "tru" trust base record:
 #+begin_example
     tru:o:0:1166697654:1:3:1:5
 #+end_example
 
     - Field 2 :: Reason for staleness of trust.  If this field is
                  empty, then the trustdb is not stale.  This field may
                  have multiple flags in it:
 
                  - o :: Trustdb is old
                  - t :: Trustdb was built with a different trust model
                         than the one we are using now.
 
     - Field 3 :: Trust model
 
                  - 0 :: Classic trust model, as used in PGP 2.x.
                  - 1 :: PGP trust model, as used in PGP 6 and later.
                         This is the same as the classic trust model,
                         except for the addition of trust signatures.
 
                  GnuPG before version 1.4 used the classic trust model
                  by default. GnuPG 1.4 and later uses the PGP trust
                  model by default.
 
     - Field 4 :: Date trustdb was created in seconds since Epoch.
     - Field 5 :: Date trustdb will expire in seconds since Epoch.
     - Field 6 :: Number of marginally trusted users to introduce a new
                  key signer (gpg's option --marginals-needed).
     - Field 7 :: Number of completely trusted users to introduce a new
                  key signer.  (gpg's option --completes-needed)
 
     - Field 8 :: Maximum depth of a certification chain. (gpg's option
                  --max-cert-depth)
 
 *** SPK - Signature subpacket records
 
     - Field 2 :: Subpacket number as per RFC-4880 and later.
     - Field 3 :: Flags in hex.  Currently the only two bits assigned
                  are 1, to indicate that the subpacket came from the
                  hashed part of the signature, and 2, to indicate the
                  subpacket was marked critical.
     - Field 4 :: Length of the subpacket.  Note that this is the
                  length of the subpacket, and not the length of field
                  5 below.  Due to the need for %-encoding, the length
                  of field 5 may be up to 3x this value.
     - Field 5 :: The subpacket data.  Printable ASCII is shown as
                  ASCII, but other values are rendered as %XX where XX
                  is the hex value for the byte.
 
 *** CFG - Configuration data
 
     --list-config outputs information about the GnuPG configuration
     for the benefit of frontends or other programs that call GnuPG.
     There are several list-config items, all colon delimited like the
     rest of the --with-colons output.  The first field is always "cfg"
     to indicate configuration information.  The second field is one of
     (with examples):
 
     - version :: The third field contains the version of GnuPG.
 
                  : cfg:version:1.3.5
 
     - pubkey :: The third field contains the public key algorithms
                 this version of GnuPG supports, separated by
                 semicolons.  The algorithm numbers are as specified in
                 RFC-4880.  Note that in contrast to the --status-fd
                 interface these are _not_ the Libgcrypt identifiers.
                 Using =pubkeyname= prints names instead of numbers.
 
                  : cfg:pubkey:1;2;3;16;17
 
     - cipher :: The third field contains the symmetric ciphers this
                 version of GnuPG supports, separated by semicolons.
                 The cipher numbers are as specified in RFC-4880.
                 Using =ciphername= prints names instead of numbers.
 
                  : cfg:cipher:2;3;4;7;8;9;10
 
     - digest :: The third field contains the digest (hash) algorithms
                 this version of GnuPG supports, separated by
                 semicolons.  The digest numbers are as specified in
                 RFC-4880.  Using =digestname= prints names instead of
                 numbers.
 
                  : cfg:digest:1;2;3;8;9;10
 
     - compress :: The third field contains the compression algorithms
                   this version of GnuPG supports, separated by
                   semicolons.  The algorithm numbers are as specified
                   in RFC-4880.
 
                  : cfg:compress:0;1;2;3
 
     - group :: The third field contains the name of the group, and the
                fourth field contains the values that the group expands
                to, separated by semicolons.
 
                For example, a group of:
                  : group mynames = paige 0x12345678 joe patti
                would result in:
                  : cfg:group:mynames:patti;joe;0x12345678;paige
 
     - curve :: The third field contains the curve names this version
                of GnuPG supports, separated by semicolons. Using
                =curveoid= prints OIDs instead of numbers.
 
                  : cfg:curve:ed25519;nistp256;nistp384;nistp521
 
 
 * Format of the --status-fd output
 
   Every line is prefixed with "[GNUPG:] ", followed by a keyword with
   the type of the status line and some arguments depending on the type
   (maybe none); an application should always be willing to ignore
   unknown keywords that may be emitted by future versions of GnuPG.
   Also, new versions of GnuPG may add arguments to existing keywords.
   Any additional arguments should be ignored for forward-compatibility.
 
 ** General status codes
 *** NEWSIG [<signers_uid>]
     Is issued right before a signature verification starts.  This is
     useful to define a context for parsing ERROR status messages.
     If SIGNERS_UID is given and is not "-" this is the percent-escaped
     value of the OpenPGP Signer's User ID signature sub-packet.
 
 *** GOODSIG  <long_keyid_or_fpr>  <username>
     The signature with the keyid is good.  For each signature only one
     of the codes GOODSIG, BADSIG, EXPSIG, EXPKEYSIG, REVKEYSIG or
     ERRSIG will be emitted.  In the past they were used as a marker
     for a new signature; new code should use the NEWSIG status
     instead.  The username is the primary one encoded in UTF-8 and %XX
     escaped. The fingerprint may be used instead of the long keyid if
     it is available.  This is the case with CMS and might eventually
     also be available for OpenPGP.
 
 *** EXPSIG  <long_keyid_or_fpr>  <username>
     The signature with the keyid is good, but the signature is
     expired. The username is the primary one encoded in UTF-8 and %XX
     escaped. The fingerprint may be used instead of the long keyid if
     it is available.  This is the case with CMS and might eventually
     also be available for OpenPGP.
 
 *** EXPKEYSIG  <long_keyid_or_fpr> <username>
     The signature with the keyid is good, but the signature was made
     by an expired key. The username is the primary one encoded in
     UTF-8 and %XX escaped.  The fingerprint may be used instead of the
     long keyid if it is available.  This is the case with CMS and
     might eventually also be available for OpenPGP.
 
 *** REVKEYSIG  <long_keyid_or_fpr>  <username>
     The signature with the keyid is good, but the signature was made
     by a revoked key. The username is the primary one encoded in UTF-8
     and %XX escaped. The fingerprint may be used instead of the long
     keyid if it is available.  This is the case with CMS and might
     eventually also beñ available for OpenPGP.
 
 *** BADSIG  <long_keyid_or_fpr>  <username>
     The signature with the keyid has not been verified okay.  The
     username is the primary one encoded in UTF-8 and %XX escaped. The
     fingerprint may be used instead of the long keyid if it is
     available.  This is the case with CMS and might eventually also be
     available for OpenPGP.
 
 *** ERRSIG  <keyid>  <pkalgo> <hashalgo> <sig_class> <time> <rc> <fpr>
     It was not possible to check the signature.  This may be caused by
     a missing public key or an unsupported algorithm.  A RC of 4
     indicates unknown algorithm, a 9 indicates a missing public
     key. The other fields give more information about this signature.
     sig_class is a 2 byte hex-value.  The fingerprint may be used
     instead of the long_keyid_or_fpr if it is available.  This is the
     case with gpgsm and might eventually also be available for
     OpenPGP.  The ERRSIG line has FPR filed which is only available
     since 2.2.7; that FPR may either be missing or - if the signature
     has no fingerprint as meta data.
 
     Note, that TIME may either be the number of seconds since Epoch or
     an ISO 8601 string.  The latter can be detected by the presence of
     the letter 'T'.
 
 *** VALIDSIG <args>
 
     The args are:
 
     - <fingerprint_in_hex>
     - <sig_creation_date>
     - <sig-timestamp>
     - <expire-timestamp>
     - <sig-version>
     - <reserved>
     - <pubkey-algo>
     - <hash-algo>
     - <sig-class>
     - [ <primary-key-fpr> ]
 
     This status indicates that the signature is cryptographically
     valid. This is similar to GOODSIG, EXPSIG, EXPKEYSIG, or REVKEYSIG
     (depending on the date and the state of the signature and signing
     key) but has the fingerprint as the argument. Multiple status
     lines (VALIDSIG and the other appropriate *SIG status) are emitted
     for a valid signature.  All arguments here are on one long line.
     sig-timestamp is the signature creation time in seconds after the
     epoch. expire-timestamp is the signature expiration time in
     seconds after the epoch (zero means "does not
     expire"). sig-version, pubkey-algo, hash-algo, and sig-class (a
     2-byte hex value) are all straight from the signature packet.
     PRIMARY-KEY-FPR is the fingerprint of the primary key or identical
     to the first argument.  This is useful to get back to the primary
     key without running gpg again for this purpose.
 
     The primary-key-fpr parameter is used for OpenPGP and not
     available for CMS signatures.  The sig-version as well as the sig
     class is not defined for CMS and currently set to 0 and 00.
 
     Note, that *-TIMESTAMP may either be a number of seconds since
     Epoch or an ISO 8601 string which can be detected by the presence
     of the letter 'T'.
 
 *** SIG_ID  <radix64_string>  <sig_creation_date>  <sig-timestamp>
     This is emitted only for signatures of class 0 or 1 which have
     been verified okay.  The string is a signature id and may be used
     in applications to detect replay attacks of signed messages.  Note
     that only DLP algorithms give unique ids - others may yield
     duplicated ones when they have been created in the same second.
 
     Note, that SIG-TIMESTAMP may either be a number of seconds since
     Epoch or an ISO 8601 string which can be detected by the presence
     of the letter 'T'.
 
 *** ENC_TO  <long_keyid>  <keytype>  <keylength>
     The message is encrypted to this LONG_KEYID.  KEYTYPE is the
     numerical value of the public key algorithm or 0 if it is not
     known, KEYLENGTH is the length of the key or 0 if it is not known
     (which is currently always the case).  Gpg prints this line
     always; Gpgsm only if it knows the certificate.
 
 *** BEGIN_DECRYPTION
     Mark the start of the actual decryption process.  This is also
     emitted when in --list-only mode.
 *** END_DECRYPTION
     Mark the end of the actual decryption process.  This are also
     emitted when in --list-only mode.
 *** DECRYPTION_KEY <fpr> <fpr2> <otrust>
     This line is emitted when a public key decryption succeeded in
     providing a session key.  <fpr> is the hexified fingerprint of the
     actual key used for decryption.  <fpr2> is the fingerprint of the
     primary key.  <otrust> is the letter with the ownertrust; this is
     in general a 'u' which stands for ultimately trusted.
 *** DECRYPTION_INFO <mdc_method> <sym_algo> [<aead_algo>]
     Print information about the symmetric encryption algorithm and the
     MDC method.  This will be emitted even if the decryption fails.
     For an AEAD algorithm AEAD_ALGO is not 0.  GPGSM currently does
     not print such a status.
 
 *** DECRYPTION_FAILED
     The symmetric decryption failed - one reason could be a wrong
     passphrase for a symmetrical encrypted message.
 
 *** DECRYPTION_OKAY
     The decryption process succeeded.  This means, that either the
     correct secret key has been used or the correct passphrase for a
     symmetric encrypted message was given.  The program itself may
     return an errorcode because it may not be possible to verify a
     signature for some reasons.
 
 *** SESSION_KEY <algo>:<hexdigits>
     The session key used to decrypt the message.  This message will
     only be emitted if the option --show-session-key is used.  The
     format is suitable to be passed as value for the option
     --override-session-key.  It is not an indication that the
     decryption will or has succeeded.
 
 *** BEGIN_ENCRYPTION  <mdc_method> <sym_algo> [<aead_algo>]
     Mark the start of the actual encryption process.
     MDC_METHOD shall be 0 if an AEAD_ALGO is not 0.  Users should
     however ignore MDC_METHOD if AEAD_ALGO is not 0.
 
 *** END_ENCRYPTION
     Mark the end of the actual encryption process.
 
 *** FILE_START <what> <filename>
     Start processing a file <filename>.  <what> indicates the performed
     operation:
     - 1 :: verify
     - 2 :: encrypt
     - 3 :: decrypt
 
 *** FILE_DONE
     Marks the end of a file processing which has been started
     by FILE_START.
 
 *** BEGIN_SIGNING
     Mark the start of the actual signing process. This may be used as
     an indication that all requested secret keys are ready for use.
 
 *** ALREADY_SIGNED <long-keyid>
     Warning: This is experimental and might be removed at any time.
 
 *** SIG_CREATED <type> <pk_algo> <hash_algo> <class> <timestamp> <keyfpr>
     A signature has been created using these parameters.
     Values for type <type> are:
       - D :: detached
       - C :: cleartext
       - S :: standard
     (only the first character should be checked)
 
     <class> are 2 hex digits with the OpenPGP signature class.
 
     Note, that TIMESTAMP may either be a number of seconds since Epoch
     or an ISO 8601 string which can be detected by the presence of the
     letter 'T'.
 
 *** NOTATION_
     There are actually three related status codes to convey notation
     data:
 
     - NOTATION_NAME <name>
     - NOTATION_FLAGS <critical> <human_readable>
     - NOTATION_DATA <string>
 
     <name> and <string> are %XX escaped.  The data may be split among
     several NOTATION_DATA lines.  NOTATION_FLAGS is emitted after
     NOTATION_NAME and gives the critical and human readable flags;
     the flag values are either 0 or 1.
 
 *** POLICY_URL <string>
     Note that URL in <string> is %XX escaped.
 
 *** PLAINTEXT <format> <timestamp> <filename>
     This indicates the format of the plaintext that is about to be
     written.  The format is a 1 byte hex code that shows the format of
     the plaintext: 62 ('b') is binary data, 74 ('t') is text data with
     no character set specified, and 75 ('u') is text data encoded in
     the UTF-8 character set.  The timestamp is in seconds since the
     epoch.  If a filename is available it gets printed as the third
     argument, percent-escaped as usual.
 
 *** PLAINTEXT_LENGTH <length>
     This indicates the length of the plaintext that is about to be
     written.  Note that if the plaintext packet has partial length
     encoding it is not possible to know the length ahead of time.  In
     that case, this status tag does not appear.  The length is only
     exact for binary formats; other formats ('t', 'u') may do post
     processing like line ending conversion so that the actual number
     of bytes written may be differ.
 
 *** ATTRIBUTE <arguments>
     The list or arguments are:
     - <fpr>
     - <octets>
     - <type>
     - <index>
     - <count>
     - <timestamp>
     - <expiredate>
     - <flags>
 
     This is one long line issued for each attribute subpacket when an
     attribute packet is seen during key listing.  <fpr> is the
     fingerprint of the key.  <octets> is the length of the attribute
     subpacket.  <type> is the attribute type (e.g. 1 for an image).
     <index> and <count> indicate that this is the N-th indexed
     subpacket of count total subpackets in this attribute packet.
     <timestamp> and <expiredate> are from the self-signature on the
     attribute packet.  If the attribute packet does not have a valid
     self-signature, then the timestamp is 0.  <flags> are a bitwise OR
     of:
     - 0x01 :: this attribute packet is a primary uid
     - 0x02 :: this attribute packet is revoked
     - 0x04 :: this attribute packet is expired
 
 *** SIG_SUBPACKET <type> <flags> <len> <data>
     This indicates that a signature subpacket was seen.  The format is
     the same as the "spk" record above.
 
 *** ENCRYPTION_COMPLIANCE_MODE <flags>
     Indicates that the current encryption operation was in compliance
     with the given set of modes for all recipients.  "flags" is a
     space separated list of numerical flags, see "Field 18 -
     Compliance flags" above.
 
 *** DECRYPTION_COMPLIANCE_MODE <flags>
     Indicates that the current decryption operation is in compliance
     with the given set of modes.  "flags" is a space separated list of
     numerical flags, see "Field 18 - Compliance flags" above.
 
 *** VERIFICATION_COMPLIANCE_MODE <flags>
     Indicates that the current signature verification operation is in
     compliance with the given set of modes.  "flags" is a space
     separated list of numerical flags, see "Field 18 - Compliance
     flags" above.
 
 ** Key related
 *** INV_RECP, INV_SGNR
     The two similar status codes:
 
     - INV_RECP <reason> <requested_recipient>
     - INV_SGNR <reason> <requested_sender>
 
     are issued for each unusable recipient/sender. The reasons codes
     currently in use are:
 
        -  0 :: No specific reason given
        -  1 :: Not Found
        -  2 :: Ambiguous specification
        -  3 :: Wrong key usage
        -  4 :: Key revoked
        -  5 :: Key expired
        -  6 :: No CRL known
        -  7 :: CRL too old
        -  8 :: Policy mismatch
        -  9 :: Not a secret key
        - 10 :: Key not trusted
        - 11 :: Missing certificate
        - 12 :: Missing issuer certificate
        - 13 :: Key disabled
        - 14 :: Syntax error in specification
 
     If no specific reason was given a previously emitted status code
     KEY_CONSIDERED may be used to analyzed the problem.
 
     Note that for historical reasons the INV_RECP status is also used
     for gpgsm's SIGNER command where it relates to signer's of course.
     Newer GnuPG versions are using INV_SGNR; applications should
     ignore the INV_RECP during the sender's command processing once
     they have seen an INV_SGNR.  Different codes are used so that they
     can be distinguish while doing an encrypt+sign operation.
 
 *** NO_RECP <reserved>
     Issued if no recipients are usable.
 
 *** NO_SGNR <reserved>
     Issued if no senders are usable.
 
 *** KEY_CONSIDERED <fpr> <flags>
     Issued to explain the lookup of a key.  FPR is the hexified
     fingerprint of the primary key.  The bit values for FLAGS are:
 
     - 1 :: The key has not been selected.
     - 2 :: All subkeys of the key are expired or have been revoked.
 
 *** KEYEXPIRED <expire-timestamp>
     The key has expired.  expire-timestamp is the expiration time in
     seconds since Epoch.  This status line is not very useful because
     it will also be emitted for expired subkeys even if this subkey is
     not used.  To check whether a key used to sign a message has
     expired, the EXPKEYSIG status line is to be used.
 
     Note, that the TIMESTAMP may either be a number of seconds since
     Epoch or an ISO 8601 string which can be detected by the presence
     of the letter 'T'.
 
 *** KEYREVOKED
     The used key has been revoked by its owner.  No arguments yet.
 
 *** NO_PUBKEY  <long keyid>
     The public key is not available.  Note the arg should in general
     not be used because it is better to take it from the ERRSIG
     status line which is printed right before this one.
 
 *** NO_SECKEY  <long keyid>
     The secret key is not available
 
 *** KEY_CREATED <type> <fingerprint> [<handle>]
     A key has been created.  Values for <type> are:
       - B :: primary and subkey
       - P :: primary
       - S :: subkey
     The fingerprint is one of the primary key for type B and P and the
     one of the subkey for S.  Handle is an arbitrary non-whitespace
     string used to match key parameters from batch key creation run.
 
 *** KEY_NOT_CREATED [<handle>]
     The key from batch run has not been created due to errors.
 
 *** TRUST_
     These are several similar status codes:
 
 #+begin_src
     - TRUST_UNDEFINED <error_token> [<validation_model> [<mbox>]]
     - TRUST_NEVER     <error_token> [<validation_model> [<mbox>]]
     - TRUST_MARGINAL  0  [<validation_model> [<mbox>]]
     - TRUST_FULLY     0  [<validation_model> [<mbox>]]
     - TRUST_ULTIMATE  0  [<validation_model> [<mbox>]]
 #+end_src
 
     For good signatures one of these status lines are emitted to
     indicate the validity of the key used to create the signature.
     <error_token> values other that a literal zero are currently only
     emitted by gpgsm.
 
     VALIDATION_MODEL describes the algorithm used to check the
     validity of the key.  The defaults are the standard Web of Trust
     model for gpg and the standard X.509 model for gpgsm.  The
     defined values are
 
        - classic  :: The classic PGP WoT model.
        - pgp      :: The standard PGP WoT.
        - external :: The external PGP trust model.
        - tofu     :: The GPG Trust-On-First-Use model.
        - tofu+pgp :: Ditto but combined with mopdel "pgp".
        - always   :: The Always trust model.
        - direct   :: The Direct Trust model.
        - shell    :: The Standard X.509 model.
        - chain    :: The Chain model.
        - steed    :: The STEED model.
        - unknown  :: An unknown trust model.
 
     Note that the term =TRUST_= in the status names is used for
     historic reasons; we now speak of validity.
 
     MBOX is the UTF-8 encoded and percent escaped addr-spec of the
     User ID used to compute the validity of a signature.  If this is
     not known the validity is computed on the key with no specific
     User ID.  Note that MBOX is always the addr-spec of the User ID;
     for User IDs without a proper addr-spec a dash is used to
     distinguish this from the case that no User ID at all is known.
     The MBOX is either taken from the Signer's User ID signature
     sub-packet or from the addr-spec passed to gpg using the --sender
     option.  If both are available and they don't match
     TRUST_UNDEFINED along with an error code is emitted.  MBOX is not
     used by gpgsm.
 
 *** TOFU_USER <fingerprint_in_hex> <mbox>
 
     This status identifies the key and the userid for all following
     Tofu information.  The fingerprint is the fingerprint of the
     primary key and the mbox is in general the addr-spec part of the
     userid encoded in UTF-8 and percent escaped.  The fingerprint is
     identical for all TOFU_USER lines up to a NEWSIG line.
 
 *** TOFU_STATS <MANY_ARGS>
 
     Statistics for the current user id.
 
     The <MANY_ARGS> are the usual space delimited arguments.  Here we
     have too many of them to fit on one printed line and thus they are
     given on 3 printed lines:
 
     : <summary> <sign-count> <encryption-count>
     : [<policy> [<tm1> <tm2> <tm3> <tm4>
     : [<validity> [<sign-days> <encrypt-days>]]]]
 
     Values for SUMMARY are:
     - 0 :: attention, an interaction with the user is required (conflict)
     - 1 :: key with no verification/encryption history
     - 2 :: key with little history
     - 3 :: key with enough history for basic trust
     - 4 :: key with a lot of history
 
     Values for POLICY are:
     - none    :: No Policy set
     - auto    :: Policy is "auto"
     - good    :: Policy is "good"
     - bad     :: Policy is "bad"
     - ask     :: Policy is "ask"
     - unknown :: Policy is "unknown" (TOFU information does not
                  contribute to the key's validity)
 
     TM1 is the time the first message was verified.  TM2 is the time
     the most recent message was verified.  TM3 is the time the first
     message was encrypted.  TM4 is the most recent encryption. All may
     either be seconds since Epoch or an ISO time string
     (yyyymmddThhmmss).
 
     VALIDITY is the same as SUMMARY with the exception that VALIDITY
     doesn't reflect whether the key needs attention.  That is it never
     takes on value 0.  Instead, if there is a conflict, VALIDITY still
     reflects the key's validity (values: 1-4).
 
     SUMMARY values use the euclidean distance (m = sqrt(a² + b²)) rather
     then the sum of the magnitudes (m = a + b) to ensure a balance between
     verified signatures and encrypted messages.
 
     Values are calculated based on the number of days where a key was used
     for verifying a signature or to encrypt to it.
     The ranges for the values are:
 
     - 1 :: signature_days + encryption_days == 0
     - 2 :: 1 <= sqrt(signature_days² + encryption_days²) < 8
     - 3 :: 8 <= sqrt(signature_days² + encryption_days²) < 42
     - 4 :: sqrt(signature_days² + encryption_days²) >= 42
 
     SIGN-COUNT and ENCRYPTION-COUNT are the number of messages that we
     have seen that have been signed by this key / encryption to this
     key.
 
     SIGN-DAYS and ENCRYPTION-DAYS are similar, but the number of days
     (in UTC) on which we have seen messages signed by this key /
     encrypted to this key.
 
 *** TOFU_STATS_SHORT <long_string>
 
     Information about the TOFU binding for the signature.
     Example: "15 signatures verified. 10 messages encrypted"
 
 *** TOFU_STATS_LONG <long_string>
 
     Information about the TOFU binding for the signature in verbose
     format.  The LONG_STRING is percent escaped.
     Example: 'Verified 9 messages signed by "Werner Koch
     (dist sig)" in the past 3 minutes, 40 seconds.  The most
     recent message was verified 4 seconds ago.'
 
 *** PKA_TRUST_
     This is one of:
 
     - PKA_TRUST_GOOD <addr-spec>
     - PKA_TRUST_BAD  <addr-spec>
 
     Depending on the outcome of the PKA check one of the above status
     codes is emitted in addition to a =TRUST_*= status.
 
 ** Remote control
 *** GET_BOOL, GET_LINE, GET_HIDDEN, GOT_IT
 
     These status line are used with --command-fd for interactive
     control of the process.
 
 *** USERID_HINT <long main keyid> <string>
     Give a hint about the user ID for a certain keyID.
 
 *** NEED_PASSPHRASE <long keyid> <long main keyid> <keytype> <keylength>
     Issued whenever a passphrase is needed.  KEYTYPE is the numerical
     value of the public key algorithm or 0 if this is not applicable,
     KEYLENGTH is the length of the key or 0 if it is not known (this
     is currently always the case).
 
 *** NEED_PASSPHRASE_SYM <cipher_algo> <s2k_mode> <s2k_hash>
     Issued whenever a passphrase for symmetric encryption is needed.
 
 *** NEED_PASSPHRASE_PIN <card_type> <chvno> [<serialno>]
     Issued whenever a PIN is requested to unlock a card.
 
 *** MISSING_PASSPHRASE
     No passphrase was supplied.  An application which encounters this
     message may want to stop parsing immediately because the next
     message will probably be a BAD_PASSPHRASE.  However, if the
     application is a wrapper around the key edit menu functionality it
     might not make sense to stop parsing but simply ignoring the
     following BAD_PASSPHRASE.
 
 *** BAD_PASSPHRASE <long keyid>
     The supplied passphrase was wrong or not given.  In the latter
     case you may have seen a MISSING_PASSPHRASE.
 
 *** GOOD_PASSPHRASE
     The supplied passphrase was good and the secret key material
     is therefore usable.
 
 ** Import/Export
 *** IMPORT_CHECK <long keyid> <fingerprint> <user ID>
     This status is emitted in interactive mode right before
     the "import.okay" prompt.
 
 *** IMPORTED   <long keyid>  <username>
     The keyid and name of the signature just imported
 
 *** IMPORT_OK  <reason> [<fingerprint>]
     The key with the primary key's FINGERPRINT has been imported.
     REASON flags are:
 
     - 0 :: Not actually changed
     - 1 :: Entirely new key.
     - 2 :: New user IDs
     - 4 :: New signatures
     - 8 :: New subkeys
     - 16 :: Contains private key.
 
     The flags may be ORed.
 
 *** IMPORT_PROBLEM <reason> [<fingerprint>]
     Issued for each import failure.  Reason codes are:
 
     - 0 :: No specific reason given.
     - 1 :: Invalid Certificate.
     - 2 :: Issuer Certificate missing.
     - 3 :: Certificate Chain too long.
     - 4 :: Error storing certificate.
 
 *** IMPORT_RES <args>
     Final statistics on import process (this is one long line). The
     args are a list of unsigned numbers separated by white space:
 
     - <count>
     - <no_user_id>
     - <imported>
     - always 0 (formerly used for the number of RSA keys)
     - <unchanged>
     - <n_uids>
     - <n_subk>
     - <n_sigs>
     - <n_revoc>
     - <sec_read>
     - <sec_imported>
     - <sec_dups>
     - <skipped_new_keys>
     - <not_imported>
     - <skipped_v3_keys>
 
 *** EXPORTED  <fingerprint>
     The key with <fingerprint> has been exported.  The fingerprint is
     the fingerprint of the primary key even if the primary key has
     been replaced by a stub key during secret key export.
 
 *** EXPORT_RES <args>
 
     Final statistics on export process (this is one long line). The
     args are a list of unsigned numbers separated by white space:
 
     - <count>
     - <secret_count>
     - <exported>
 
 
 ** Smartcard related
 *** CARDCTRL <what> [<serialno>]
     This is used to control smartcard operations.  Defined values for
     WHAT are:
 
       - 1 :: Request insertion of a card.  Serialnumber may be given
              to request a specific card.  Used by gpg 1.4 w/o
              scdaemon
       - 2 :: Request removal of a card.  Used by gpg 1.4 w/o scdaemon.
       - 3 :: Card with serialnumber detected
       - 4 :: No card available
       - 5 :: No card reader available
       - 6 :: No card support available
       - 7 :: Card is in termination state
 
 *** SC_OP_FAILURE [<code>]
     An operation on a smartcard definitely failed.  Currently there is
     no indication of the actual error code, but application should be
     prepared to later accept more arguments.  Defined values for
     <code> are:
 
       - 0 :: unspecified error (identically to a missing CODE)
       - 1 :: canceled
       - 2 :: bad PIN
 
 *** SC_OP_SUCCESS
     A smart card operation succeeded.  This status is only printed for
     certain operation and is mostly useful to check whether a PIN
     change really worked.
 
 ** Miscellaneous status codes
 *** NODATA  <what>
     No data has been found.  Codes for WHAT are:
 
     - 1 :: No armored data.
     - 2 :: Expected a packet but did not found one.
     - 3 :: Invalid packet found, this may indicate a non OpenPGP
            message.
     - 4 :: Signature expected but not found
 
     You may see more than one of these status lines.
 
 *** UNEXPECTED <what>
     Unexpected data has been encountered.  Codes for WHAT are:
     - 0 :: Not further specified
     - 1 :: Corrupted message structure
 
 *** TRUNCATED <maxno>
     The output was truncated to MAXNO items.  This status code is
     issued for certain external requests.
 
 *** ERROR <error location> <error code> [<more>]
     This is a generic error status message, it might be followed by
     error location specific data. <error code> and <error_location>
     should not contain spaces.  The error code is a either a string
     commencing with a letter or such a string prefixed with a
     numerical error code and an underscore; e.g.: "151011327_EOF".
 *** WARNING <location> <error code> [<text>]
     This is a generic warning status message, it might be followed by
     error location specific data. <location> and <error code> may not
     contain spaces.  The <location> may be used to indicate a class of
     warnings.  The error code is a either a string commencing with a
     letter or such a string prefixed with a numerical error code and
     an underscore; e.g.: "151011327_EOF".
 *** NOTE <location> <error code> [<text>]
     This is a generic info status message the same syntax as for
     WARNING messages is used.
 *** SUCCESS [<location>]
     Positive confirmation that an operation succeeded.  It is used
     similar to ISO-C's EXIT_SUCCESS.  <location> is optional but if
     given should not contain spaces.  Used only with a few commands.
 
 *** FAILURE <location> <error_code>
     This is the counterpart to SUCCESS and used to indicate a program
     failure.  It is used similar to ISO-C's EXIT_FAILURE but allows
     conveying more information, in particular a gpg-error error code.
     That numerical error code may optionally have a suffix made of an
     underscore and a string with an error symbol like "151011327_EOF".
     A dash may be used instead of <location>.
 
 *** BADARMOR
     The ASCII armor is corrupted.  No arguments yet.
 
 *** DELETE_PROBLEM <reason_code>
     Deleting a key failed.  Reason codes are:
     - 1 :: No such key
     - 2 :: Must delete secret key first
     - 3 :: Ambiguous specification
     - 4 :: Key is stored on a smartcard.
 
 *** PROGRESS <what> <char> <cur> <total> [<units>]
     Used by the primegen and public key functions to indicate
     progress.  <char> is the character displayed with no --status-fd
     enabled, with the linefeed replaced by an 'X'.  <cur> is the
     current amount done and <total> is amount to be done; a <total> of
     0 indicates that the total amount is not known. Both are
     non-negative integers.  The condition
       :       TOTAL && CUR == TOTAL
     may be used to detect the end of an operation.
 
     Well known values for <what> are:
 
            - pk_dsa   :: DSA key generation
            - pk_elg   :: Elgamal key generation
            - primegen :: Prime generation
            - need_entropy :: Waiting for new entropy in the RNG
            - tick :: Generic tick without any special meaning - useful
                      for letting clients know that the server is still
                      working.
            - starting_agent :: A gpg-agent was started because it is not
                                 running as a daemon.
            - learncard :: Send by the agent and gpgsm while learing
                           the data of a smartcard.
            - card_busy :: A smartcard is still working
 
     When <what> refers to a file path, it may be truncated.
 
     <units> is sometimes used to describe the units for <current> and
     <total>.  For example "B", "KiB", or "MiB".
 
 *** BACKUP_KEY_CREATED <fingerprint> <fname>
     A backup of a key identified by <fingerprint> has been writte to
     the file <fname>; <fname> is percent-escaped.
 
 *** MOUNTPOINT <name>
     <name> is a percent-plus escaped filename describing the
     mountpoint for the current operation (e.g. used by "g13 --mount").
     This may either be the specified mountpoint or one randomly
     chosen by g13.
 
 *** PINENTRY_LAUNCHED <pid>[:<extra>]
     This status line is emitted by gpg to notify a client that a
     Pinentry has been launched.  <pid> is the PID of the Pinentry.  It
     may be used to display a hint to the user but can't be used to
     synchronize with Pinentry.  Note that there is also an Assuan
     inquiry line with the same name used internally or, if enabled,
     send to the client instead of this status line.  Such an inquiry
     may be used to sync with Pinentry
 
 ** Obsolete status codes
 *** SIGEXPIRED
     Removed on 2011-02-04.  This is deprecated in favor of KEYEXPIRED.
 *** RSA_OR_IDEA
     Obsolete.  This status message used to be emitted for requests to
     use the IDEA or RSA algorithms.  It has been dropped from GnuPG
     2.1 after the respective patents expired.
 *** SHM_INFO, SHM_GET, SHM_GET_BOOL, SHM_GET_HIDDEN
     These were used for the ancient shared memory based co-processing.
 *** BEGIN_STREAM, END_STREAM
     Used to issued by the experimental pipemode.
 
 ** Inter-component codes
    Status codes are also used between the components of the GnuPG
    system via the Assuan S lines.  Some of them are documented here:
 
 *** PUBKEY_INFO <n> <ubid> <flags>
     The type of the public key in the following D-lines or
     communicated via a pipe.  <n> is the value of =enum pubkey_types=
     and <ubid> the Unique Blob ID (UBID) which is the fingerprint of
     the primary key truncated to 20 octets and formatted in hex.  Note
     that the keyboxd SEARCH command can be used to lookup the public
     key using the <ubid> prefixed with a caret (^).
 
     <flags> is a string extra information about the blob.  The first
     byte is either '-' for standard key or 'e' for an ephemeral key.
     The second byte is either '-' or 'r' for a known revoked key.
 
-*** KEYPAIRINFO <grip> <keyref> [<usage>] [<keytime>]
+*** KEYPAIRINFO <grip> <keyref> [<usage>] [<keytime>] [<algostr>]
 
     This status is emitted by scdaemon and gpg-agent to convey brief
     information about keypairs stored on tokens.  <grip> is the
     hexified keygrip of the key or, if no key is stored, an "X".
     <keyref> is the ID of a card's key; for example "OPENPGP.2" for
     the second key slot of an OpenPGP card.  <usage> is optional and
     returns technically possible key usages, this is a string of
     single letters describing the usage ('c' for certify, 'e' for
     encryption, 's' for signing, 'a' for authentication). A '-' can be
     used to tell that usage flags are not conveyed.  <keytime> is used
     by OpenPGP cards for the stored key creation time.  A '-' means no
-    info available.  The format is the usual ISO string are a number
-    with the seconds since Epoch.
+    info available.  The format is the usual ISO string or a number
+    with the seconds since Epoch.  <algostr> is the algorithm or curve
+    this key uses (e.g. "rsa2048") or a "-" if not known.
 *** MANUFACTURER <n> [<string>]
 
     This status returns the Manufactorer ID as the unsigned number N.
     For OpenPGP this is well defined; for other cards this is 0.  The
     name of the manufacturer is also given as <string>; spaces are not
     escaped.  For PKCS#15 cards <string> is TokenInfo.manufactorerID.
 
 *** KEY-STATUS <keyref> <status>
     This is the response from scdaemon on GETATTR KEY-STATUS for
     OpenPGP cards.  <keyref> is the usual keyref (e.g. OPENPGP.1 or
     OPENPGP.129) and <status> is an integer describing the status of
     the key: 0 = key is not present, 1 = key generated on card, 2 =
     key imported.  See section 4.4.3.8 of the OpenPGP Smart Card
     Application V3.4.
 
 *** KEY-ATTR-INFO <keyref> <string>
     This is the response from scdaemon on GETATTR KEY-ATTR-INFO for
     OpenPGP cards.  <keyref> is the usual keyref (e.g. OPENPGP.1 or
     OPENPGP.129) and <string> is the algoritm or curve name, which
     is available for the key.
 
 * Format of the --attribute-fd output
 
   When --attribute-fd is set, during key listings (--list-keys,
   --list-secret-keys) GnuPG dumps each attribute packet to the file
   descriptor specified.  --attribute-fd is intended for use with
   --status-fd as part of the required information is carried on the
   ATTRIBUTE status tag (see above).
 
   The contents of the attribute data is specified by RFC 4880.  For
   convenience, here is the Photo ID format, as it is currently the
   only attribute defined:
 
   - Byte 0-1 :: The length of the image header.  Due to a historical
                 accident (i.e. oops!) back in the NAI PGP days, this
                 is a little-endian number.  Currently 16 (0x10 0x00).
 
   - Byte 2 :: The image header version.  Currently 0x01.
 
   - Byte 3 :: Encoding format.  0x01 == JPEG.
 
   - Byte 4-15 :: Reserved, and currently unused.
 
   All other data after this header is raw image (JPEG) data.
 
 
 * Layout of the TrustDB
 
   The TrustDB is built from fixed length records, where the first byte
   describes the record type.  All numeric values are stored in network
   byte order.  The length of each record is 40 bytes.  The first
   record of the DB is always of type 1 and this is the only record of
   this type.
 
   The record types: directory(2), key(3), uid(4), pref(5), sigrec(6),
   and shadow directory(8) are not anymore used by version 2 of the
   TrustDB.
 
 ** Record type 0
 
    Unused record or deleted, can be reused for any purpose.  Such
    records should in general not exist because deleted records are of
    type 254 and kept in a linked list.
 
 ** Version info (RECTYPE_VER, 1)
 
    Version information for this TrustDB.  This is always the first
    record of the DB and the only one of this type.
 
    - 1 u8 :: Record type (value: 1).
    - 3 byte :: Magic value ("gpg")
    - 1 u8 :: TrustDB version (value: 2).
    - 1 u8 :: =marginals=. How many marginal trusted keys are required.
    - 1 u8 :: =completes=. How many completely trusted keys are
              required.
    - 1 u8 :: =max_cert_depth=.  How deep is the WoT evaluated.  Along
              with =marginals= and =completes=, this value is used to
              check whether the cached validity value from a [FIXME
              dir] record can be used.
    - 1 u8 :: =trust_model=
    - 1 u8 :: =min_cert_level=
    - 2 byte :: Not used
    - 1 u32 :: =created=. Timestamp of trustdb creation.
    - 1 u32 :: =nextcheck=. Timestamp of last modification which may
               affect the validity of keys in the trustdb.  This value
               is checked against the validity timestamp in the dir
               records.
    - 1 u32 :: =reserved=.  Not used.
    - 1 u32 :: =reserved2=. Not used.
    - 1 u32 :: =firstfree=. Number of the record with the head record
               of the RECTYPE_FREE linked list.
    - 1 u32 :: =reserved3=. Not used.
    - 1 u32 :: =trusthashtbl=. Record number of the trusthashtable.
 
 
 ** Hash table (RECTYPE_HTBL, 10)
 
    Due to the fact that we use fingerprints to lookup keys, we can
    implement quick access by some simple hash methods, and avoid the
    overhead of gdbm.  A property of fingerprints is that they can be
    used directly as hash values.  What we use is a dynamic multilevel
    architecture, which combines hash tables, record lists, and linked
    lists.
 
    This record is a hash table of 256 entries with the property that
    all these records are stored consecutively to make one big
    table. The hash value is simple the 1st, 2nd, ... byte of the
    fingerprint (depending on the indirection level).
 
    - 1 u8 :: Record type (value: 10).
    - 1 u8 :: Reserved
    - n u32 :: =recnum=.  A table with the hash table items fitting into
               this record.  =n= depends on the record length:
               $n=(reclen-2)/4$ which yields 9 for oure current record
               length of 40 bytes.
 
    The total number of hash table records to form the table is:
    $m=(256+n-1)/n$.  This is 29 for our record length of 40.
 
    To look up a key we use the first byte of the fingerprint to get
    the recnum from this hash table and then look up the addressed
    record:
 
    - If that record is another hash table, we use 2nd byte to index
      that hash table and so on;
    - if that record is a hash list, we walk all entries until we find
      a matching one; or
    - if that record is a key record, we compare the fingerprint to
      decide whether it is the requested key;
 
 
 ** Hash list (RECTYPE_HLST, 11)
 
    See hash table above on how it is used.  It may also be used for
    other purposes.
 
    - 1 u8 :: Record type (value: 11).
    - 1 u8 :: Reserved.
    - 1 u32 :: =next=.  Record number of the next hash list record or 0
               if none.
    - n u32 :: =rnum=.  Array with record numbers to values.  With
               $n=(reclen-5)/5$ and our record length of 40, n is 7.
 
 ** Trust record (RECTYPE_TRUST, 12)
 
    - 1 u8 :: Record type (value: 12).
    - 1 u8 :: Reserved.
    - 20 byte :: =fingerprint=.
    - 1 u8 :: =ownertrust=.
    - 1 u8 :: =depth=.
    - 1 u8 :: =min_ownertrust=.
    - 1 byte :: Not used.
    - 1 u32 :: =validlist=.
    - 10 byte :: Not used.
 
 ** Validity record (RECTYPE_VALID, 13)
 
    - 1 u8 :: Record type (value: 13).
    - 1 u8 :: Reserved.
    - 20 byte :: =namehash=.
    - 1 u8 :: =validity=
    - 1 u32 :: =next=.
    - 1 u8 :: =full_count=.
    - 1 u8 :: =marginal_count=.
    - 11 byte :: Not used.
 
 ** Free record (RECTYPE_FREE, 254)
 
    All these records form a linked list of unused records in the TrustDB.
 
    - 1 u8 :: Record type (value: 254)
    - 1 u8 :: Reserved.
    - 1 u32 :: =next=.  Record number of the next rcord of this type.
               The record number to the head of this linked list is
               stored in the version info record.
 
 
 * Database scheme for the TOFU info
 
 #+begin_src sql
 --
 -- The VERSION table holds the version of our TOFU data structures.
 --
 CREATE TABLE version (
   version integer -- As of now this is always 1
 );
 
 --
 -- The BINDINGS table associates mail addresses with keys.
 --
 CREATE TABLE bindings (
   oid integer primary key autoincrement,
   fingerprint text, -- The key's fingerprint in hex
   email text,       -- The normalized mail address destilled from user_id
   user_id text,     -- The unmodified user id
   time integer,     -- The time this binding was first observed.
   policy boolean check
        (policy in (1, 2, 3, 4, 5)), -- The trust policy with the values:
                                     --   1 := Auto
                                     --   2 := Good
                                     --   3 := Unknown
                                     --   4 := Bad
                                     --   5 := Ask
   conflict string,  -- NULL or a hex formatted fingerprint.
   unique (fingerprint, email)
 );
 
 CREATE INDEX bindings_fingerprint_email on bindings (fingerprint, email);
 CREATE INDEX bindings_email on bindings (email);
 
 --
 -- The SIGNATURES table records all data signatures we verified
 --
 CREATE TABLE signatures (
   binding integer not null, -- Link to bindings table,
                             -- references bindings.oid.
   sig_digest text,          -- The digest of the signed message.
   origin text,              -- String describing who initially fed
                             -- the signature to gpg (e.g. "email:claws").
   sig_time integer,         -- Timestamp from the signature.
   time integer,             -- Time this record was created.
   primary key (binding, sig_digest, origin)
 );
 #+end_src
 
 
 * GNU extensions to the S2K algorithm
 
   1 octet  - S2K Usage: either 254 or 255.
   1 octet  - S2K Cipher Algo: 0
   1 octet  - S2K Specifier: 101
   3 octets - "GNU"
   1 octet  - GNU S2K Extension Number.
 
   If such a GNU extension is used neither an IV nor any kind of
   checksum is used.  The defined GNU S2K Extension Numbers are:
 
   - 1 :: Do not store the secret part at all.  No specific data
          follows.
 
   - 2 :: A stub to access smartcards.  This data follows:
          - One octet with the length of the following serial number.
          - The serial number. Regardless of what the length octet
            indicates no more than 16 octets are stored.
 
   Note that gpg stores the GNU S2K Extension Number internally as an
   S2K Specifier with an offset of 1000.
 
 
 * Format of the OpenPGP TRUST packet
 
   According to RFC4880 (5.10), the trust packet (aka ring trust) is
   only used within keyrings and contains data that records the user's
   specifications of which key holds trusted introducers.  The RFC also
   states that the format of this packet is implementation defined and
   SHOULD NOT be emitted to output streams or should be ignored on
   import.  GnuPG uses this packet in several additional ways:
 
   - 1 octet :: Trust-Value (only used by Subtype SIG)
   - 1 octet :: Signature-Cache (only used by Subtype SIG; value must
                be less than 128)
   - 3 octets :: Fixed value: "gpg"
   - 1 octet  :: Subtype
                - 0 :: Signature cache (SIG)
                - 1 :: Key source on the primary key (KEY)
                - 2 :: Key source on a user id (UID)
   - 1 octet :: Key Source; i.e. the origin of the key:
                - 0 :: Unknown source.
                - 1 :: Public keyserver.
                - 2 :: Preferred keyserver.
                - 3 :: OpenPGP DANE.
                - 4 :: Web Key Directory.
                - 5 :: Import from a trusted URL.
                - 6 :: Import from a trusted file.
                - 7 :: Self generated.
   - 4 octets :: Time of last update.  This is a four-octet scalar
                 with the seconds since Epoch.
   - 1 octet  :: Scalar with the length of the following field.
   - N octets :: String with the URL of the source.  This may be a
                 zero-length string.
 
   If the packets contains only two octets a Subtype of 0 is assumed;
   this is the only format recognized by GnuPG versions < 2.1.18.
   Trust-Value and Signature-Cache must be zero for all subtypes other
   than SIG.
 
 
 * Keyserver helper message format
 
   *This information is obsolete*
   (Keyserver helpers have been replaced by dirmngr)
 
   The keyserver may be contacted by a Unix Domain socket or via TCP.
 
   The format of a request is:
 #+begin_example
   command-tag
   "Content-length:" digits
   CRLF
 #+end_example
 
   Where command-tag is
 
 #+begin_example
   NOOP
   GET <user-name>
   PUT
   DELETE <user-name>
 #+end_example
 
 The format of a response is:
 
 #+begin_example
   "GNUPG/1.0" status-code status-text
   "Content-length:" digits
   CRLF
 #+end_example
 followed by <digits> bytes of data
 
 Status codes are:
 
   - 1xx :: Informational - Request received, continuing process
 
   - 2xx :: Success - The action was successfully received, understood,
            and accepted
 
   - 4xx :: Client Error - The request contains bad syntax or cannot be
            fulfilled
 
   - 5xx :: Server Error - The server failed to fulfill an apparently
            valid request
 
 
 * Object identifiers
 
   OIDs below the GnuPG arc:
 
 #+begin_example
   1.3.6.1.4.1.11591.2          GnuPG
   1.3.6.1.4.1.11591.2.1          notation
   1.3.6.1.4.1.11591.2.1.1          pkaAddress
   1.3.6.1.4.1.11591.2.2          X.509 extensions
   1.3.6.1.4.1.11591.2.2.1          standaloneCertificate
   1.3.6.1.4.1.11591.2.2.2          wellKnownPrivateKey
   1.3.6.1.4.1.11591.2.3          CMS contentType
   1.3.6.1.4.1.11591.2.3.1          OpenPGP keyblock (as octet string)
   1.3.6.1.4.1.11591.2.4          LDAP stuff
   1.3.6.1.4.1.11591.2.4.1          attributes
   1.3.6.1.4.1.11591.2.4.1.1          gpgFingerprint attribute
   1.3.6.1.4.1.11591.2.4.1.2          gpgSubFingerprint attribute
   1.3.6.1.4.1.11591.2.4.1.3          gpgMailbox attribute
   1.3.6.1.4.1.11591.2.4.1.4          gpgSubCertID attribute
   1.3.6.1.4.1.11591.2.12242973   invalid encoded OID
 #+end_example
 
 
 
 * Debug flags
 
 This tables gives the flag values for the --debug option along with
 the alternative names used by the components.
 
 |       | gpg     | gpgsm   | agent   | scd     | dirmngr | g13     | wks     |
 |-------+---------+---------+---------+---------+---------+---------+---------|
 |     1 | packet  | x509    |         |         | x509    | mount   | mime    |
 |     2 | mpi     | mpi     | mpi     | mpi     |         |         | parser  |
 |     4 | crypto  | crypto  | crypto  | crypto  | crypto  | crypto  | crypto  |
 |     8 | filter  |         |         |         |         |         |         |
 |    16 | iobuf   |         |         |         | dns     |         |         |
 |    32 | memory  | memory  | memory  | memory  | memory  | memory  | memory  |
 |    64 | cache   | cache   | cache   | cache   | cache   |         |         |
 |   128 | memstat | memstat | memstat | memstat | memstat | memstat | memstat |
 |   256 | trust   |         |         |         |         |         |         |
 |   512 | hashing | hashing | hashing | hashing | hashing |         |         |
 |  1024 | ipc     | ipc     | ipc     | ipc     | ipc     | ipc     | ipc     |
 |  2048 |         |         |         | cardio  | network |         |         |
 |  4096 | clock   |         |         | reader  |         |         |         |
 |  8192 | lookup  |         |         |         | lookup  |         |         |
 | 16384 | extprog |         |         |         |         |         | extprog |
 
 Description of some debug flags:
 
   - cardio :: Used by scdaemon to trace the APDUs exchange with the
               card.
   - clock  :: Show execution times of certain functions.
   - crypto :: Trace crypto operations.
   - hashing :: Create files with the hashed data.
   - ipc :: Trace the Assuan commands.
   - mpi :: Show the values of the MPIs.
   - reader :: Used by scdaemon to trace card reader related code.  For
               example: Open and close reader.
 
 
 
 * Miscellaneous notes
 ** List of useful RFCs
   - RFC-3447 :: PKCS  #1: RSA Cryptography Specifications Version 2.1
   - RFC-4880 :: OpenPGP
   - RFC-5280 :: X.509 PKI Certificate and CRL Profile
   - RFC-6818 :: Updates to the X.509 PKI Certificate and CRL Profile
   - RFC-8398 :: Internationalized Email Addresses in X.509 Certificates.
   - RFC-8399 :: Internationalization Updates to RFC 5280
   - RFC-5480 :: ECC Subject Public Key Information
   - RFC-8813 :: Clarifications for ECC Subject Public Key
   - RFC-5915 :: Elliptic Curve Private Key Structure
   - RFC-5958 :: Asymmetric Key Packages
   - RFC-7292 :: PKCS #12: Personal Information Exchange Syntax v1.1
   - RFC-8351 :: The PKCS #8 EncryptedPrivateKeyInfo Media Type
 
 ** v3 fingerprints
    For packet version 3 we calculate the keyids this way:
     - RSA :: Low 64 bits of n
     - ELGAMAL :: Build a v3 pubkey packet (with CTB 0x99) and
                  calculate a RMD160 hash value from it. This is used
                  as the fingerprint and the low 64 bits are the keyid.
 
 ** Simplified revocation certificates
   Revocation certificates consist only of the signature packet;
   "--import" knows how to handle this.  The rationale behind it is to
   keep them small.
 
 ** Documentation on HKP (the http keyserver protocol):
 
    A minimalistic HTTP server on port 11371 recognizes a GET for
    /pks/lookup.  The standard http URL encoded query parameters are
    this (always key=value):
 
    - op=index (like pgp -kv), op=vindex (like pgp -kvv) and op=get (like
      pgp -kxa)
 
    - search=<stringlist>. This is a list of words that must occur in the key.
      The words are delimited with space, points, @ and so on. The delimiters
      are not searched for and the order of the words doesn't matter (but see
      next option).
 
    - exact=on. This switch tells the hkp server to only report exact matching
      keys back. In this case the order and the "delimiters" are important.
 
    - fingerprint=on. Also reports the fingerprints when used with 'index' or
      'vindex'
 
    The keyserver also recognizes http-POSTs to /pks/add. Use this to upload
    keys.
 
 
    A better way to do this would be a request like:
 
       /pks/lookup/<gnupg_formatierte_user_id>?op=<operation>
 
    This can be implemented using Hurd's translator mechanism.
    However, I think the whole keyserver stuff has to be re-thought;
    I have some ideas and probably create a white paper.
 ** Algorithm names for the "keygen.algo" prompt
 
   When using a --command-fd controlled key generation or "addkey"
   there is way to know the number to enter on the "keygen.algo"
   prompt.  The displayed numbers are for human reception and may
   change with releases.  To provide a stable way to enter a desired
   algorithm choice the prompt also accepts predefined names for the
   algorithms, which will not change.
 
    | Name    | No | Description                     |
    |---------+----+---------------------------------|
    | rsa+rsa |  1 | RSA and RSA (default)           |
    | dsa+elg |  2 | DSA and Elgamal                 |
    | dsa     |  3 | DSA (sign only)                 |
    | rsa/s   |  4 | RSA (sign only)                 |
    | elg     |  5 | Elgamal (encrypt only)          |
    | rsa/e   |  6 | RSA (encrypt only)              |
    | dsa/*   |  7 | DSA (set your own capabilities) |
    | rsa/*   |  8 | RSA (set your own capabilities) |
    | ecc+ecc |  9 | ECC and ECC                     |
    | ecc/s   | 10 | ECC (sign only)                 |
    | ecc/*   | 11 | ECC (set your own capabilities) |
    | ecc/e   | 12 | ECC (encrypt only)              |
    | keygrip | 13 | Existing key                    |
    | cardkey | 14 | Existing key from card          |
 
    If one of the "foo/*" names are used a "keygen.flags" prompt needs
    to be answered as well.  Instead of toggling the predefined flags,
    it is also possible to set them direct: Use a "=" character
    directly followed by a combination of "a" (for authentication), "s"
    (for signing), or "c" (for certification).
diff --git a/scd/app-common.h b/scd/app-common.h
index cab82fbb6..d245b8b0a 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -1,344 +1,344 @@
 /* app-common.h - Common declarations for all card applications
  * Copyright (C) 2003, 2005, 2008 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  *
  * $Id$
  */
 
 #ifndef GNUPG_SCD_APP_COMMON_H
 #define GNUPG_SCD_APP_COMMON_H
 
 #include <npth.h>
 #include <ksba.h>
 
 /* Flags used with app_change_pin.  */
 #define APP_CHANGE_FLAG_RESET    1  /* PIN Reset mode.  */
 #define APP_CHANGE_FLAG_NULLPIN  2  /* NULL PIN mode.  */
 #define APP_CHANGE_FLAG_CLEAR    4  /* Clear the given PIN.  */
 
 /* Flags used with app_genkey.  */
 #define APP_GENKEY_FLAG_FORCE    1  /* Force overwriting existing key.  */
 
 /* Flags used with app_writekey.  */
 #define APP_WRITEKEY_FLAG_FORCE  1  /* Force overwriting existing key.  */
 
 /* Flags used with app_readkey.  */
 #define APP_READKEY_FLAG_INFO    1  /* Send also a KEYPAIRINFO line.  */
 
 /* Flags set by the decipher function into R_INFO.  */
 #define APP_DECIPHER_INFO_NOPAD  1  /* Padding has been removed.  */
 
 /* Flags used by the app_write_learn_status.  */
 #define APP_LEARN_FLAG_KEYPAIRINFO  1 /* Return only keypair infos.  */
 #define APP_LEARN_FLAG_MULTI        2 /* Return info for all apps.  */
 
 
 /* List of supported card types.  Generic is the usual ISO7817-4
  * compliant card.  More specific card or token versions can be given
  * here.  Use strcardtype() to map them to a string. */
 typedef enum
   {
    CARDTYPE_GENERIC = 0,
    CARDTYPE_GNUK,
    CARDTYPE_YUBIKEY,
    CARDTYPE_ZEITCONTROL
 
   } cardtype_t;
 
 /* List of supported card applications.  The source code for each
  * application can usually be found in an app-NAME.c file.  Use
  * strapptype() to map them to a string.  */
 typedef enum
   {
    APPTYPE_NONE = 0,
    APPTYPE_UNDEFINED,
    APPTYPE_OPENPGP,
    APPTYPE_PIV,
    APPTYPE_NKS,
    APPTYPE_P15,
    APPTYPE_GELDKARTE,
    APPTYPE_DINSIG,
    APPTYPE_SC_HSM
   } apptype_t;
 
 
 /* Forward declarations.  */
 struct card_ctx_s;
 struct app_ctx_s;
 struct app_local_s;  /* Defined by all app-*.c.  */
 
 
 typedef struct card_ctx_s *card_t;
 typedef struct app_ctx_s *app_t;
 
 /* The object describing a card.  */
 struct card_ctx_s {
   card_t next;
 
   npth_mutex_t lock;
 
   /* Number of connections currently using this application context.  */
   unsigned int ref_count;
 
   /* Used reader slot. */
   int slot;
 
   cardtype_t cardtype;     /* The token's type.  */
   unsigned int cardversion;/* Firmware version of the token or 0.  */
 
   unsigned int card_status;
 
   /* The serial number is associated with the card and not with a
    * specific app.  If a card uses different serial numbers for its
    * applications, our code picks the serial number of a specific
    * application and uses that.  */
   unsigned char *serialno; /* Serialnumber in raw form, allocated. */
   size_t serialnolen;      /* Length in octets of serialnumber. */
 
   /* A linked list of applications used on this card.  The app at the
    * head of the list is the currently active app; To work with the
    * other apps, switching to that app might be needed.  Switching will
    * put the active app at the head of the list.  */
   app_t app;
 
   /* Various flags.  */
   unsigned int reset_requested:1;
   unsigned int periodical_check_needed:1;
 };
 
 
 /* The object describing a card's applications.  A card may have
  * several applications and it is usually required to explicitly
  * switch between applications.  */
 struct app_ctx_s {
   app_t next;
 
   card_t card;  /* Link back to the card.  */
 
   apptype_t apptype;       /* The type of the application.  */
   unsigned int appversion; /* Version of the application or 0.     */
   unsigned int did_chv1:1;
   unsigned int force_chv1:1;   /* True if the card does not cache CHV1. */
   unsigned int did_chv2:1;
   unsigned int did_chv3:1;
   struct app_local_s *app_local;  /* Local to the application. */
   struct {
     void (*deinit) (app_t app);
     gpg_error_t (*prep_reselect) (app_t app, ctrl_t ctrl);
     gpg_error_t (*reselect) (app_t app, ctrl_t ctrl);
     gpg_error_t (*learn_status) (app_t app, ctrl_t ctrl, unsigned int flags);
     gpg_error_t (*readcert) (app_t app, const char *certid,
                      unsigned char **cert, size_t *certlen);
     gpg_error_t (*readkey) (app_t app, ctrl_t ctrl,
                             const char *certid, unsigned int flags,
                             unsigned char **pk, size_t *pklen);
     gpg_error_t (*getattr) (app_t app, ctrl_t ctrl, const char *name);
     gpg_error_t (*setattr) (app_t app, ctrl_t ctrl, const char *name,
                     gpg_error_t (*pincb)(void*, const char *, char **),
                     void *pincb_arg,
                     const unsigned char *value, size_t valuelen);
     gpg_error_t (*sign) (app_t app, ctrl_t ctrl,
                  const char *keyidstr, int hashalgo,
                  gpg_error_t (*pincb)(void*, const char *, char **),
                  void *pincb_arg,
                  const void *indata, size_t indatalen,
                  unsigned char **outdata, size_t *outdatalen );
     gpg_error_t (*auth) (app_t app, ctrl_t ctrl, const char *keyidstr,
                  gpg_error_t (*pincb)(void*, const char *, char **),
                  void *pincb_arg,
                  const void *indata, size_t indatalen,
                  unsigned char **outdata, size_t *outdatalen);
     gpg_error_t (*decipher) (app_t app, ctrl_t ctrl, const char *keyidstr,
                              gpg_error_t (*pincb)(void*, const char *, char **),
                              void *pincb_arg,
                              const void *indata, size_t indatalen,
                              unsigned char **outdata, size_t *outdatalen,
                              unsigned int *r_info);
     gpg_error_t (*writecert) (app_t app, ctrl_t ctrl,
                               const char *certid,
                               gpg_error_t (*pincb)(void*,const char *,char **),
                               void *pincb_arg,
                               const unsigned char *data, size_t datalen);
     gpg_error_t (*writekey) (app_t app, ctrl_t ctrl,
                              const char *keyid, unsigned int flags,
                              gpg_error_t (*pincb)(void*,const char *,char **),
                              void *pincb_arg,
                              const unsigned char *pk, size_t pklen);
     gpg_error_t (*genkey) (app_t app, ctrl_t ctrl,
                            const char *keyref, const char *keytype,
                            unsigned int flags, time_t createtime,
                            gpg_error_t (*pincb)(void*, const char *, char **),
                            void *pincb_arg);
     gpg_error_t (*change_pin) (app_t app, ctrl_t ctrl,
                        const char *chvnostr, unsigned int flags,
                        gpg_error_t (*pincb)(void*, const char *, char **),
                        void *pincb_arg);
     gpg_error_t (*check_pin) (app_t app, ctrl_t ctrl, const char *keyidstr,
                       gpg_error_t (*pincb)(void*, const char *, char **),
                       void *pincb_arg);
     gpg_error_t (*with_keygrip) (app_t app, ctrl_t ctrl, int action,
                                  const char *keygrip_str, int capability);
   } fnc;
 };
 
 
 /* Action values for app_do_with_keygrip.  */
 enum
  {
   KEYGRIP_ACTION_SEND_DATA,
   KEYGRIP_ACTION_WRITE_STATUS,
   KEYGRIP_ACTION_LOOKUP
  };
 
 
 /* Helper to get the slot from an APP object. */
 static inline int
 app_get_slot (app_t app)
 {
   if (app && app->card)
     return app->card->slot;
   return -1;
 }
 
 
 /*-- app-help.c --*/
 unsigned int app_help_count_bits (const unsigned char *a, size_t len);
 gpg_error_t app_help_get_keygrip_string_pk (const void *pk, size_t pklen,
                                             char *hexkeygrip,
                                             gcry_sexp_t *r_pkey,
-                                            int *r_algo);
+                                            int *r_algo, char **r_algostr);
 gpg_error_t app_help_get_keygrip_string (ksba_cert_t cert, char *hexkeygrip,
                                          gcry_sexp_t *r_pkey, int *r_algo);
 gpg_error_t app_help_pubkey_from_cert (const void *cert, size_t certlen,
                                        unsigned char **r_pk, size_t *r_pklen);
 size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 
 
 /*-- app.c --*/
 const char *strcardtype (cardtype_t t);
 const char *strapptype (apptype_t t);
 
 void app_update_priority_list (const char *arg);
 gpg_error_t app_send_card_list (ctrl_t ctrl);
 gpg_error_t app_send_active_apps (card_t card, ctrl_t ctrl);
 char *card_get_serialno (card_t card);
 char *app_get_serialno (app_t app);
 
 void app_dump_state (void);
 void application_notify_card_reset (int slot);
 gpg_error_t check_application_conflict (card_t card, const char *name,
                                         const unsigned char *serialno_bin,
                                         size_t serialno_bin_len);
 gpg_error_t card_reset (card_t card, ctrl_t ctrl, int send_reset);
 gpg_error_t select_application (ctrl_t ctrl, const char *name, card_t *r_app,
                                 int scan, const unsigned char *serialno_bin,
                                 size_t serialno_bin_len);
 gpg_error_t select_additional_application (ctrl_t ctrl, const char *name);
 
 gpg_error_t app_switch_current_card (ctrl_t ctrl,
                                      const unsigned char *serialno,
                                      size_t serialnolen);
 gpg_error_t app_switch_active_app (card_t card, ctrl_t ctrl,
                                    const char *appname);
 
 char *get_supported_applications (void);
 
 card_t card_ref (card_t card);
 void   card_unref (card_t card);
 void   card_unref_locked (card_t card);
 
 gpg_error_t app_munge_serialno (card_t card);
 gpg_error_t app_write_learn_status (card_t card, ctrl_t ctrl,
                                     unsigned int flags);
 gpg_error_t app_readcert (card_t card, ctrl_t ctrl, const char *certid,
                   unsigned char **cert, size_t *certlen);
 gpg_error_t app_readkey (card_t card, ctrl_t ctrl,
                          const char *keyid, unsigned int flags,
                          unsigned char **pk, size_t *pklen);
 gpg_error_t app_getattr (card_t card, ctrl_t ctrl, const char *name);
 gpg_error_t app_setattr (card_t card, ctrl_t ctrl, const char *name,
                          gpg_error_t (*pincb)(void*, const char *, char **),
                          void *pincb_arg,
                          const unsigned char *value, size_t valuelen);
 gpg_error_t app_sign (card_t card, ctrl_t ctrl,
                       const char *keyidstr, int hashalgo,
                       gpg_error_t (*pincb)(void*, const char *, char **),
                       void *pincb_arg,
                       const void *indata, size_t indatalen,
                       unsigned char **outdata, size_t *outdatalen);
 gpg_error_t app_auth (card_t card, ctrl_t ctrl, const char *keyidstr,
                       gpg_error_t (*pincb)(void*, const char *, char **),
                       void *pincb_arg,
                       const void *indata, size_t indatalen,
                       unsigned char **outdata, size_t *outdatalen);
 gpg_error_t app_decipher (card_t card, ctrl_t ctrl, const char *keyidstr,
                           gpg_error_t (*pincb)(void*, const char *, char **),
                           void *pincb_arg,
                           const void *indata, size_t indatalen,
                           unsigned char **outdata, size_t *outdatalen,
                           unsigned int *r_info);
 gpg_error_t app_writecert (card_t card, ctrl_t ctrl,
                            const char *certidstr,
                            gpg_error_t (*pincb)(void*, const char *, char **),
                            void *pincb_arg,
                            const unsigned char *keydata, size_t keydatalen);
 gpg_error_t app_writekey (card_t card, ctrl_t ctrl,
                           const char *keyidstr, unsigned int flags,
                           gpg_error_t (*pincb)(void*, const char *, char **),
                           void *pincb_arg,
                           const unsigned char *keydata, size_t keydatalen);
 gpg_error_t app_genkey (card_t card, ctrl_t ctrl,
                         const char *keynostr, const char *keytype,
                         unsigned int flags, time_t createtime,
                         gpg_error_t (*pincb)(void*, const char *, char **),
                         void *pincb_arg);
 gpg_error_t app_get_challenge (card_t card, ctrl_t ctrl, size_t nbytes,
                                unsigned char *buffer);
 gpg_error_t app_change_pin (card_t card, ctrl_t ctrl,
                             const char *chvnostr, unsigned int flags,
                             gpg_error_t (*pincb)(void*, const char *, char **),
                             void *pincb_arg);
 gpg_error_t app_check_pin (card_t card, ctrl_t ctrl, const char *keyidstr,
                            gpg_error_t (*pincb)(void*, const char *, char **),
                            void *pincb_arg);
 card_t app_do_with_keygrip (ctrl_t ctrl, int action, const char *keygrip_str,
                             int capability);
 
 
 /*-- app-openpgp.c --*/
 gpg_error_t app_select_openpgp (app_t app);
 
 /*-- app-nks.c --*/
 gpg_error_t app_select_nks (app_t app);
 
 /*-- app-dinsig.c --*/
 gpg_error_t app_select_dinsig (app_t app);
 
 /*-- app-p15.c --*/
 gpg_error_t app_select_p15 (app_t app);
 
 /*-- app-geldkarte.c --*/
 gpg_error_t app_select_geldkarte (app_t app);
 
 /*-- app-sc-hsm.c --*/
 gpg_error_t app_select_sc_hsm (app_t app);
 
 /*-- app-piv.c --*/
 gpg_error_t app_select_piv (app_t app);
 
 
 #endif /*GNUPG_SCD_APP_COMMON_H*/
diff --git a/scd/app-help.c b/scd/app-help.c
index f2b592399..b599add71 100644
--- a/scd/app-help.c
+++ b/scd/app-help.c
@@ -1,254 +1,269 @@
 /* app-help.c - Application helper functions
  * Copyright (C) 2004, 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "scdaemon.h"
 #include "iso7816.h"
 #include "../common/tlv.h"
 
 
 /* Count the number of bits, assuming that A represents an unsigned
  * big integer of length LEN bytes.  If A is NULL a length of 0 is
  * returned. */
 unsigned int
 app_help_count_bits (const unsigned char *a, size_t len)
 {
   unsigned int n = len * 8;
   int i;
 
   if (!a)
     return 0;
 
   for (; len && !*a; len--, a++, n -=8)
     ;
   if (len)
     {
       for (i=7; i && !(*a & (1<<i)); i--)
         n--;
     }
   return n;
 }
 
 
 /* Return the KEYGRIP for the canonical encoded public key (PK,PKLEN)
  * as an hex encoded string in the user provided buffer HEXKEYGRIP
  * which must be of at least 41 bytes.  If R_PKEY is not NULL and the
  * function succeeded, the S-expression representing the key is stored
  * there.  The caller needs to call gcry_sexp_release on that.  If
  * R_ALGO is not NULL the public key algorithm id of Libgcrypt is
- * stored there.  */
+ * stored there.  If R_ALGOSTR is not NULL and the function succeeds a
+ * newly allocated algo string (e.g. "rsa2048") is stored there. */
 gpg_error_t
 app_help_get_keygrip_string_pk (const void *pk, size_t pklen, char *hexkeygrip,
-                                gcry_sexp_t *r_pkey, int *r_algo)
+                                gcry_sexp_t *r_pkey, int *r_algo,
+                                char **r_algostr)
 {
   gpg_error_t err;
   gcry_sexp_t s_pkey;
   unsigned char array[KEYGRIP_LEN];
 
   if (r_pkey)
     *r_pkey = NULL;
+  if (r_algostr)
+    *r_algostr = NULL;
 
   err = gcry_sexp_sscan (&s_pkey, NULL, pk, pklen);
   if (err)
     return err; /* Can't parse that S-expression. */
   if (!gcry_pk_get_keygrip (s_pkey, array))
     {
       gcry_sexp_release (s_pkey);
       return gpg_error (GPG_ERR_GENERAL); /* Failed to calculate the keygrip.*/
     }
 
   if (r_algo)
     *r_algo = get_pk_algo_from_key (s_pkey);
 
+  if (r_algostr)
+    {
+      *r_algostr = pubkey_algo_string (s_pkey, NULL);
+      if (!*r_algostr)
+        {
+          err = gpg_error_from_syserror ();
+          gcry_sexp_release (s_pkey);
+          return err;
+        }
+    }
+
   if (r_pkey)
     *r_pkey = s_pkey;
   else
     gcry_sexp_release (s_pkey);
 
   bin2hex (array, KEYGRIP_LEN, hexkeygrip);
 
   return 0;
 }
 
 
 /* Return the KEYGRIP for the certificate CERT as an hex encoded
  * string in the user provided buffer HEXKEYGRIP which must be of at
  * least 41 bytes.  If R_PKEY is not NULL and the function succeeded,
  * the S-expression representing the key is stored there.  The caller
  * needs to call gcry_sexp_release on that.  If R_ALGO is not NULL the
  * public key algorithm id of Libgcrypt is stored there. */
 gpg_error_t
 app_help_get_keygrip_string (ksba_cert_t cert, char *hexkeygrip,
                              gcry_sexp_t *r_pkey, int *r_algo)
 {
   gpg_error_t err;
   ksba_sexp_t p;
   size_t n;
 
   if (r_pkey)
     *r_pkey = NULL;
 
   p = ksba_cert_get_public_key (cert);
   if (!p)
     return gpg_error (GPG_ERR_BUG);
   n = gcry_sexp_canon_len (p, 0, NULL, NULL);
   if (!n)
     return gpg_error (GPG_ERR_INV_SEXP);
   err = app_help_get_keygrip_string_pk ((void*)p, n, hexkeygrip,
-                                        r_pkey, r_algo);
+                                        r_pkey, r_algo, NULL);
   ksba_free (p);
   return err;
 }
 
 
 gpg_error_t
 app_help_pubkey_from_cert (const void *cert, size_t certlen,
                            unsigned char **r_pk, size_t *r_pklen)
 {
   gpg_error_t err;
   ksba_cert_t kc;
   unsigned char *pk;
   size_t pklen;
 
   *r_pk = NULL;
   *r_pklen = 0;
 
   err = ksba_cert_new (&kc);
   if (err)
     return err;
 
   err = ksba_cert_init_from_mem (kc, cert, certlen);
   if (err)
     goto leave;
 
   pk = ksba_cert_get_public_key (kc);
   if (!pk)
     {
       err = gpg_error (GPG_ERR_NO_PUBKEY);
       goto leave;
     }
   pklen = gcry_sexp_canon_len (pk, 0, NULL, &err);
 
  leave:
   if (!err)
     {
       *r_pk = pk;
       *r_pklen = pklen;
     }
   else
     ksba_free (pk);
   ksba_cert_release (kc);
   return err;
 }
 
 /* Given the SLOT and the File ID FID, return the length of the
    certificate contained in that file. Returns 0 if the file does not
    exists or does not contain a certificate.  If R_CERTOFF is not
    NULL, the length the header will be stored at this address; thus to
    parse the X.509 certificate a read should start at that offset.
 
    On success the file is still selected.
 */
 size_t
 app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff)
 {
   gpg_error_t err;
   unsigned char *buffer;
   const unsigned char *p;
   size_t buflen, n;
   int class, tag, constructed, ndef;
   size_t resultlen, objlen, hdrlen;
 
   err = iso7816_select_file (slot, fid, 0);
   if (err)
     {
       log_info ("error selecting FID 0x%04X: %s\n", fid, gpg_strerror (err));
       return 0;
     }
 
   err = iso7816_read_binary (slot, 0, 32, &buffer, &buflen);
   if (err)
     {
       log_info ("error reading certificate from FID 0x%04X: %s\n",
                  fid, gpg_strerror (err));
       return 0;
     }
 
   if (!buflen || *buffer == 0xff)
     {
       log_info ("no certificate contained in FID 0x%04X\n", fid);
       xfree (buffer);
       return 0;
     }
 
   p = buffer;
   n = buflen;
   err = parse_ber_header (&p, &n, &class, &tag, &constructed,
                           &ndef, &objlen, &hdrlen);
   if (err)
     {
       log_info ("error parsing certificate in FID 0x%04X: %s\n",
                 fid, gpg_strerror (err));
       xfree (buffer);
       return 0;
     }
 
   /* All certificates should commence with a SEQUENCE except for the
      special ROOT CA which are enclosed in a SET. */
   if ( !(class == CLASS_UNIVERSAL &&  constructed
          && (tag == TAG_SEQUENCE || tag == TAG_SET)))
     {
       log_info ("data at FID 0x%04X does not look like a certificate\n", fid);
       return 0;
     }
 
   resultlen = objlen + hdrlen;
   if (r_certoff)
     {
       /* The callers want the offset to the actual certificate. */
       *r_certoff = hdrlen;
 
       err = parse_ber_header (&p, &n, &class, &tag, &constructed,
                               &ndef, &objlen, &hdrlen);
       if (err)
         return 0;
 
       if (class == CLASS_UNIVERSAL && tag == TAG_OBJECT_ID && !constructed)
         {
           /* The certificate seems to be contained in a
              userCertificate container.  Assume the following sequence
              is the certificate. */
           *r_certoff += hdrlen + objlen;
           if (*r_certoff > resultlen)
             {
               *r_certoff = 0;
               return 0; /* That should never happen. */
             }
         }
       else
         *r_certoff = 0;
     }
 
   return resultlen;
 }
diff --git a/scd/app-nks.c b/scd/app-nks.c
index 5d326cb37..47be7cd85 100644
--- a/scd/app-nks.c
+++ b/scd/app-nks.c
@@ -1,2327 +1,2358 @@
 /* app-nks.c - The Telesec NKS card application.
  * Copyright (C) 2004, 2007-2009 Free Software Foundation, Inc.
  * Copyright (C) 2004, 2007-2009, 2013-2015, 2020 g10 Code GmbH
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 /* Notes:
  *
  * - We are now targeting TCOS 3 cards and it may happen that there is
  *   a regression towards TCOS 2 cards.  Please report.
  *
  * - The NKS3 AUT key is not used.  It seems that it is only useful for
  *   the internal authentication command and not accessible by other
  *   applications.  The key itself is in the encryption class but the
  *   corresponding certificate has only the digitalSignature
  *   capability.
  *   Update: This changed for the Signature Card V2 (nks version 15)
  *
  * - If required, we automagically switch between the NKS application
  *   and the SigG or eSign application.  This avoids to use the DINSIG
  *   application which is somewhat limited, has no support for Secure
  *   Messaging as required by TCOS 3 and has no way to change the PIN
  *   or even set the NullPIN.  With the Signature Card v2 (nks version
  *   15) the Esign application is used instead of the SigG.
  *
  * - We use the prefix NKS-DF01 for TCOS 2 cards and NKS-NKS3 for newer
  *   cards.  This is because the NKS application has moved to DF02 with
  *   TCOS 3 and thus we better use a DF independent tag.
  *
  * - We use only the global PINs for the NKS application.
  *
  *
  *
  * Here is a table with PIN stati collected from 3 cards.
  *
  *  | app | pwid | NKS3      | SIG_B     | SIG_N     |
  *  |-----+------+-----------+-----------+-----------|
  *  | NKS | 0x00 | null -    | -    -    | -    -    |
  *  |     | 0x01 | 0    3    | -    -    | -    -    |
  *  |     | 0x02 | 3    null | 15   3    | 15   null |
  *  |     | 0x03 | -    3    | null -    | 3    -    |
  *  |     | 0x04 |           | null 0    | 3    3    |
  *  | SIG | 0x00 | null -    | -    -    | -    -    |
  *  |     | 0x01 | 0    null | -    null | -    null |
  *  |     | 0x02 | 3    null | 15   0    | 15   0    |
  *  |     | 0x03 | -    0    | null null | null null |
  *  - SIG is either SIGG or ESIGN.
  *  - "-" indicates reference not found (SW 6A88).
  *  - "null" indicates a NULLPIN (SW 6985).
  *  - The first value in each cell is the global PIN;
  *    the second is the local PIN (high bit of pwid set).
  *  - The NKS3 card is some older test card.
  *  - The SIG_B is a Signature Card V2.0 with Brainpool curves.
  *    Here the PIN 0x82 has been changed from the NULLPIN.
  *  - The SIG_N is a Signature Card V2.0 with NIST curves.
  *    The PIN was enabled using the TCOS Windows tool.
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
 
 #include "scdaemon.h"
 #include "../common/i18n.h"
 #include "iso7816.h"
 #include "../common/tlv.h"
 #include "apdu.h"
 #include "../common/host2net.h"
 
 static char const aid_nks[]  = { 0xD2, 0x76, 0x00, 0x00, 0x03, 0x01, 0x02 };
 static char const aid_sigg[] = { 0xD2, 0x76, 0x00, 0x00, 0x66, 0x01 };
 static char const aid_esign[] =
   { 0xA0, 0x00, 0x00, 0x01, 0x67, 0x45, 0x53, 0x49, 0x47, 0x4E };
 static char const aid_idlm[] = { 0xD2, 0x76, 0x00, 0x00, 0x03, 0x0c, 0x01 };
 
 
 /* The ids of the different apps on our TCOS cards.  */
 #define NKS_APP_NKS   0
 #define NKS_APP_SIGG  1
 #define NKS_APP_ESIGN 2
 #define NKS_APP_IDLM  3
 
 
 static struct
 {
   int nks_app_id;/* One of the NKS_APP_ constants.  */
   int fid;       /* File ID. */
   int nks_ver;   /* 0 for NKS version 2, 3 for version 3, etc.  */
   int certtype;  /* Type of certificate or 0 if it is not a certificate. */
   int iskeypair; /* If true has the FID of the corresponding certificate. */
   int isauthkey; /* True if file is a key usable for authentication. */
   int issignkey; /* True if file is a key usable for signing. */
   int isencrkey; /* True if file is a key usable for decryption. */
   unsigned char kid;  /* Corresponding key references.  */
 } filelist[] = {
   { 0, 0x4531, 0, 0,  0xC000, 1,1,0, 0x80}, /* EF_PK.NKS.SIG */
   /* */                              /* nks15: EF.PK.NKS.ADS */
   { 0, 0xC000, 0, 101 },                    /* EF_C.NKS.SIG  */
   /* */                              /* nks15: EF.C.ICC.ADS  (sign key)  */
 
   { 0, 0x4331, 0, 100 },                    /* Unnamed.                  */
   /* */                              /* nks15: EF.C.ICC.RFU1             */
   /* */                              /* (second cert for sign key)       */
 
   { 0, 0x4332, 0, 100 },
   { 0, 0xB000, 0, 110 },                    /* EF_PK.RCA.NKS             */
 
   { 0, 0x45B1, 0, 0,  0xC200, 0,0,1, 0x81}, /* EF_PK.NKS.ENC             */
   /* */                              /* nks15: EF.PK.ICC.ENC1            */
   { 0, 0xC200, 0, 101 },                    /* EF_C.NKS.ENC              */
                                      /* nks15: EF.C.ICC.ENC1 (Cert-encr) */
 
   { 0, 0x43B1, 0, 100 },                    /* Unnamed */
   /* */                              /* nks15: EF.C.ICC.RFU2             */
   /* */                              /* (second cert for enc1 key)       */
 
   { 0, 0x43B2, 0, 100 },
   { 0, 0x4371,15, 100 },                    /* EF.C.ICC.RFU3             */
   /* */                              /* (second cert for auth key)       */
 
   { 0, 0x45B2, 3, 0,  0xC201, 0,0,1, 0x83}, /* EF_PK.NKS.ENC1024         */
   /* */                              /* nks15: EF.PK.ICC.ENC2            */
   { 0, 0xC201, 3, 101 },                    /* EF_C.NKS.ENC1024  */
 
   { 0, 0xC20E,15, 111 },                    /* EF.C.CSP.RCA1 (RootCA 1) */
   { 0, 0xC208,15, 101 },                    /* EF.C.CSP.SCA1 (SubCA 1) */
   { 0, 0xC10E,15, 111 },                    /* EF.C.CSP.RCA2 (RootCA 2) */
   { 0, 0xC108,15, 101 },                    /* EF.C.CSP.SCA2 (SubCA 2) */
 
   { 0, 0x4571,15, 0,  0xC500, 1,0,0, 0x82}, /* EF.PK.ICC.AUT */
   { 0, 0xC500,15, 101 },                    /* EF.C.ICC.AUT  (Cert-auth) */
 
   { 0, 0xC201,15, 101 },                    /* EF.C.ICC.ENC2 (Cert-encr) */
                                             /* (empty on delivery) */
 
   { 1, 0x4531, 3, 0,  0xC000, 0,1,1, 0x84}, /* EF_PK.CH.SIG  */
   { 1, 0xC000, 0, 101 },                    /* EF_C.CH.SIG  */
 
   { 1, 0xC008, 3, 101 },                    /* EF_C.CA.SIG  */
   { 1, 0xC00E, 3, 111 },                    /* EF_C.RCA.SIG  */
 
   { 2, 0x4531, 15, 0, 0xC001, 0,1,1, 0x84}, /* EF_PK.CH.SIG  */
   { 2, 0xC000, 15,101 },                    /* EF.C.SCA.QES (SubCA) */
   { 2, 0xC001, 15,100 },                    /* EF.C.ICC.QES (Cert)  */
   { 2, 0xC00E, 15,111 },                    /* EF.C.RCA.QES (RootCA */
 
   { 3, 0x4E03,  3, 100 },                   /* EK_PK_03 */
   { 3, 0x4E04,  3, 100 },                   /* EK_PK_04 */
   { 3, 0x4E05,  3, 100 },                   /* EK_PK_05 */
   { 3, 0x4E06,  3, 100 },                   /* EK_PK_06 */
   { 3, 0x4E07,  3, 100 },                   /* EK_PK_07 */
   { 3, 0x4E08,  3, 100 },                   /* EK_PK_08 */
 
   { 0, 0 }
 };
 
 
 /* Object to cache information gathered from FIDs. */
 struct fid_cache_s {
   struct fid_cache_s *next;
   int fid;                          /* Zero for an unused slot.  */
   unsigned int  got_keygrip:1;      /* The keygrip and algo are valid.  */
   int algo;
+  char *algostr;                    /* malloced.  */
   char keygripstr[2*KEYGRIP_LEN+1];
 };
 
 
 /* Object with application (i.e. NKS) specific data.  */
 struct app_local_s {
   int active_nks_app;   /* One of the NKS_APP_ constants.  */
 
   int only_idlm;        /* The application is fixed to IDLM (IDKey card).  */
   int qes_app_id;       /* Either NKS_APP_SIGG or NKS_APP_ESIGN.  */
 
   int sigg_msig_checked;/* True if we checked for a mass signature card.  */
   int sigg_is_msig;     /* True if this is a mass signature card.  */
 
   int need_app_select;  /* Need to re-select the application.  */
 
   struct fid_cache_s *fid_cache; /* Linked list with cached infos.  */
 };
 
 
 
 static gpg_error_t readcert_from_ef (app_t app, int fid,
                                      unsigned char **cert, size_t *certlen);
 static gpg_error_t switch_application (app_t app, int nks_app_id);
 static const char *parse_pwidstr (app_t app, const char *pwidstr, int new_mode,
                                   int *r_nks_app_id, int *r_pwid);
 static gpg_error_t verify_pin (app_t app, int pwid, const char *desc,
                                gpg_error_t (*pincb)(void*, const char *,
                                                     char **),
                                void *pincb_arg);
 
 
 
 static void
 flush_fid_cache (app_t app)
 {
   while (app->app_local->fid_cache)
     {
       struct fid_cache_s *next = app->app_local->fid_cache->next;
+      if (app->app_local->fid_cache)
+        xfree (app->app_local->fid_cache->algostr);
       xfree (app->app_local->fid_cache);
       app->app_local->fid_cache = next;
     }
 }
 
 /* Release local data. */
 static void
 do_deinit (app_t app)
 {
   if (app && app->app_local)
     {
       flush_fid_cache (app);
       xfree (app->app_local);
       app->app_local = NULL;
     }
 }
 
 
 static int
 all_zero_p (void *buffer, size_t length)
 {
   char *p;
 
   for (p=buffer; length; length--, p++)
     if (*p)
       return 0;
   return 1;
 }
 
 
 /* Return an allocated string with the serial number in a format to be
  * show to the user.  May return NULL on malloc problem.  */
 static char *
 get_dispserialno (app_t app)
 {
   char *result;
 
   /* We only need to strip the last zero which is not printed on the
    * card.  */
   result = app_get_serialno (app);
   if (result && *result && result[strlen(result)-1] == '0')
     result[strlen(result)-1] = 0;
   return result;
 }
 
 
 /* Read the file with PKFID, assume it contains a public key and
  * return its keygrip in the caller provided 41 byte buffer R_GRIPSTR.
  * This works only for RSA card.  For the Signature Card v2 ECC is
  * used and Read Record needs to be replaced by read binary.  Given
  * all the ECC parameters required, we don't do that but rely that the
  * corresponding certificate at CFID is already available and get the
  * public key from there.  If R_ALGO is not NULL the public key
- * algorithm for the returned KEYGRIP is stored there.  */
+ * algorithm for the returned KEYGRIP is stored there.  If R_ALGOSTR
+ * is not NULL the public key algo string (e.g. "rsa2048") is stored
+ * there.  */
 static gpg_error_t
 keygripstr_from_pk_file (app_t app, int pkfid, int cfid, char *r_gripstr,
-                         int *r_algo)
+                         int *r_algo, char **r_algostr)
 {
   gpg_error_t err;
   unsigned char grip[20];
   unsigned char *buffer[2];
   size_t buflen[2];
   gcry_sexp_t sexp = NULL;
   int algo = 0;  /* Public key algo.  */
+  char *algostr = NULL; /* Public key algo string.  */
   int i;
   int offset[2] = { 0, 0 };
   struct fid_cache_s *ci;
 
   for (ci = app->app_local->fid_cache; ci; ci = ci->next)
     if (ci->fid && ci->fid == pkfid)
       {
         if (!ci->got_keygrip)
           return gpg_error (GPG_ERR_NOT_FOUND);
+        if (r_algostr && !ci->algostr)
+          break;  /* Not in the cache - try w/o cache.  */
         memcpy (r_gripstr, ci->keygripstr, 2*KEYGRIP_LEN+1);
         if (r_algo)
           *r_algo = ci->algo;
+        if (r_algostr)
+          {
+            *r_algostr = xtrystrdup (ci->algostr);
+            if (!*r_algostr)
+              return gpg_error_from_syserror ();
+          }
         return 0;  /* Found in cache.  */
       }
 
   if (app->appversion == 15)
     {
       /* Signature Card v2 - get keygrip from the certificate.  */
       unsigned char *cert, *pk;
       size_t certlen, pklen;
 
       /* Fall back to certificate reading.  */
       err = readcert_from_ef (app, cfid, &cert, &certlen);
       if (err)
         {
           log_error ("nks: error reading certificate %04X: %s\n",
                      cfid, gpg_strerror (err));
-          return err;
+          goto leave;
         }
 
       err = app_help_pubkey_from_cert (cert, certlen, &pk, &pklen);
       xfree (cert);
       if (err)
         {
           log_error ("nks: error parsing certificate %04X: %s\n",
                      cfid, gpg_strerror (err));
-          return err;
+          goto leave;
         }
 
-      err = app_help_get_keygrip_string_pk (pk, pklen, r_gripstr, NULL, &algo);
+      err = app_help_get_keygrip_string_pk (pk, pklen, r_gripstr, NULL,
+                                            &algo, &algostr);
       xfree (pk);
       if (err)
         log_error ("nks: error getting keygrip for certificate %04X: %s\n",
                    cfid, gpg_strerror (err));
 
       goto leave;
     }
 
   err = iso7816_select_file (app_get_slot (app), pkfid, 0);
   if (err)
-    return err;
+    goto leave;
   err = iso7816_read_record (app_get_slot (app), 1, 1, 0,
                              &buffer[0], &buflen[0]);
   if (err)
-    return err;
+    goto leave;
   err = iso7816_read_record (app_get_slot (app), 2, 1, 0,
                              &buffer[1], &buflen[1]);
   if (err)
     {
       xfree (buffer[0]);
-      return err;
+      goto leave;
     }
 
   if (app->appversion < 3)
     {
       /* Old versions of NKS store the values in a TLV encoded format.
          We need to do some checks.  */
       for (i=0; i < 2; i++)
         {
           /* Check that the value appears like an integer encoded as
              Simple-TLV.  We don't check the tag because the tests cards I
              have use 1 for both, the modulus and the exponent - the
              example in the documentation gives 2 for the exponent. */
           if (buflen[i] < 3)
             err = gpg_error (GPG_ERR_TOO_SHORT);
           else if (buffer[i][1] != buflen[i]-2 )
             err = gpg_error (GPG_ERR_INV_OBJ);
           else
             offset[i] = 2;
         }
     }
   else
     {
       /* Remove leading zeroes to get a correct keygrip.  Take care of
          negative numbers.  We should also fix it the same way in
          libgcrypt but we can't yet rely on it yet.  */
       for (i=0; i < 2; i++)
         {
           while (buflen[i]-offset[i] > 1
                  && !buffer[i][offset[i]]
                  && !(buffer[i][offset[i]+1] & 0x80))
             offset[i]++;
         }
     }
 
   /* Check whether negative values are not prefixed with a zero and
      fix that.  */
   for (i=0; i < 2; i++)
     {
       if ((buflen[i]-offset[i]) && (buffer[i][offset[i]] & 0x80))
         {
           unsigned char *newbuf;
           size_t newlen;
 
           newlen = 1 + buflen[i] - offset[i];
           newbuf = xtrymalloc (newlen);
           if (!newlen)
             {
               xfree (buffer[0]);
               xfree (buffer[1]);
-              return gpg_error_from_syserror ();
+              err = gpg_error_from_syserror ();
+              goto leave;
             }
           newbuf[0] = 0;
           memcpy (newbuf+1, buffer[i]+offset[i], buflen[i] - offset[i]);
           xfree (buffer[i]);
           buffer[i] = newbuf;
           buflen[i] = newlen;
           offset[i] = 0;
         }
     }
 
   algo = GCRY_PK_RSA;
   if (!err)
     err = gcry_sexp_build (&sexp, NULL,
                            "(public-key (rsa (n %b) (e %b)))",
                            (int)buflen[0]-offset[0], buffer[0]+offset[0],
                            (int)buflen[1]-offset[1], buffer[1]+offset[1]);
 
   xfree (buffer[0]);
   xfree (buffer[1]);
   if (err)
     return err;
 
   if (!gcry_pk_get_keygrip (sexp, grip))
     {
       err = gpg_error (GPG_ERR_INTERNAL); /* i.e. RSA not supported by
                                              libgcrypt. */
     }
   else
     {
       bin2hex (grip, 20, r_gripstr);
       if (r_algo)
         *r_algo = algo;
     }
 
 
  leave:
   if (!err)
     {
+      if (r_algostr)
+        {
+          *r_algostr = algostr;
+          algostr = NULL;
+        }
+
       /* FIXME: We need to implement not_found caching.  */
       for (ci = app->app_local->fid_cache; ci; ci = ci->next)
         if (ci->fid && ci->fid == pkfid)
           {
             /* Update the keygrip.  */
             memcpy (ci->keygripstr, r_gripstr, 2*KEYGRIP_LEN+1);
             ci->algo = algo;
+            xfree (ci->algostr);
+            ci->algostr = algostr? xtrystrdup (algostr) : NULL;
             ci->got_keygrip = 1;
             break;
           }
       if (!ci)
         {
           for (ci = app->app_local->fid_cache; ci; ci = ci->next)
             if (!ci->fid)
               break;
           if (!ci)
             ci = xtrycalloc (1, sizeof *ci);
           if (!ci)
             ; /* Out of memory - it is a cache, so we ignore it.  */
           else
             {
               ci->fid = pkfid;
               memcpy (ci->keygripstr, r_gripstr, 2*KEYGRIP_LEN+1);
               ci->algo = algo;
               ci->got_keygrip = 1;
               ci->next = app->app_local->fid_cache;
               app->app_local->fid_cache = ci;
             }
         }
     }
   gcry_sexp_release (sexp);
+  xfree (algostr);
   return err;
 }
 
 
 /* Parse KEYREF and return the index into the FILELIST at R_IDX.
  * Returns 0 on success and switches to the requested application.
  * The public key algo is stored at R_ALGO unless it is NULL.  */
 static gpg_error_t
 find_fid_by_keyref (app_t app, const char *keyref, int *r_idx, int *r_algo)
 {
   gpg_error_t err;
   int idx, fid, nks_app_id;
   char keygripstr[2*KEYGRIP_LEN+1];
 
   if (!keyref || !keyref[0])
     err = gpg_error (GPG_ERR_INV_ID);
   else if (keyref[0] != 'N' && strlen (keyref) == 40)  /* This is a keygrip.  */
     {
       struct fid_cache_s *ci;
 
       for (ci = app->app_local->fid_cache; ci; ci = ci->next)
         if (ci->fid && ci->got_keygrip && !strcmp (ci->keygripstr, keyref))
           break;
       if (ci) /* Cached */
         {
           for (idx=0; filelist[idx].fid; idx++)
             if (filelist[idx].fid == ci->fid)
               break;
           if (!filelist[idx].fid)
             {
               log_debug ("nks: Ooops: Unkown FID cached!\n");
               err = gpg_error (GPG_ERR_BUG);
               goto leave;
             }
           err = switch_application (app, filelist[idx].nks_app_id);
           if (err)
             goto leave;
           if (r_algo)
             *r_algo = ci->algo;
         }
       else  /* Not cached.  */
         {
           for (idx=0; filelist[idx].fid; idx++)
             {
               if (!filelist[idx].iskeypair)
                 continue;
 
               if (app->app_local->only_idlm)
                 {
                   if (filelist[idx].nks_app_id != NKS_APP_IDLM)
                     continue;
                 }
               else
                 {
                   if (filelist[idx].nks_app_id != NKS_APP_NKS
                       && filelist[idx].nks_app_id != app->app_local->qes_app_id)
                     continue;
 
                   err = switch_application (app, filelist[idx].nks_app_id);
                   if (err)
                     goto leave;
                 }
 
               err = keygripstr_from_pk_file (app, filelist[idx].fid,
                                              filelist[idx].iskeypair,
-                                             keygripstr, r_algo);
+                                             keygripstr, r_algo, NULL);
               if (err)
                 {
                   log_info ("nks: no keygrip for FID 0x%04X: %s - ignored\n",
                             filelist[idx].fid, gpg_strerror (err));
                   continue;
                 }
               if (!strcmp (keygripstr, keyref))
                 break; /* Found */
             }
           if (!filelist[idx].fid)
             {
               err = gpg_error (GPG_ERR_NOT_FOUND);
               goto leave;
             }
           /* (No need to switch the app as that has already been done
            * in the loop.)  */
         }
       *r_idx = idx;
       err = 0;
     }
   else /* This is a usual keyref.  */
     {
       if (!ascii_strncasecmp (keyref, "NKS-NKS3.", 9))
         nks_app_id = NKS_APP_NKS;
       else if (!ascii_strncasecmp (keyref, "NKS-ESIGN.", 10)
                && app->app_local->qes_app_id == NKS_APP_ESIGN)
         nks_app_id = NKS_APP_ESIGN;
       else if (!ascii_strncasecmp (keyref, "NKS-SIGG.", 9)
                && app->app_local->qes_app_id == NKS_APP_SIGG)
         nks_app_id = NKS_APP_SIGG;
       else if (!ascii_strncasecmp (keyref, "NKS-IDLM.", 9))
         nks_app_id = NKS_APP_IDLM;
       else if (!ascii_strncasecmp (keyref, "NKS-DF01.", 9))
         nks_app_id = NKS_APP_NKS;
       else
         {
           err = gpg_error (GPG_ERR_INV_ID);
           goto leave;
         }
       keyref += nks_app_id == NKS_APP_ESIGN? 10 : 9;
 
       if (!hexdigitp (keyref) || !hexdigitp (keyref+1)
           || !hexdigitp (keyref+2) || !hexdigitp (keyref+3)
           || keyref[4])
         {
           err = gpg_error (GPG_ERR_INV_ID);
           goto leave;
         }
       fid = xtoi_4 (keyref);
       for (idx=0; filelist[idx].fid; idx++)
         if (filelist[idx].iskeypair && filelist[idx].fid == fid
             && filelist[idx].nks_app_id == nks_app_id)
           break;
       if (!filelist[idx].fid)
         {
           err = gpg_error (GPG_ERR_NOT_FOUND);
           goto leave;
         }
       *r_idx = idx;
 
       err = switch_application (app, nks_app_id);
       if (err)
         goto leave;
       if (r_algo)
         {
           /* We need to get the public key algo.  */
           err = keygripstr_from_pk_file (app, filelist[idx].fid,
                                          filelist[idx].iskeypair,
-                                         keygripstr, r_algo);
+                                         keygripstr, r_algo, NULL);
           if (err)
             log_error ("nks: no keygrip for FID 0x%04X: %s\n",
                        filelist[idx].fid, gpg_strerror (err));
         }
     }
 
  leave:
   return err;
 }
 
 
 /* TCOS responds to a verify with empty data (i.e. without the Lc
  * byte) with the status of the PIN.  PWID is the PIN ID. NKS_APP_ID
  * gives the application to first switch to.  Returns:
  * ISO7816_VERIFY_* codes or non-negative number of verification
  * attempts left.  */
 static int
 get_chv_status (app_t app, int nks_app_id, int pwid)
 {
   if (switch_application (app, nks_app_id))
     return (nks_app_id == NKS_APP_NKS
             ? ISO7816_VERIFY_ERROR
             : ISO7816_VERIFY_NO_PIN);
 
   return iso7816_verify_status (app_get_slot (app), pwid);
 }
 
 
 /* Implement the GETATTR command.  This is similar to the LEARN
    command but returns just one value via the status interface. */
 static gpg_error_t
 do_getattr (app_t app, ctrl_t ctrl, const char *name)
 {
   static struct {
     const char *name;
     int special;
   } table[] = {
     { "$AUTHKEYID",   1 },
     { "$ENCRKEYID",   2 },
     { "$SIGNKEYID",   3 },
     { "NKS-VERSION",  4 },  /* Legacy (printed decimal)  */
     { "CHV-STATUS",   5 },
     { "$DISPSERIALNO",6 },
     { "SERIALNO",     0 }
   };
   gpg_error_t err = 0;
   int idx;
   char *p, *p2;
   char buffer[100];
   int nksver = app->appversion;
 
   err = switch_application (app, NKS_APP_NKS);
   if (err)
     return err;
 
   for (idx=0; (idx < DIM(table)
                && ascii_strcasecmp (table[idx].name, name)); idx++)
     ;
   if (!(idx < DIM (table)))
     return gpg_error (GPG_ERR_INV_NAME);
 
   switch (table[idx].special)
     {
     case 0: /* SERIALNO */
       {
         p = app_get_serialno (app);
         if (p)
           {
             send_status_direct (ctrl, "SERIALNO", p);
             xfree (p);
           }
       }
       break;
 
     case 1: /* $AUTHKEYID */
       {
         /* NetKey 3.0 cards define an authentication key but according
            to the specs this key is only usable for encryption and not
            signing.  it might work anyway but it has not yet been
            tested - fixme.  Thus for now we use the NKS signature key
            for authentication for netkey 3.  For the Signature Card
            V2.0 the auth key is defined and thus we use it. */
         const char *tmp = nksver == 15? "NKS-NKS3.4571" : "NKS-NKS3.4531";
         send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       }
       break;
 
     case 2: /* $ENCRKEYID */
       {
         char const tmp[] = "NKS-NKS3.45B1";
         send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       }
       break;
 
     case 3: /* $SIGNKEYID */
       {
         char const tmp[] = "NKS-NKS3.4531";
         send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       }
       break;
 
     case 4: /* NKS-VERSION */
       snprintf (buffer, sizeof buffer, "%d", app->appversion);
       send_status_info (ctrl, table[idx].name,
                         buffer, strlen (buffer), NULL, 0);
       break;
 
     case 5: /* CHV-STATUS */
       {
         /* Return the status for the the PINs as described in the
          * table below.  See the macros ISO7816_VERIFY_* for a list
          * for each slot.  The order is
          *
          * | idx | name       |
          * |-----+------------|
          * |   0 | PW1.CH     |
          * |   1 | PW2.CH     |
          * |   2 | PW1.CH.SIG |
          * |   3 | PW2.CH.SIG |
          *
          * See parse_pwidstr for details of the mapping.
          */
         int tmp[4];
 
         /* We use a helper array so that we can control that there is
          * no superfluous application switches.  */
         if (app->appversion == 15)
           {
             tmp[0] = get_chv_status (app, 0, 0x03);
             tmp[1] = get_chv_status (app, 0, 0x04);
           }
         else
           {
             tmp[0] = get_chv_status (app, 0, 0x00);
             tmp[1] = get_chv_status (app, 0, 0x01);
           }
         tmp[2] = get_chv_status (app, app->app_local->qes_app_id, 0x81);
         if (app->appversion == 15)
           tmp[3] = get_chv_status (app, app->app_local->qes_app_id, 0x82);
         else
           tmp[3] = get_chv_status (app, app->app_local->qes_app_id, 0x83);
         snprintf (buffer, sizeof buffer, "%d %d %d %d",
                   tmp[0], tmp[1], tmp[2], tmp[3]);
         send_status_info (ctrl, table[idx].name,
                           buffer, strlen (buffer), NULL, 0);
       }
       break;
 
     case 6: /* $DISPSERIALNO */
       {
         p = app_get_serialno (app);
         p2 = get_dispserialno (app);
         if (p && p2 && strcmp (p, p2))
           send_status_info (ctrl, table[idx].name, p2, strlen (p2),
                             NULL, (size_t)0);
         else /* No abbreviated S/N or identical to the full full S/N.  */
           err = gpg_error (GPG_ERR_INV_NAME);  /* No Abbreviated S/N.  */
         xfree (p);
         xfree (p2);
       }
       break;
 
     default:
       err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
       break;
     }
 
   return err;
 }
 
 
 
 static void
 do_learn_status_core (app_t app, ctrl_t ctrl, unsigned int flags,
                       int nks_app_id)
 {
   gpg_error_t err;
   char ct_buf[100], id_buf[100];
   int i;
   const char *tag;
 
   if (nks_app_id == NKS_APP_ESIGN)
     tag = "ESIGN";
   else if (nks_app_id == NKS_APP_SIGG)
     tag = "SIGG";
   else if (nks_app_id == NKS_APP_IDLM)
     tag = "IDLM";
   else if (app->appversion < 3)
     tag = "DF01";
   else
     tag = "NKS3";
 
   /* Output information about all useful objects in the NKS application. */
   for (i=0; filelist[i].fid; i++)
     {
       if (filelist[i].nks_ver > app->appversion)
         continue;
 
       if (filelist[i].nks_app_id != nks_app_id)
         continue;
 
       if (filelist[i].certtype && !(flags & APP_LEARN_FLAG_KEYPAIRINFO))
         {
           size_t len;
 
           len = app_help_read_length_of_cert (app_get_slot (app),
                                               filelist[i].fid, NULL);
           if (len)
             {
               /* FIXME: We should store the length in the application's
                  context so that a following readcert does only need to
                  read that many bytes. */
               snprintf (ct_buf, sizeof ct_buf, "%d", filelist[i].certtype);
               snprintf (id_buf, sizeof id_buf, "NKS-%s.%04X",
                         tag, filelist[i].fid);
               send_status_info (ctrl, "CERTINFO",
                                 ct_buf, strlen (ct_buf),
                                 id_buf, strlen (id_buf),
                                 NULL, (size_t)0);
             }
         }
       else if (filelist[i].iskeypair)
         {
           char gripstr[40+1];
           char usagebuf[5];
           int usageidx = 0;
+          char *algostr = NULL;
 
           err = keygripstr_from_pk_file (app, filelist[i].fid,
-                                         filelist[i].iskeypair, gripstr, NULL);
+                                         filelist[i].iskeypair, gripstr,
+                                         NULL, &algostr);
           if (err)
             log_error ("can't get keygrip from FID 0x%04X: %s\n",
                        filelist[i].fid, gpg_strerror (err));
           else
             {
               snprintf (id_buf, sizeof id_buf, "NKS-%s.%04X",
                         tag, filelist[i].fid);
               if (filelist[i].issignkey)
                 usagebuf[usageidx++] = 's';
               if (filelist[i].isauthkey)
                 usagebuf[usageidx++] = 'a';
               if (filelist[i].isencrkey)
                 usagebuf[usageidx++] = 'e';
               usagebuf[usageidx] = 0;
               send_status_info (ctrl, "KEYPAIRINFO",
                                 gripstr, 40,
                                 id_buf, strlen (id_buf),
                                 usagebuf, strlen (usagebuf),
+                                "-", (size_t)1,
+                                algostr, strlen (algostr),
                                 NULL, (size_t)0);
             }
+          xfree (algostr);
         }
     }
 }
 
 
 static gpg_error_t
 do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 {
   gpg_error_t err;
 
   do_getattr (app, ctrl, "CHV-STATUS");
 
   err = switch_application (app, NKS_APP_NKS);
   if (err)
     return err;
 
   do_learn_status_core (app, ctrl, flags, app->app_local->active_nks_app);
 
   if (app->app_local->only_idlm)
     return 0;  /* ready.  */
 
   err = switch_application (app, app->app_local->qes_app_id);
   if (err)
     return 0;  /* Silently ignore if we can't switch to SigG.  */
 
   do_learn_status_core (app, ctrl, flags, app->app_local->qes_app_id);
 
   return 0;
 }
 
 
 
 /* Helper to read a certificate from the file FID.  The function
  * assumes that the the application has already been selected.  */
 static gpg_error_t
 readcert_from_ef (app_t app, int fid, unsigned char **cert, size_t *certlen)
 {
   gpg_error_t err;
   unsigned char *buffer;
   const unsigned char *p;
   size_t buflen, n;
   int class, tag, constructed, ndef;
   size_t totobjlen, objlen, hdrlen;
   int rootca = 0;
 
   *cert = NULL;
   *certlen = 0;
 
   /* Read the entire file.  fixme: This could be optimized by first
      reading the header to figure out how long the certificate
      actually is. */
   err = iso7816_select_file (app_get_slot (app), fid, 0);
   if (err)
     {
       log_error ("nks: error selecting FID 0x%04X: %s\n",
                  fid, gpg_strerror (err));
       return err;
     }
 
   err = iso7816_read_binary (app_get_slot (app), 0, 0, &buffer, &buflen);
   if (err)
     {
       log_error ("nks: error reading certificate from FID 0x%04X: %s\n",
                  fid, gpg_strerror (err));
       return err;
     }
 
   if (!buflen || *buffer == 0xff)
     {
       log_info ("nks: no certificate contained in FID 0x%04X\n", fid);
       err = gpg_error (GPG_ERR_NOT_FOUND);
       goto leave;
     }
 
   /* Now figure something out about the object. */
   p = buffer;
   n = buflen;
   err = parse_ber_header (&p, &n, &class, &tag, &constructed,
                           &ndef, &objlen, &hdrlen);
   if (err)
     goto leave;
   if ( class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed )
     ;
   else if ( class == CLASS_UNIVERSAL && tag == TAG_SET && constructed )
     rootca = 1;
   else
     return gpg_error (GPG_ERR_INV_OBJ);
   totobjlen = objlen + hdrlen;
   log_assert (totobjlen <= buflen);
 
   err = parse_ber_header (&p, &n, &class, &tag, &constructed,
                           &ndef, &objlen, &hdrlen);
   if (err)
     goto leave;
 
   if (rootca)
     ;
   else if (class == CLASS_UNIVERSAL && tag == TAG_OBJECT_ID && !constructed)
     {
       const unsigned char *save_p;
 
       /* The certificate seems to be contained in a userCertificate
          container.  Skip this and assume the following sequence is
          the certificate. */
       if (n < objlen)
         {
           err = gpg_error (GPG_ERR_INV_OBJ);
           goto leave;
         }
       p += objlen;
       n -= objlen;
       save_p = p;
       err = parse_ber_header (&p, &n, &class, &tag, &constructed,
                               &ndef, &objlen, &hdrlen);
       if (err)
         goto leave;
       if ( !(class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed) )
         return gpg_error (GPG_ERR_INV_OBJ);
       totobjlen = objlen + hdrlen;
       log_assert (save_p + totobjlen <= buffer + buflen);
       memmove (buffer, save_p, totobjlen);
     }
 
   *cert = buffer;
   buffer = NULL;
   *certlen = totobjlen;
 
  leave:
   xfree (buffer);
   return err;
 }
 
 
 /* Read the certificate with id CERTID (as returned by learn_status in
    the CERTINFO status lines) and return it in the freshly allocated
    buffer put into CERT and the length of the certificate put into
    CERTLEN. */
 static gpg_error_t
 do_readcert (app_t app, const char *certid,
              unsigned char **cert, size_t *certlen)
 {
   int i, fid;
   gpg_error_t err;
   int nks_app_id;
 
   *cert = NULL;
   *certlen = 0;
 
   if (!strncmp (certid, "NKS-NKS3.", 9))
     nks_app_id = NKS_APP_NKS;
   else if (!strncmp (certid, "NKS-ESIGN.", 10))
     nks_app_id = NKS_APP_ESIGN;
   else if (!strncmp (certid, "NKS-SIGG.", 9))
     nks_app_id = NKS_APP_SIGG;
   else if (!strncmp (certid, "NKS-DF01.", 9))
     nks_app_id = NKS_APP_NKS;
   else if (!strncmp (certid, "NKS-IDLM.", 9))
     nks_app_id = NKS_APP_IDLM;
   else
     return gpg_error (GPG_ERR_INV_ID);
   certid += nks_app_id == NKS_APP_ESIGN? 10 : 9;
 
   err = switch_application (app, nks_app_id);
   if (err)
     return err;
 
   if (!hexdigitp (certid) || !hexdigitp (certid+1)
       || !hexdigitp (certid+2) || !hexdigitp (certid+3)
       || certid[4])
     return gpg_error (GPG_ERR_INV_ID);
   fid = xtoi_4 (certid);
   for (i=0; filelist[i].fid; i++)
     if ((filelist[i].certtype || filelist[i].iskeypair)
         && filelist[i].nks_app_id == nks_app_id
         && filelist[i].fid == fid)
       break;
   if (!filelist[i].fid)
     return gpg_error (GPG_ERR_NOT_FOUND);
 
   /* If the requested objects is a plain public key, redirect it to
      the corresponding certificate.  The whole system is a bit messy
      because we sometime use the key directly or let the caller
      retrieve the key from the certificate.  The rationale for
      that is to support not-yet stored certificates. */
   if (filelist[i].iskeypair)
     fid = filelist[i].iskeypair;
 
   return readcert_from_ef (app, fid, cert, certlen);
 }
 
 
 /* Handle the READKEY command. On success a canonical encoded
    S-expression with the public key will get stored at PK and its
    length at PKLEN; the caller must release that buffer.  On error PK
    and PKLEN are not changed and an error code is returned.  As of now
    this function is only useful for the internal authentication key.
    Other keys are automagically retrieved by means of the
    certificate parsing code in commands.c:cmd_readkey.  For internal
    use PK and PKLEN may be NULL to just check for an existing key.  */
 static gpg_error_t
 do_readkey (app_t app, ctrl_t ctrl, const char *keyid, unsigned int flags,
             unsigned char **pk, size_t *pklen)
 {
   gpg_error_t err;
   unsigned char *buffer[2];
   size_t buflen[2];
   unsigned short path[1] = { 0x4500 };
 
   /* We use a generic name to retrieve PK.AUT.IFD-SPK.  */
   if (!strcmp (keyid, "$IFDAUTHKEY") && app->appversion >= 3)
     ;
   else /* Return the error code expected by cmd_readkey.  */
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   /* Access the KEYD file which is always in the master directory.  */
   err = iso7816_select_path (app_get_slot (app), path, DIM (path));
   if (err)
     return err;
   /* Due to the above select we need to re-select our application.  */
   app->app_local->need_app_select = 1;
   /* Get the two records.  */
   err = iso7816_read_record (app_get_slot (app), 5, 1, 0,
                              &buffer[0], &buflen[0]);
   if (err)
     return err;
   if (all_zero_p (buffer[0], buflen[0]))
     {
       xfree (buffer[0]);
       return gpg_error (GPG_ERR_NOT_FOUND);
     }
   err = iso7816_read_record (app_get_slot (app), 6, 1, 0,
                              &buffer[1], &buflen[1]);
   if (err)
     {
       xfree (buffer[0]);
       return err;
     }
 
   if ((flags & APP_READKEY_FLAG_INFO))
     {
       /* Not yet implemented but we won't get here for any regular
        * keyrefs anyway, thus the top layer will provide the
        * keypairinfo from the certificate.  */
       (void)ctrl;
     }
 
   if (pk && pklen)
     {
       *pk = make_canon_sexp_from_rsa_pk (buffer[0], buflen[0],
                                          buffer[1], buflen[1],
                                          pklen);
       if (!*pk)
         err = gpg_error_from_syserror ();
     }
 
   xfree (buffer[0]);
   xfree (buffer[1]);
   return err;
 }
 
 
 /* Write the certificate (CERT,CERTLEN) to the card at CERTREFSTR.
  * CERTREFSTR is of the form "NKS_<yyy>.<four_hexdigit_keyref>". */
 static gpg_error_t
 do_writecert (app_t app, ctrl_t ctrl,
               const char *certid,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg,
               const unsigned char *cert, size_t certlen)
 {
   gpg_error_t err;
   int i, fid, pwid;
   int nks_app_id, tmp_app_id;
   const char *desc;
 
   (void)ctrl;
 
   if (!strncmp (certid, "NKS-NKS3.", 9))
     nks_app_id = NKS_APP_NKS;
   else if (!strncmp (certid, "NKS-ESIGN.", 10))
     nks_app_id = NKS_APP_ESIGN;
   else if (!strncmp (certid, "NKS-SIGG.", 9))
     nks_app_id = NKS_APP_SIGG;
   else if (!strncmp (certid, "NKS-DF01.", 9))
     nks_app_id = NKS_APP_NKS;
   else if (!strncmp (certid, "NKS-IDLM.", 9))
     nks_app_id = NKS_APP_IDLM;
   else
     return gpg_error (GPG_ERR_INV_ID);
   certid += nks_app_id == NKS_APP_ESIGN? 10 : 9;
 
   err = switch_application (app, nks_app_id);
   if (err)
     return err;
 
   if (!hexdigitp (certid) || !hexdigitp (certid+1)
       || !hexdigitp (certid+2) || !hexdigitp (certid+3)
       || certid[4])
     return gpg_error (GPG_ERR_INV_ID);
   fid = xtoi_4 (certid);
   for (i=0; filelist[i].fid; i++)
     if ((filelist[i].certtype || filelist[i].iskeypair)
         && filelist[i].nks_app_id == nks_app_id
         && filelist[i].fid == fid)
       break;
   if (!filelist[i].fid)
     return gpg_error (GPG_ERR_NOT_FOUND);
 
   /* If the requested objects is a plain public key, redirect it to
    * the corresponding certificate.  This makes it easier for the user
    * to figure out which CERTID to use.  For example gpg-card shows
    * the id of the key and not of the certificate.  */
   if (filelist[i].iskeypair)
     fid = filelist[i].iskeypair;
 
   /* We have no selective flush mechanism and given the rare use of
    * writecert it won't harm to flush the entire cache.  */
   flush_fid_cache (app);
 
 
   /* The certificates we support all require PW1.CH.  Note that we
    * check that the nks_app_id matches which sorts out CERTID values
    * which are subkecy to a different nks_app_id.  */
   desc = parse_pwidstr (app, "PW1.CH", 0, &tmp_app_id, &pwid);
   if (!desc || tmp_app_id != nks_app_id)
     return gpg_error (GPG_ERR_INV_ID);
   err = verify_pin (app, pwid, desc, pincb, pincb_arg);
   if (err)
     return err;
 
     /* Select the file and write the certificate.  */
   err = iso7816_select_file (app_get_slot (app), fid, 0);
   if (err)
     {
       log_error ("nks: error selecting FID 0x%04X: %s\n",
                  fid, gpg_strerror (err));
       return err;
     }
 
   err = iso7816_update_binary (app_get_slot (app), 1, 0, cert, certlen);
   if (err)
     {
       log_error ("nks: error updating certificate at FID 0x%04X: %s\n",
                  fid, gpg_strerror (err));
       return err;
     }
 
   return 0;
 }
 
 
 /* Handle the WRITEKEY command for NKS.  This function expects a
    canonical encoded S-expression with the public key in KEYDATA and
    its length in KEYDATALEN.  The only supported KEYID is
    "$IFDAUTHKEY" to store the terminal key on the card.  Bit 0 of
    FLAGS indicates whether an existing key shall get overwritten.
    PINCB and PINCB_ARG are the usual arguments for the pinentry
    callback.  */
 static gpg_error_t
 do_writekey (app_t app, ctrl_t ctrl,
              const char *keyid, unsigned int flags,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const unsigned char *keydata, size_t keydatalen)
 {
   gpg_error_t err;
   int force = (flags & 1);
   const unsigned char *rsa_n = NULL;
   const unsigned char *rsa_e = NULL;
   size_t rsa_n_len, rsa_e_len;
   unsigned int nbits;
 
   (void)ctrl;
   (void)pincb;
   (void)pincb_arg;
 
   if (!strcmp (keyid, "$IFDAUTHKEY") && app->appversion >= 3)
     ;
   else
     return gpg_error (GPG_ERR_INV_ID);
 
   if (!force && !do_readkey (app, ctrl, keyid, 0, NULL, NULL))
     return gpg_error (GPG_ERR_EEXIST);
 
   /* Parse the S-expression.  */
   err = get_rsa_pk_from_canon_sexp (keydata, keydatalen,
                                     &rsa_n, &rsa_n_len, &rsa_e, &rsa_e_len);
   if (err)
     goto leave;
 
   /* Check that the parameters match the requirements.  */
   nbits = app_help_count_bits (rsa_n, rsa_n_len);
   if (nbits != 1024)
     {
       log_error (_("RSA modulus missing or not of size %d bits\n"), 1024);
       err = gpg_error (GPG_ERR_BAD_PUBKEY);
       goto leave;
     }
 
   nbits = app_help_count_bits (rsa_e, rsa_e_len);
   if (nbits < 2 || nbits > 32)
     {
       log_error (_("RSA public exponent missing or larger than %d bits\n"),
                  32);
       err = gpg_error (GPG_ERR_BAD_PUBKEY);
       goto leave;
     }
 
 /*   /\* Store them.  *\/ */
 /*   err = verify_pin (app, 0, NULL, pincb, pincb_arg); */
 /*   if (err) */
 /*     goto leave; */
 
   /* Send the MSE:Store_Public_Key.  */
   /* We will need to clear the cache here.  */
   err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
 /*   mse = xtrymalloc (1000); */
 
 /*   mse[0] = 0x80; /\* Algorithm reference.  *\/ */
 /*   mse[1] = 1; */
 /*   mse[2] = 0x17; */
 /*   mse[3] = 0x84; /\* Private key reference.  *\/ */
 /*   mse[4] = 1; */
 /*   mse[5] = 0x77; */
 /*   mse[6] = 0x7F; /\* Public key parameter.  *\/ */
 /*   mse[7] = 0x49; */
 /*   mse[8] = 0x81; */
 /*   mse[9] = 3 + 0x80 + 2 + rsa_e_len; */
 /*   mse[10] = 0x81; /\* RSA modulus of 128 byte.  *\/ */
 /*   mse[11] = 0x81; */
 /*   mse[12] = rsa_n_len; */
 /*   memcpy (mse+12, rsa_n, rsa_n_len); */
 /*   mse[10] = 0x82; /\* RSA public exponent of up to 4 bytes.  *\/ */
 /*   mse[12] = rsa_e_len; */
 /*   memcpy (mse+12, rsa_e, rsa_e_len); */
 /*   err = iso7816_manage_security_env (app_get_slot (app), 0x81, 0xB6, */
 /*                                      mse, sizeof mse); */
 
  leave:
   return err;
 }
 
 
 /* Return an allocated string to be used as prompt.  Returns NULL on
  * malloc error.  */
 static char *
 make_prompt (app_t app, int remaining, const char *firstline,
              const char *extraline)
 {
   char *serial, *tmpbuf, *result;
 
   serial = get_dispserialno (app);
 
   /* TRANSLATORS: Put a \x1f right before a colon.  This can be
    * used by pinentry to nicely align the names and values.  Keep
    * the %s at the start and end of the string.  */
   result = xtryasprintf (_("%s"
                            "Number\x1f: %s%%0A"
                            "Holder\x1f: %s"
                            "%s"),
                          "\x1e",
                          serial,
                          "",
                          "");
   xfree (serial);
   if (!result)
     return NULL; /* Out of core.  */
 
   /* Append a "remaining attempts" info if needed.  */
   if (remaining != -1 && remaining < 3)
     {
       char *rembuf;
 
       /* TRANSLATORS: This is the number of remaining attempts to
        * enter a PIN.  Use %%0A (double-percent,0A) for a linefeed. */
       rembuf = xtryasprintf (_("Remaining attempts: %d"), remaining);
       if (rembuf)
         {
           tmpbuf = strconcat (firstline, "%0A%0A", result,
                               "%0A%0A", rembuf, NULL);
           xfree (rembuf);
         }
       else
         tmpbuf = NULL;
       xfree (result);
       result = tmpbuf;
     }
   else
     {
       tmpbuf = strconcat (firstline, "%0A%0A", result,
                           extraline? "%0A%0A":"", extraline,
                           NULL);
       xfree (result);
       result = tmpbuf;
     }
 
   return result;
 }
 
 
 static gpg_error_t
 basic_pin_checks (const char *pinvalue, int minlen, int maxlen)
 {
   if (strlen (pinvalue) < minlen)
     {
       log_error ("PIN is too short; minimum length is %d\n", minlen);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
   if (strlen (pinvalue) > maxlen)
     {
       log_error ("PIN is too large; maximum length is %d\n", maxlen);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
   return 0;
 }
 
 
 /* Verify the PIN if required.  */
 static gpg_error_t
 verify_pin (app_t app, int pwid, const char *desc,
             gpg_error_t (*pincb)(void*, const char *, char **),
             void *pincb_arg)
 {
   int rc;
   pininfo_t pininfo;
   char *prompt;
   const char *extrapromptline = NULL;
   int remaining, nullpin;
 
   if (!desc)
     desc = "||PIN";
 
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.fixedlen = -1;
 
   /* FIXME: TCOS allows to read the min. and max. values - do this.  */
   if (app->appversion == 15)
     {
       if (app->app_local->active_nks_app == NKS_APP_NKS && pwid == 0x03)
         pininfo.minlen = 6;
       else if (app->app_local->active_nks_app == NKS_APP_ESIGN && pwid == 0x81)
         pininfo.minlen = 6;
       else
         pininfo.minlen = 8;
       pininfo.maxlen = 24;
     }
   else if (app->app_local->active_nks_app == NKS_APP_IDLM)
     {
       if (pwid == 0x00)
         pininfo.minlen = 6;
       else
         pininfo.minlen = 8;
       pininfo.maxlen = 24;
     }
   else
     {
       /* For NKS3 we used these fixed values; let's keep this.  */
       pininfo.minlen = 6;
       pininfo.maxlen = 16;
     }
 
   remaining = iso7816_verify_status (app_get_slot (app), pwid);
   nullpin = (remaining == ISO7816_VERIFY_NULLPIN);
   if (remaining < 0)
     remaining = -1; /* We don't care about the concrete error.  */
   if (remaining < 3)
     {
       if (remaining >= 0)
         log_info ("nks: PIN has %d attempts left\n", remaining);
     }
 
   if (nullpin)
     {
       log_info ("nks: The NullPIN for PIN 0x%02x has not yet been changed\n",
                 pwid);
       extrapromptline = _("Note: PIN has not yet been enabled.");
     }
 
   if (!opt.disable_pinpad
       && !iso7816_check_pinpad (app_get_slot (app), ISO7816_VERIFY, &pininfo) )
     {
       prompt = make_prompt (app, remaining, desc, extrapromptline);
       rc = pincb (pincb_arg, prompt, NULL);
       xfree (prompt);
       if (rc)
         {
           log_info (_("PIN callback returned error: %s\n"),
                     gpg_strerror (rc));
           return rc;
         }
 
       rc = iso7816_verify_kp (app_get_slot (app), pwid, &pininfo);
       pincb (pincb_arg, NULL, NULL);  /* Dismiss the prompt. */
     }
   else
     {
       char *pinvalue;
 
       prompt = make_prompt (app, remaining, desc, extrapromptline);
       rc = pincb (pincb_arg, prompt, &pinvalue);
       xfree (prompt);
       if (rc)
         {
           log_info ("PIN callback returned error: %s\n", gpg_strerror (rc));
           return rc;
         }
 
       rc = basic_pin_checks (pinvalue, pininfo.minlen, pininfo.maxlen);
       if (rc)
         {
           xfree (pinvalue);
           return rc;
         }
 
       rc = iso7816_verify (app_get_slot (app), pwid,
                            pinvalue, strlen (pinvalue));
       xfree (pinvalue);
     }
 
   if (rc)
     {
       if ( gpg_err_code (rc) == GPG_ERR_USE_CONDITIONS )
         log_error (_("the NullPIN has not yet been changed\n"));
       else
         log_error ("verify PIN failed\n");
       return rc;
     }
 
   return 0;
 }
 
 
 /* Create the signature and return the allocated result in OUTDATA.
    If a PIN is required the PINCB will be used to ask for the PIN;
    that callback should return the PIN in an allocated buffer and
    store that in the 3rd argument.  */
 static gpg_error_t
 do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
          gpg_error_t (*pincb)(void*, const char *, char **),
          void *pincb_arg,
          const void *indata, size_t indatalen,
          unsigned char **outdata, size_t *outdatalen )
 {
   static unsigned char sha1_prefix[15] = /* Object ID is 1.3.14.3.2.26 */
     { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
       0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
   static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
     { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
       0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
   gpg_error_t err;
   int idx;
   int pwid;
   unsigned char kid;
   unsigned char data[83];   /* Must be large enough for a SHA-1 digest
                                + the largest OID prefix. */
   size_t datalen;
 
   (void)ctrl;
 
   switch (indatalen)
     {
     case 16: case 20: case 35: case 47: case 51: case 67: case 83: break;
     default: return gpg_error (GPG_ERR_INV_VALUE);
     }
 
   err = find_fid_by_keyref (app, keyidstr, &idx, NULL);
   if (err)
     return err;
 
   if (app->app_local->active_nks_app == NKS_APP_SIGG
       && app->app_local->sigg_is_msig)
     {
       log_info ("mass signature cards are not allowed\n");
       return gpg_error (GPG_ERR_NOT_SUPPORTED);
     }
 
   if (!filelist[idx].issignkey)
     return gpg_error (GPG_ERR_INV_ID);
 
   kid = filelist[idx].kid;
 
   /* Prepare the DER object from INDATA.  */
   if (app->appversion > 2 && (indatalen == 35
                               || indatalen == 47
                               || indatalen == 51
                               || indatalen == 67
                               || indatalen == 83))
     {
       /* The caller send data matching the length of the ASN.1 encoded
          hash for SHA-{1,224,256,384,512}.  Assume that is okay.  */
       log_assert (indatalen <= sizeof data);
       memcpy (data, indata, indatalen);
       datalen = indatalen;
     }
   else if (indatalen == 35)
     {
       /* Alright, the caller was so kind to send us an already
          prepared DER object.  This is for TCOS 2. */
       if (hashalgo == GCRY_MD_SHA1 && !memcmp (indata, sha1_prefix, 15))
         ;
       else if (hashalgo == GCRY_MD_RMD160 && !memcmp (indata,rmd160_prefix,15))
         ;
       else
         return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
       memcpy (data, indata, indatalen);
       datalen = 35;
     }
   else if (indatalen == 20)
     {
       if (hashalgo == GCRY_MD_SHA1)
         memcpy (data, sha1_prefix, 15);
       else if (hashalgo == GCRY_MD_RMD160)
         memcpy (data, rmd160_prefix, 15);
       else
         return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
       memcpy (data+15, indata, indatalen);
       datalen = 35;
     }
   else
     return gpg_error (GPG_ERR_INV_VALUE);
 
 
   /* Send an MSE for PSO:Computer_Signature.  */
   if (app->appversion > 2)
     {
       unsigned char mse[6];
 
       mse[0] = 0x80; /* Algorithm reference.  */
       mse[1] = 1;
       mse[2] = 2;    /* RSA, card does pkcs#1 v1.5 padding, no ASN.1 check.  */
       mse[3] = 0x84; /* Private key reference.  */
       mse[4] = 1;
       mse[5] = kid;
       err = iso7816_manage_security_env (app_get_slot (app), 0x41, 0xB6,
                                          mse, sizeof mse);
     }
 
   /* We use the Global PIN 1 */
   if (app->appversion == 15)
     pwid = 0x03;
   else
     pwid = 0x00;
 
   if (!err)
     err = verify_pin (app, pwid, NULL, pincb, pincb_arg);
   /* Compute the signature.  */
   if (!err)
     err = iso7816_compute_ds (app_get_slot (app), 0, data, datalen, 0,
                               outdata, outdatalen);
   return err;
 }
 
 
 
 /* Decrypt the data in INDATA and return the allocated result in OUTDATA.
    If a PIN is required the PINCB will be used to ask for the PIN; it
    should return the PIN in an allocated buffer and put it into PIN.  */
 static gpg_error_t
 do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const void *indata, size_t indatalen,
              unsigned char **outdata, size_t *outdatalen,
              unsigned int *r_info)
 {
   gpg_error_t err;
   int idx;
   int kid;
   int algo;
   int pwid;
   int padind;
   int extended_mode;
 
   (void)ctrl;
   (void)r_info;
 
   if (!indatalen)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   err = find_fid_by_keyref (app, keyidstr, &idx, &algo);
   if (err)
     return err;
 
   if (!filelist[idx].isencrkey)
     return gpg_error (GPG_ERR_INV_ID);
 
   kid = filelist[idx].kid;
 
   if (app->appversion <= 2)
     {
       static const unsigned char mse[] =
         {
           0x80, 1, 0x10, /* Select algorithm RSA. */
           0x84, 1, 0x81  /* Select local secret key 1 for decryption. */
         };
       err = iso7816_manage_security_env (app_get_slot (app), 0xC1, 0xB8,
                                          mse, sizeof mse);
       extended_mode = 0;
       padind = 0x81;
     }
   else if (algo == GCRY_PK_ECC)
     {
       unsigned char mse[3];
       mse[0] = 0x84; /* Private key reference.  */
       mse[1] = 1;
       mse[2] = kid;
       err = iso7816_manage_security_env (app_get_slot (app), 0x41, 0xB8,
                                          mse, sizeof mse);
       extended_mode = 0;
       padind = 0x00;
     }
   else
     {
       unsigned char mse[6];
       mse[0] = 0x80; /* Algorithm reference.  */
       mse[1] = 1;
       mse[2] = 0x0a; /* RSA no padding.  (0x1A is pkcs#1.5 padding.)  */
       mse[3] = 0x84; /* Private key reference.  */
       mse[4] = 1;
       mse[5] = kid;
       err = iso7816_manage_security_env (app_get_slot (app), 0x41, 0xB8,
                                          mse, sizeof mse);
       extended_mode = 1;
       padind = 0x81;
     }
   if (err)
     {
       log_error ("nks: MSE failed: %s\n", gpg_strerror (err));
       goto leave;
     }
 
   /* We use the Global PIN 1 */
   if (app->appversion == 15)
     pwid = 0x03;
   else
     pwid = 0x00;
 
   err = verify_pin (app, pwid, NULL, pincb, pincb_arg);
   if (err)
     goto leave;
 
   err = iso7816_decipher (app_get_slot (app), extended_mode,
                           indata, indatalen, 0, padind,
                           outdata, outdatalen);
 
  leave:
   return err;
 }
 
 
 
 /* Parse a password ID string.  Returns NULL on error or a string
  * suitable as passphrase prompt on success.  On success stores the
  * reference value for the password at R_PWID and a flag indicating
  * which app is to be used at R_NKS_APP_ID.  If NEW_MODE is true, the
  * returned description is suitable for a new password.  Here is a
  * take mapping the PWIDSTR to the used PWIDs:
  *
  *  | pwidstr    |              | NKS3 | NKS15 | IDKEY1 |
  *  |------------+--------------+------+-------+--------|
  *  | PW1.CH     | Global PIN 1 | 0x00 |  0x03 | 0x00   |
  *  | PW2.CH     | Global PIN 2 | 0x01 |  0x04 | 0x01   |
  *  | PW1.CH.SIG | SigG PIN 1   | 0x81 |  0x81 | -      |
  *  | PW2.CH.SIG | SigG PIN 2   | 0x83 |  0x82 | -      |
  *
  * The names for PWIDSTR are taken from the NKS3 specs; the specs of
  * other cards use different names but we keep using the.  PIN1 can be
  * used to unlock PIN2 and vice versa; for consistence with other
  * cards we name PIN2 a "PUK".  The IDKEY card also features a Card
  * Reset Key (CR Key 0x01) which can also be used to reset PIN1.
  *
  * For testing it is possible to specify the PWID directly; the
  * prompts are then not very descriptive:
  *
  *   NKS.0xnn   - Switch to NKS and select id 0xnn
  *   SIGG.0xnn  - Switch to SigG and select id 0xnn
  *   ESIGN.0xnn - Switch to ESIGN and select id 0xnn
  */
 static const char *
 parse_pwidstr (app_t app, const char *pwidstr, int new_mode,
                int *r_nks_app_id, int *r_pwid)
 {
   const char *desc;
   int nks15 = app->appversion == 15;
 
   if (!pwidstr)
     desc = NULL;
   else if (!strcmp (pwidstr, "PW1.CH"))
     {
       *r_nks_app_id = NKS_APP_NKS;
       *r_pwid = nks15? 0x03 : 0x00;
       /* TRANSLATORS: Do not translate the "|*|" prefixes but keep
          them verbatim at the start of the string.  */
       desc = (new_mode
               ? _("|N|Please enter a new PIN for the standard keys.")
               : _("||Please enter the PIN for the standard keys."));
     }
   else if (!strcmp (pwidstr, "PW2.CH"))
     {
       *r_nks_app_id = NKS_APP_NKS;
       *r_pwid = nks15? 0x04 : 0x01;
       desc = (new_mode
               ? _("|NP|Please enter a new PIN Unblocking Code (PUK) "
                   "for the standard keys.")
               : _("|P|Please enter the PIN Unblocking Code (PUK) "
                   "for the standard keys."));
     }
   else if (!strcmp (pwidstr, "PW1.CH.SIG") && !app->app_local->only_idlm)
     {
       *r_nks_app_id = app->app_local->qes_app_id;
       *r_pwid = 0x81;
       desc = (new_mode
               ? _("|N|Please enter a new PIN for the key to create "
                   "qualified signatures.")
               : _("||Please enter the PIN for the key to create "
                   "qualified signatures."));
     }
   else if (!strcmp (pwidstr, "PW2.CH.SIG") && !app->app_local->only_idlm)
     {
       *r_nks_app_id = app->app_local->qes_app_id;
       *r_pwid = nks15? 0x82 : 0x83;
       desc = (new_mode
               ? _("|NP|Please enter a new PIN Unblocking Code (PUK) "
                   "for the key to create qualified signatures.")
               : _("|P|Please enter the PIN Unblocking Code (PUK) "
                   "for the key to create qualified signatures."));
     }
   else if (!strncmp (pwidstr, "NKS.0x", 6)
            && hexdigitp (pwidstr+6) && hexdigitp (pwidstr+7) && !pwidstr[8])
     {
       /* Hack to help debugging.  */
       *r_nks_app_id = NKS_APP_NKS;
       *r_pwid = xtoi_2 (pwidstr+6);
       desc = (new_mode
               ? "|N|Please enter a new PIN for the given NKS pwid"
               : "||Please enter the PIN for the given NKS pwid" );
     }
   else if (!strncmp (pwidstr, "SIGG.0x", 7)
            && hexdigitp (pwidstr+7) && hexdigitp (pwidstr+8) && !pwidstr[9])
     {
       /* Hack to help debugging.  */
       *r_nks_app_id = NKS_APP_SIGG;
       *r_pwid = xtoi_2 (pwidstr+7);
       desc = (new_mode
               ? "|N|Please enter a new PIN for the given SIGG pwid"
               : "||Please enter the PIN for the given SIGG pwid" );
     }
   else if (!strncmp (pwidstr, "ESIGN.0x", 8)
            && hexdigitp (pwidstr+8) && hexdigitp (pwidstr+9) && !pwidstr[10])
     {
       /* Hack to help debugging.  */
       *r_nks_app_id = NKS_APP_ESIGN;
       *r_pwid = xtoi_2 (pwidstr+8);
       desc = (new_mode
               ? "|N|Please enter a new PIN for the given ESIGN pwid"
               : "||Please enter the PIN for the given ESIGN pwid" );
     }
   else if (!strncmp (pwidstr, "IDLM.0x", 7)
            && hexdigitp (pwidstr+7) && hexdigitp (pwidstr+8) && !pwidstr[9])
     {
       /* Hack to help debugging.  */
       *r_nks_app_id = NKS_APP_IDLM;
       *r_pwid = xtoi_2 (pwidstr+7);
       desc = (new_mode
               ? "|N|Please enter a new PIN for the given IDLM pwid"
               : "||Please enter the PIN for the given IDLM pwid" );
     }
   else
     {
       *r_pwid = 0; /* Only to avoid gcc warning in calling function.  */
       desc = NULL; /* Error.  */
     }
 
   return desc;
 }
 
 
 /* Handle the PASSWD command. See parse_pwidstr() for allowed values
    for CHVNOSTR.  */
 static gpg_error_t
 do_change_pin (app_t app, ctrl_t ctrl,  const char *pwidstr,
                unsigned int flags,
                gpg_error_t (*pincb)(void*, const char *, char **),
                void *pincb_arg)
 {
   gpg_error_t err;
   char *newpin = NULL;
   char *oldpin = NULL;
   size_t newpinlen;
   size_t oldpinlen;
   int nks_app_id;
   const char *newdesc;
   int pwid;
   pininfo_t pininfo;
   int remaining;
   char *prompt;
 
   (void)ctrl;
 
   /* The minimum length is enforced by TCOS, the maximum length is
      just a reasonable value.  */
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.minlen = 6;
   pininfo.maxlen = 16;
 
   newdesc = parse_pwidstr (app, pwidstr, 1, &nks_app_id, &pwid);
   if (!newdesc)
     return gpg_error (GPG_ERR_INV_ID);
 
   if ((flags & APP_CHANGE_FLAG_CLEAR))
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   err = switch_application (app, nks_app_id);
   if (err)
     return err;
 
   if ((flags & APP_CHANGE_FLAG_NULLPIN))
     {
       /* With the nullpin flag, we do not verify the PIN - it would
          fail if the Nullpin is still set.  */
       oldpin = xtrycalloc (1, 6);
       if (!oldpin)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       if (app->appversion == 15)
         {
           memset (oldpin, '0', 5);
           oldpinlen = 5;  /* 5 ascii zeroes.  */
         }
       else
         {
           oldpinlen = 6;  /* 6 binary Nuls.  */
         }
     }
   else
     {
       const char *desc;
       int dummy1, dummy2;
 
       if ((flags & APP_CHANGE_FLAG_RESET))
         {
           /* Reset mode: Ask for the alternate PIN.  */
           const char *altpwidstr;
 
           if (!strcmp (pwidstr, "PW1.CH"))
             altpwidstr = "PW2.CH";
           else if (!strcmp (pwidstr, "PW2.CH"))
             altpwidstr = "PW1.CH";
           else if (!strcmp (pwidstr, "PW1.CH.SIG"))
             altpwidstr = "PW2.CH.SIG";
           else if (!strcmp (pwidstr, "PW2.CH.SIG"))
             altpwidstr = "PW1.CH.SIG";
           else
             {
               err = gpg_error (GPG_ERR_BUG);
               goto leave;
             }
           desc = parse_pwidstr (app, altpwidstr, 0, &dummy1, &dummy2);
           remaining = iso7816_verify_status (app_get_slot (app), dummy2);
         }
       else
         {
           /* Regular change mode:  Ask for the old PIN.  */
           desc = parse_pwidstr (app, pwidstr, 0, &dummy1, &dummy2);
           remaining = iso7816_verify_status (app_get_slot (app), pwid);
         }
 
       if (remaining < 0)
         remaining = -1; /* We don't care about the concrete error.  */
       if (remaining < 3)
         {
           if (remaining >= 0)
             log_info ("nks: PIN has %d attempts left\n", remaining);
         }
 
       prompt = make_prompt (app, remaining, desc, NULL);
       err = pincb (pincb_arg, prompt, &oldpin);
       xfree (prompt);
       if (err)
         {
           log_error ("error getting old PIN: %s\n", gpg_strerror (err));
           goto leave;
         }
       oldpinlen = strlen (oldpin);
       err = basic_pin_checks (oldpin, pininfo.minlen, pininfo.maxlen);
       if (err)
         goto leave;
     }
 
 
   prompt = make_prompt (app, -1, newdesc, NULL);
   err = pincb (pincb_arg, prompt, &newpin);
   xfree (prompt);
   if (err)
     {
       log_error (_("error getting new PIN: %s\n"), gpg_strerror (err));
       goto leave;
     }
   newpinlen = strlen (newpin);
 
   err = basic_pin_checks (newpin, pininfo.minlen, pininfo.maxlen);
   if (err)
     goto leave;
 
   if ((flags & APP_CHANGE_FLAG_RESET))
     {
       char *data;
       size_t datalen = oldpinlen + newpinlen;
 
       data = xtrymalloc (datalen);
       if (!data)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       memcpy (data, oldpin, oldpinlen);
       memcpy (data+oldpinlen, newpin, newpinlen);
       err = iso7816_reset_retry_counter_with_rc (app_get_slot (app), pwid,
                                                  data, datalen);
       wipememory (data, datalen);
       xfree (data);
     }
   else
     err = iso7816_change_reference_data (app_get_slot (app), pwid,
                                          oldpin, oldpinlen,
                                          newpin, newpinlen);
  leave:
   xfree (oldpin);
   xfree (newpin);
   return err;
 }
 
 
 /* Perform a simple verify operation.  KEYIDSTR should be NULL or empty.  */
 static gpg_error_t
 do_check_pin (app_t app, ctrl_t ctrl, const char *pwidstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg)
 {
   gpg_error_t err;
   int pwid;
   int nks_app_id;
   const char *desc;
 
   (void)ctrl;
 
   desc = parse_pwidstr (app, pwidstr, 0, &nks_app_id, &pwid);
   if (!desc)
     return gpg_error (GPG_ERR_INV_ID);
 
   err = switch_application (app, nks_app_id);
   if (err)
     return err;
 
   return verify_pin (app, pwid, desc, pincb, pincb_arg);
 }
 
 
 /* Process the various keygrip based info requests.  */
 static gpg_error_t
 do_with_keygrip (app_t app, ctrl_t ctrl, int action,
                  const char *want_keygripstr, int capability)
 {
   gpg_error_t err;
   char keygripstr[2*KEYGRIP_LEN+1];
   char *serialno = NULL;
   char idbuf[20];
   int data = 0;
   int idx;
   const char *tagstr;
 
   /* First a quick check for valid parameters.  */
   switch (action)
     {
     case KEYGRIP_ACTION_LOOKUP:
       if (!want_keygripstr)
         {
           err = gpg_error (GPG_ERR_NOT_FOUND);
           goto leave;
         }
       break;
     case KEYGRIP_ACTION_SEND_DATA:
       data = 1;
       break;
     case KEYGRIP_ACTION_WRITE_STATUS:
       break;
     default:
       err = gpg_error (GPG_ERR_INV_ARG);
       goto leave;
     }
 
   /* Allocate the S/N string if needed.  */
   if (action != KEYGRIP_ACTION_LOOKUP)
     {
       serialno = app_get_serialno (app);
       if (!serialno)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
     }
 
   for (idx=0; filelist[idx].fid; idx++)
     {
       if (filelist[idx].nks_ver > app->appversion)
         continue;
 
       if (!filelist[idx].iskeypair)
         continue;
 
       if (app->app_local->only_idlm)
         {
           if (filelist[idx].nks_app_id != NKS_APP_IDLM)
             continue;
         }
       else
         {
           if (filelist[idx].nks_app_id != NKS_APP_NKS
               && filelist[idx].nks_app_id != app->app_local->qes_app_id)
             continue;
           err = switch_application (app, filelist[idx].nks_app_id);
           if (err)
             goto leave;
         }
 
       err = keygripstr_from_pk_file (app, filelist[idx].fid,
-                                     filelist[idx].iskeypair, keygripstr, NULL);
+                                     filelist[idx].iskeypair, keygripstr,
+                                     NULL, NULL);
       if (err)
         {
           log_error ("can't get keygrip from FID 0x%04X: %s\n",
                      filelist[idx].fid, gpg_strerror (err));
           continue;
         }
 
       if (action == KEYGRIP_ACTION_LOOKUP)
         {
           if (!strcmp (keygripstr, want_keygripstr))
             {
               err = 0; /* Found */
               goto leave;
             }
         }
       else if (!want_keygripstr || !strcmp (keygripstr, want_keygripstr))
         {
           if (capability == GCRY_PK_USAGE_SIGN)
             {
               if (!filelist[idx].issignkey)
                 continue;
             }
           if (capability == GCRY_PK_USAGE_ENCR)
             {
               if (!filelist[idx].isencrkey)
                 continue;
             }
           if (capability == GCRY_PK_USAGE_AUTH)
             {
               if (!filelist[idx].isauthkey)
                 continue;
             }
 
           if (app->app_local->active_nks_app == NKS_APP_ESIGN)
             tagstr = "ESIGN";
           else if (app->app_local->active_nks_app == NKS_APP_SIGG)
             tagstr = "SIGG";
           else if (app->app_local->active_nks_app == NKS_APP_IDLM)
             tagstr = "IDLM";
           else if (app->appversion < 3)
             tagstr = "DF01";
           else
             tagstr = "NKS3";
           snprintf (idbuf, sizeof idbuf, "NKS-%s.%04X",
                     tagstr, filelist[idx].fid);
           send_keyinfo (ctrl, data, keygripstr, serialno, idbuf);
           if (want_keygripstr)
             {
               err = 0; /* Found */
               goto leave;
             }
         }
     }
 
   /* Return an error so that the dispatcher keeps on looping over the
    * other applications.  For clarity we use a different error code
    * when listing all keys.  Note that in lookup mode WANT_KEYGRIPSTR
    * is not NULL.  */
   if (!want_keygripstr)
     err = gpg_error (GPG_ERR_TRUE);
   else
     err = gpg_error (GPG_ERR_NOT_FOUND);
 
  leave:
   xfree (serialno);
   return err;
 }
 
 
 /* Return the version of the NKS application.  */
 static int
 get_nks_version (int slot)
 {
   unsigned char *result = NULL;
   size_t resultlen;
   int type;
 
   if (iso7816_apdu_direct (slot, "\x80\xaa\x06\x00\x00", 5, 0,
                            NULL, &result, &resultlen))
     return 2; /* NKS 2 does not support this command.  */
   /* Example values:   04 11 19 22 21 6A 20 80 03 03 01 01 01 00 00 00
    *                   05 a0 22 3e c8 0c 04 20 0f 01 b6 01 01 00 00 02
    *                   vv tt ccccccccccccccccc aa bb cc vv ff rr rr xx
    * vendor -----------+  |  |                 |  |  |  |  |  |  |  |
    * chip type -----------+  |                 |  |  |  |  |  |  |  |
    * chip id ----------------+                 |  |  |  |  |  |  |  |
    * card type --------------------------------+  |  |  |  |  |  |  |
    * OS version of card type ---------------------+  |  |  |  |  |  |
    * OS release of card type ------------------------+  |  |  |  |  |
    * Completion code version number --------------------+  |  |  |  |
    * File system version ----------------------------------+  |  |  |
    * RFU (00) ------------------------------------------------+  |  |
    * RFU (00) ---------------------------------------------------+  |
    * Authentication key identifier ---------------------------------+
    *
    * vendor    4 := Philips
    *           5 := Infinion
    * card type 3 := TCOS 3
    *          15 := TCOS Signature Card (bb,cc is the ROM mask version)
    * Completion code version number Bit 7..5 := pre-completion code version
    *                                Bit 4..0 := completion code version
    *                                (pre-completion by chip vendor)
    *                                (completion by OS developer)
    */
   if (resultlen < 16)
     type = 0;  /* Invalid data returned.  */
   else
     type = result[8];
   xfree (result);
   return type;
 }
 
 
 /* Switch to the NKS app identified by NKS_APP_ID if not yet done.
  * Returns 0 on success.  */
 static gpg_error_t
 switch_application (app_t app, int nks_app_id)
 {
   gpg_error_t err;
 
   if (app->app_local->only_idlm)
     return 0;  /* No switching at all */
   if (app->app_local->active_nks_app == nks_app_id
       && !app->app_local->need_app_select)
     return 0;  /* Already switched.  */
 
   log_info ("nks: switching to %s\n",
             nks_app_id == NKS_APP_ESIGN? "eSign" :
             nks_app_id == NKS_APP_SIGG?  "SigG"  : "NKS");
 
   if (nks_app_id == NKS_APP_ESIGN)
     err = iso7816_select_application (app_get_slot (app),
                                       aid_esign, sizeof aid_esign, 0);
   else if (nks_app_id == NKS_APP_SIGG)
     err = iso7816_select_application (app_get_slot (app),
                                       aid_sigg, sizeof aid_sigg, 0);
   else
     err = iso7816_select_application (app_get_slot (app),
                                       aid_nks, sizeof aid_nks, 0);
 
   if (!err && nks_app_id == NKS_APP_SIGG
       && app->appversion >= 3
       && !app->app_local->sigg_msig_checked)
     {
       /* Check whether this card is a mass signature card.  */
       unsigned char *buffer;
       size_t buflen;
       const unsigned char *tmpl;
       size_t tmpllen;
 
       app->app_local->sigg_msig_checked = 1;
       app->app_local->sigg_is_msig = 1;
       err = iso7816_select_file (app_get_slot (app), 0x5349, 0);
       if (!err)
         err = iso7816_read_record (app_get_slot (app), 1, 1, 0,
                                    &buffer, &buflen);
       if (!err)
         {
           tmpl = find_tlv (buffer, buflen, 0x7a, &tmpllen);
           if (tmpl && tmpllen == 12
               && !memcmp (tmpl,
                           "\x93\x02\x00\x01\xA4\x06\x83\x01\x81\x83\x01\x83",
                           12))
             app->app_local->sigg_is_msig = 0;
           xfree (buffer);
         }
       if (app->app_local->sigg_is_msig)
         log_info ("nks: This is a mass signature card\n");
     }
 
   if (!err)
     {
       app->app_local->need_app_select = 0;
       app->app_local->active_nks_app = nks_app_id;
     }
   else
     log_error ("nks: error switching to %s: %s\n",
                nks_app_id == NKS_APP_ESIGN? "eSign" :
                nks_app_id == NKS_APP_SIGG?  "SigG"  : "NKS",
                gpg_strerror (err));
 
   return err;
 }
 
 
 /* Select the NKS application.  */
 gpg_error_t
 app_select_nks (app_t app)
 {
   int slot = app_get_slot (app);
   int rc;
   int is_idlm = 0;
 
   rc = iso7816_select_application (slot, aid_nks, sizeof aid_nks, 0);
   if (rc)
     {
       is_idlm = 1;
       rc = iso7816_select_application (slot, aid_idlm, sizeof aid_idlm, 0);
     }
   if (!rc)
     {
       app->apptype = APPTYPE_NKS;
 
       app->app_local = xtrycalloc (1, sizeof *app->app_local);
       if (!app->app_local)
         {
           rc = gpg_error (gpg_err_code_from_errno (errno));
           goto leave;
         }
 
       app->appversion = get_nks_version (slot);
       app->app_local->only_idlm = is_idlm;
       if (is_idlm) /* Set it once, there won't be any switching.  */
         app->app_local->active_nks_app = NKS_APP_IDLM;
 
       if (opt.verbose)
         {
           log_info ("Detected NKS version: %d\n", app->appversion);
           if (is_idlm)
             log_info ("Using only the IDLM application\n");
         }
 
       if (app->appversion == 15)
         app->app_local->qes_app_id = NKS_APP_ESIGN;
       else
         app->app_local->qes_app_id = NKS_APP_SIGG;
 
       app->fnc.deinit = do_deinit;
       app->fnc.prep_reselect = NULL;
       app->fnc.reselect = NULL;
       app->fnc.learn_status = do_learn_status;
       app->fnc.readcert = do_readcert;
       app->fnc.readkey = do_readkey;
       app->fnc.getattr = do_getattr;
       app->fnc.setattr = NULL;
       app->fnc.writecert = do_writecert;
       app->fnc.writekey = do_writekey;
       app->fnc.genkey = NULL;
       app->fnc.sign = do_sign;
       app->fnc.auth = NULL;
       app->fnc.decipher = do_decipher;
       app->fnc.change_pin = do_change_pin;
       app->fnc.check_pin = do_check_pin;
       app->fnc.with_keygrip = do_with_keygrip;
    }
 
  leave:
   if (rc)
     do_deinit (app);
   return rc;
 }
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 465819adc..c631383c0 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -1,6153 +1,6172 @@
 /* app-openpgp.c - The OpenPGP card application.
  * Copyright (C) 2003-2005, 2007-2009,
  *               2013-2015 Free Software Foundation, Inc.
  * Copyright (C) 2003-2005, 2007-2009, 2013-2015, 2020 g10 Code GmbH
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 /* Some notes:
 
    CHV means Card Holder Verification and is nothing else than a PIN
    or password.  That term seems to have been used originally with GSM
    cards.  Version v2 of the specs changes the term to the clearer
    term PW for password.  We use the terms here interchangeable
    because we do not want to change existing strings i18n wise.
 
    Version 2 of the specs also drops the separate PW2 which was
    required in v1 due to ISO requirements.  It is now possible to have
    one physical PW but two reference to it so that they can be
    individually be verified (e.g. to implement a forced verification
    for one key).  Thus you will noticed the use of PW2 with the verify
    command but not with change_reference_data because the latter
    operates directly on the physical PW.
 
    The Reset Code (RC) as implemented by v2 cards uses the same error
    counter as the PW2 of v1 cards.  By default no RC is set and thus
    that error counter is set to 0.  After setting the RC the error
    counter will be initialized to 3.
 
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
 #include <string.h>
 #include <assert.h>
 #include <time.h>
 
 #include "scdaemon.h"
 #include "../common/util.h"
 #include "../common/i18n.h"
 #include "iso7816.h"
 #include "../common/tlv.h"
 #include "../common/host2net.h"
 #include "../common/openpgpdefs.h"
 
 
 #define KDF_DATA_LENGTH_MIN  90
 #define KDF_DATA_LENGTH_MAX 110
 
 /* The AID of this application.  */
 static char const openpgp_aid[] = { 0xD2, 0x76, 0x00, 0x01, 0x24, 0x01 };
 
 
 /* A table describing the DOs of the card.  */
 static struct {
   int tag;
   int constructed;
   int get_from;  /* Constructed DO with this DO or 0 for direct access. */
   unsigned int binary:1;
   unsigned int dont_cache:1;
   unsigned int flush_on_error:1;
   unsigned int get_immediate_in_v11:1; /* Enable a hack to bypass the cache of
                                  this data object if it is used in 1.1
                                  and later versions of the card.  This
                                  does not work with composite DO and
                                  is currently only useful for the CHV
                                  status bytes. */
   unsigned int try_extlen:2;           /* Large object; try to use an extended
                                  length APDU when !=0.  The size is
                                  determined by extcap.max_certlen_3
                                  when == 1, and by extcap.max_special_do
                                  when == 2.  */
   char *desc;
 } data_objects[] = {
   { 0x005E, 0,    0, 1, 0, 0, 0, 2, "Login Data" },
   { 0x5F50, 0,    0, 0, 0, 0, 0, 2, "URL" },
   { 0x5F52, 0,    0, 1, 0, 0, 0, 0, "Historical Bytes" },
   { 0x0065, 1,    0, 1, 0, 0, 0, 0, "Cardholder Related Data"},
   { 0x005B, 0, 0x65, 0, 0, 0, 0, 0, "Name" },
   { 0x5F2D, 0, 0x65, 0, 0, 0, 0, 0, "Language preferences" },
   { 0x5F35, 0, 0x65, 0, 0, 0, 0, 0, "Salutation" },
   { 0x006E, 1,    0, 1, 0, 0, 0, 0, "Application Related Data" },
   { 0x004F, 0, 0x6E, 1, 0, 0, 0, 0, "AID" },
   { 0x0073, 1,    0, 1, 0, 0, 0, 0, "Discretionary Data Objects" },
   { 0x0047, 0, 0x6E, 1, 1, 0, 0, 0, "Card Capabilities" },
   { 0x00C0, 0, 0x6E, 1, 1, 0, 0, 0, "Extended Card Capabilities" },
   { 0x00C1, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Signature" },
   { 0x00C2, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Decryption" },
   { 0x00C3, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Authentication" },
   { 0x00C4, 0, 0x6E, 1, 0, 1, 1, 0, "CHV Status Bytes" },
   { 0x00C5, 0, 0x6E, 1, 0, 0, 0, 0, "Fingerprints" },
   { 0x00C6, 0, 0x6E, 1, 0, 0, 0, 0, "CA Fingerprints" },
   { 0x00CD, 0, 0x6E, 1, 0, 0, 0, 0, "Generation time" },
   { 0x007A, 1,    0, 1, 0, 0, 0, 0, "Security Support Template" },
   { 0x0093, 0, 0x7A, 1, 1, 0, 0, 0, "Digital Signature Counter" },
   { 0x0101, 0,    0, 0, 0, 0, 0, 2, "Private DO 1"},
   { 0x0102, 0,    0, 0, 0, 0, 0, 2, "Private DO 2"},
   { 0x0103, 0,    0, 0, 0, 0, 0, 2, "Private DO 3"},
   { 0x0104, 0,    0, 0, 0, 0, 0, 2, "Private DO 4"},
   { 0x7F21, 1,    0, 1, 0, 0, 0, 1, "Cardholder certificate"},
   /* V3.0 */
   { 0x7F74, 0, 0x6E, 1, 0, 0, 0, 0, "General Feature Management"},
   { 0x00D5, 0,    0, 1, 0, 0, 0, 0, "AES key data"},
   { 0x00D6, 0, 0x6E, 1, 0, 0, 0, 0, "UIF for Signature"},
   { 0x00D7, 0, 0x6E, 1, 0, 0, 0, 0, "UIF for Decryption"},
   { 0x00D8, 0, 0x6E, 1, 0, 0, 0, 0, "UIF for Authentication"},
   { 0x00F9, 0,    0, 1, 0, 0, 0, 0, "KDF data object"},
   { 0x00FA, 0,    0, 1, 0, 0, 0, 2, "Algorithm Information"},
   { 0 }
 };
 
 
 /* Type of keys.  */
 typedef enum
   {
     KEY_TYPE_ECC,
     KEY_TYPE_RSA,
   }
 key_type_t;
 
 
 /* The format of RSA private keys.  */
 typedef enum
   {
     RSA_UNKNOWN_FMT,
     RSA_STD,
     RSA_STD_N,
     RSA_CRT,
     RSA_CRT_N
   }
 rsa_key_format_t;
 
 
 /* One cache item for DOs.  */
 struct cache_s {
   struct cache_s *next;
   int tag;
   size_t length;
   unsigned char data[1];
 };
 
 
 /* Object with application (i.e. OpenPGP card) specific data.  */
 struct app_local_s {
   /* A linked list with cached DOs.  */
   struct cache_s *cache;
 
   /* Keep track of the public keys.  */
   struct
   {
     int read_done;   /* True if we have at least tried to read them.  */
     unsigned char *key; /* This is a malloced buffer with a canonical
                            encoded S-expression encoding a public
                            key. Might be NULL if key is not
                            available.  */
     size_t keylen;      /* The length of the above S-expression.  This
                            is usually only required for cross checks
                            because the length of an S-expression is
                            implicitly available.  */
     unsigned char keygrip_str[41]; /* The keygrip, null terminated */
   } pk[3];
 
   unsigned char status_indicator; /* The card status indicator.  */
 
   unsigned int manufacturer:16;   /* Manufacturer ID from the s/n.  */
 
   /* Keep track of the ISO card capabilities.  */
   struct
   {
     unsigned int cmd_chaining:1;  /* Command chaining is supported.  */
     unsigned int ext_lc_le:1;     /* Extended Lc and Le are supported.  */
   } cardcap;
 
   /* Keep track of extended card capabilities.  */
   struct
   {
     unsigned int is_v2:1;              /* Compatible to v2 or later.        */
     unsigned int extcap_v3:1;          /* Extcap is in v3 format.           */
     unsigned int has_button:1;         /* Has confirmation button or not.   */
 
     unsigned int sm_supported:1;       /* Secure Messaging is supported.    */
     unsigned int get_challenge:1;
     unsigned int key_import:1;
     unsigned int change_force_chv:1;
     unsigned int private_dos:1;
     unsigned int algo_attr_change:1;   /* Algorithm attributes changeable.  */
     unsigned int has_decrypt:1;        /* Support symmetric decryption.     */
     unsigned int kdf_do:1;             /* Support KDF DO.                   */
 
     unsigned int sm_algo:2;            /* Symmetric crypto algo for SM.     */
     unsigned int pin_blk2:1;           /* PIN block 2 format supported.     */
     unsigned int mse:1;                /* MSE command supported.            */
     unsigned int max_certlen_3:16;
     unsigned int max_get_challenge:16; /* Maximum size for get_challenge.   */
     unsigned int max_special_do:16;    /* Maximum size for special DOs.     */
   } extcap;
 
   /* Flags used to control the application.  */
   struct
   {
     unsigned int no_sync:1;   /* Do not sync CHV1 and CHV2 */
     unsigned int def_chv2:1;  /* Use 123456 for CHV2.  */
   } flags;
 
 
   /* Keep track on whether we cache a certain PIN so that we get it
    * from the cache only if we know we cached it.  This inhibits the
    * use of the same cache entry for a card plugged in and out without
    * gpg-agent having noticed that due to a bug.  */
   struct
   {
     unsigned int maybe_chv1:1;
     unsigned int maybe_chv2:1;
     unsigned int maybe_chv3:1;
   } pincache;
 
   /* Pinpad request specified on card.  */
   struct
   {
     unsigned int disabled:1;    /* No pinpad use because of KDF DO.  */
     unsigned int specified:1;
     int fixedlen_user;
     int fixedlen_admin;
   } pinpad;
 
   struct
   {
     key_type_t key_type;
     const char *keyalgo;         /* Algorithm in standard string format.  */
     union {
       struct {
         unsigned int n_bits;     /* Size of the modulus in bits.  The rest
                                     of this strucuire is only valid if
                                     this is not 0.  */
         unsigned int e_bits;     /* Size of the public exponent in bits.  */
         rsa_key_format_t format;
       } rsa;
       struct {
         const char *curve;
         int flags;
       } ecc;
     };
    } keyattr[3];
 
 };
 
 #define ECC_FLAG_DJB_TWEAK (1 << 0)
 #define ECC_FLAG_PUBKEY    (1 << 1)
 
 
 /***** Local prototypes  *****/
 static unsigned long convert_sig_counter_value (const unsigned char *value,
                                                 size_t valuelen);
 static unsigned long get_sig_counter (app_t app);
 static gpg_error_t do_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
                             gpg_error_t (*pincb)(void*, const char *, char **),
                             void *pincb_arg,
                             const void *indata, size_t indatalen,
                             unsigned char **outdata, size_t *outdatalen);
 static const char *get_algorithm_attribute_string (const unsigned char *buffer,
                                                    size_t buflen);
 static void parse_algorithm_attribute (app_t app, int keyno);
 static gpg_error_t change_keyattr_from_string
                            (app_t app, ctrl_t ctrl,
                             gpg_error_t (*pincb)(void*, const char *, char **),
                             void *pincb_arg,
                             const char *keyref, const char *keyalgo,
                             const void *value, size_t valuelen);
 
 
 /* Return the OpenPGP card manufacturer name. */
 static const char *
 get_manufacturer (unsigned int no)
 {
   /* Note:  Make sure that there is no colon or linefeed in the string. */
   switch (no)
     {
     case 0x0001: return "PPC Card Systems";
     case 0x0002: return "Prism";
     case 0x0003: return "OpenFortress";
     case 0x0004: return "Wewid";
     case 0x0005: return "ZeitControl";
     case 0x0006: return "Yubico";
     case 0x0007: return "OpenKMS";
     case 0x0008: return "LogoEmail";
     case 0x0009: return "Fidesmo";
     case 0x000A: return "Dangerous Things";
     case 0x000B: return "Feitian Technologies";
 
     case 0x002A: return "Magrathea";
     case 0x0042: return "GnuPG e.V.";
 
     case 0x1337: return "Warsaw Hackerspace";
     case 0x2342: return "warpzone"; /* hackerspace Muenster.  */
     case 0x4354: return "Confidential Technologies";   /* cotech.de */
     case 0x5443: return "TIF-IT e.V.";
     case 0x63AF: return "Trustica";
     case 0xBA53: return "c-base e.V.";
     case 0xBD0E: return "Paranoidlabs";
     case 0xF517: return "FSIJ";
     case 0xF5EC: return "F-Secure";
 
       /* 0x0000 and 0xFFFF are defined as test cards per spec,
        * 0xFF00 to 0xFFFE are assigned for use with randomly created
        * serial numbers.  */
     case 0x0000:
     case 0xffff: return "test card";
     default: return (no & 0xff00) == 0xff00? "unmanaged S/N range":"unknown";
     }
 }
 
 
 
 
 /* Deconstructor. */
 static void
 do_deinit (app_t app)
 {
   if (app && app->app_local)
     {
       struct cache_s *c, *c2;
       int i;
 
       for (c = app->app_local->cache; c; c = c2)
         {
           c2 = c->next;
           xfree (c);
         }
 
       for (i=0; i < DIM (app->app_local->pk); i++)
         {
           xfree (app->app_local->pk[i].key);
           app->app_local->pk[i].read_done = 0;
         }
       xfree (app->app_local);
       app->app_local = NULL;
     }
 }
 
 
 /* This is a helper to do a wipememory followed by a free.  In general
  * we do not need this if the buffer has been allocated in secure
  * memory.  However at some places we can't make that sure and thus we
  * better to an extra wipe here.  */
 static void
 wipe_and_free (void *p, size_t len)
 {
   if (p)
     {
       if (len)
         wipememory (p, len);
       xfree (p);
     }
 }
 
 
 /* Similar to wipe_and_free but assumes P is eitehr NULL or a proper
  * string.  */
 static void
 wipe_and_free_string (char *p)
 {
   if (p)
     {
       wipememory (p, strlen (p));
       xfree (p);
     }
 }
 
 
 /* Wrapper around iso7816_get_data which first tries to get the data
    from the cache.  With GET_IMMEDIATE passed as true, the cache is
    bypassed.  With TRY_EXTLEN extended lengths APDUs are use if
    supported by the card.  */
 static gpg_error_t
 get_cached_data (app_t app, int tag,
                  unsigned char **result, size_t *resultlen,
                  int get_immediate, int try_extlen)
 {
   gpg_error_t err;
   int i;
   unsigned char *p;
   size_t len;
   struct cache_s *c;
   int exmode;
 
   *result = NULL;
   *resultlen = 0;
 
   if (!get_immediate)
     {
       for (c=app->app_local->cache; c; c = c->next)
         if (c->tag == tag)
           {
             if(c->length)
               {
                 p = xtrymalloc (c->length);
                 if (!p)
                   return gpg_error (gpg_err_code_from_errno (errno));
                 memcpy (p, c->data, c->length);
                 *result = p;
               }
 
             *resultlen = c->length;
 
             return 0;
           }
     }
 
   if (try_extlen && app->app_local->cardcap.ext_lc_le)
     {
       if (try_extlen == 1)
         exmode = app->app_local->extcap.max_certlen_3;
       else if (try_extlen == 2 && app->app_local->extcap.extcap_v3)
         exmode = app->app_local->extcap.max_special_do;
       else
         exmode = 0;
     }
   else
     exmode = 0;
 
   err = iso7816_get_data (app_get_slot (app), exmode, tag, &p, &len);
   if (err)
     return err;
   if (len)
     *result = p;
   *resultlen = len;
 
   /* Check whether we should cache this object. */
   if (get_immediate)
     return 0;
 
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].tag == tag)
       {
         if (data_objects[i].dont_cache)
           return 0;
         break;
       }
 
   /* Okay, cache it. */
   for (c=app->app_local->cache; c; c = c->next)
     assert (c->tag != tag);
 
   c = xtrymalloc (sizeof *c + len);
   if (c)
     {
       if (len)
         memcpy (c->data, p, len);
       else
         xfree (p);
       c->length = len;
       c->tag = tag;
       c->next = app->app_local->cache;
       app->app_local->cache = c;
     }
 
   return 0;
 }
 
 /* Remove DO at TAG from the cache. */
 static void
 flush_cache_item (app_t app, int tag)
 {
   struct cache_s *c, *cprev;
   int i;
 
   if (!app->app_local)
     return;
 
   for (c=app->app_local->cache, cprev=NULL; c ; cprev=c, c = c->next)
     if (c->tag == tag)
       {
         if (cprev)
           cprev->next = c->next;
         else
           app->app_local->cache = c->next;
         xfree (c);
 
         for (c=app->app_local->cache; c ; c = c->next)
           {
             assert (c->tag != tag); /* Oops: duplicated entry. */
           }
         return;
       }
 
   /* Try again if we have an outer tag. */
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].tag == tag && data_objects[i].get_from
         && data_objects[i].get_from != tag)
       flush_cache_item (app, data_objects[i].get_from);
 }
 
 /* Flush all entries from the cache which might be out of sync after
    an error. */
 static void
 flush_cache_after_error (app_t app)
 {
   int i;
 
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].flush_on_error)
       flush_cache_item (app, data_objects[i].tag);
 }
 
 
 /* Flush the entire cache. */
 static void
 flush_cache (app_t app)
 {
   if (app && app->app_local)
     {
       struct cache_s *c, *c2;
 
       for (c = app->app_local->cache; c; c = c2)
         {
           c2 = c->next;
           xfree (c);
         }
       app->app_local->cache = NULL;
     }
 }
 
 
 /* Get the DO identified by TAG from the card in SLOT and return a
    buffer with its content in RESULT and NBYTES.  The return value is
    NULL if not found or a pointer which must be used to release the
    buffer holding value. */
 static void *
 get_one_do (app_t app, int tag, unsigned char **result, size_t *nbytes,
             int *r_rc)
 {
   int rc, i;
   unsigned char *buffer;
   size_t buflen;
   unsigned char *value;
   size_t valuelen;
   int dummyrc;
   int exmode;
 
   if (!r_rc)
     r_rc = &dummyrc;
 
   *result = NULL;
   *nbytes = 0;
   *r_rc = 0;
   for (i=0; data_objects[i].tag && data_objects[i].tag != tag; i++)
     ;
 
   if (app->appversion > 0x0100 && data_objects[i].get_immediate_in_v11)
     {
       exmode = 0;
       rc = iso7816_get_data (app_get_slot (app), exmode, tag, &buffer, &buflen);
       if (rc)
         {
           *r_rc = rc;
           return NULL;
         }
       *result = buffer;
       *nbytes = buflen;
       return buffer;
     }
 
   value = NULL;
   rc = -1;
   if (data_objects[i].tag && data_objects[i].get_from)
     {
       rc = get_cached_data (app, data_objects[i].get_from,
                             &buffer, &buflen,
                             (data_objects[i].dont_cache
                              || data_objects[i].get_immediate_in_v11),
                             data_objects[i].try_extlen);
       if (!rc)
         {
           const unsigned char *s;
 
           s = find_tlv_unchecked (buffer, buflen, tag, &valuelen);
           if (!s)
             value = NULL; /* not found */
           else if (valuelen > buflen - (s - buffer))
             {
               log_error ("warning: constructed DO too short\n");
               value = NULL;
               xfree (buffer); buffer = NULL;
             }
           else
             value = buffer + (s - buffer);
         }
     }
 
   if (!value) /* Not in a constructed DO, try simple. */
     {
       rc = get_cached_data (app, tag, &buffer, &buflen,
                             (data_objects[i].dont_cache
                              || data_objects[i].get_immediate_in_v11),
                             data_objects[i].try_extlen);
       if (!rc)
         {
           value = buffer;
           valuelen = buflen;
         }
     }
 
   if (!rc)
     {
       *nbytes = valuelen;
       *result = value;
       return buffer;
     }
   *r_rc = rc;
   return NULL;
 }
 
 
 static void
 dump_all_do (int slot)
 {
   int rc, i, j;
   unsigned char *buffer;
   size_t buflen;
 
   for (i=0; data_objects[i].tag; i++)
     {
       if (data_objects[i].get_from)
         continue;
 
       /* We don't try extended length APDU because such large DO would
          be pretty useless in a log file.  */
       rc = iso7816_get_data (slot, 0, data_objects[i].tag, &buffer, &buflen);
       if (gpg_err_code (rc) == GPG_ERR_NO_OBJ)
         ;
       else if (rc)
         log_info ("DO '%s' not available: %s\n",
                   data_objects[i].desc, gpg_strerror (rc));
       else
         {
           if (data_objects[i].binary)
             {
               log_info ("DO '%s': ", data_objects[i].desc);
               log_printhex (buffer, buflen, "");
             }
           else
             log_info ("DO '%s': '%.*s'\n",
                       data_objects[i].desc,
                       (int)buflen, buffer); /* FIXME: sanitize */
 
           if (data_objects[i].constructed)
             {
               for (j=0; data_objects[j].tag; j++)
                 {
                   const unsigned char *value;
                   size_t valuelen;
 
                   if (j==i || data_objects[i].tag != data_objects[j].get_from)
                     continue;
                   value = find_tlv_unchecked (buffer, buflen,
                                               data_objects[j].tag, &valuelen);
                   if (!value)
                     ; /* not found */
                   else if (valuelen > buflen - (value - buffer))
                     log_error ("warning: constructed DO too short\n");
                   else
                     {
                       if (data_objects[j].binary)
                         {
                           log_info ("DO '%s': ", data_objects[j].desc);
                           if (valuelen > 200)
                             log_info ("[%u]\n", (unsigned int)valuelen);
                           else
                             log_printhex (value, valuelen, "");
                         }
                       else
                         log_info ("DO '%s': '%.*s'\n",
                                   data_objects[j].desc,
                                   (int)valuelen, value); /* FIXME: sanitize */
                     }
                 }
             }
         }
       xfree (buffer); buffer = NULL;
     }
 }
 
 
 /* Count the number of bits, assuming the A represents an unsigned big
    integer of length LEN bytes. */
 static unsigned int
 count_bits (const unsigned char *a, size_t len)
 {
   unsigned int n = len * 8;
   int i;
 
   for (; len && !*a; len--, a++, n -=8)
     ;
   if (len)
     {
       for (i=7; i && !(*a & (1<<i)); i--)
         n--;
     }
   return n;
 }
 
 /* GnuPG makes special use of the login-data DO, this function parses
    the login data to store the flags for later use.  It may be called
    at any time and should be called after changing the login-data DO.
 
    Everything up to a LF is considered a mailbox or account name.  If
    the first LF is followed by DC4 (0x14) control sequence are
    expected up to the next LF.  Control sequences are separated by FS
    (0x18) and consist of key=value pairs.  There are two keys defined:
 
     F=<flags>
 
     Where FLAGS is a plain hexadecimal number representing flag values.
     The lsb is here the rightmost bit.  Defined flags bits are:
 
       Bit 0 = CHV1 and CHV2 are not synchronized
       Bit 1 = CHV2 has been set to the default PIN of "123456"
               (this implies that bit 0 is also set).
 
     P=<pinpad-request>
 
     Where PINPAD_REQUEST is in the format of: <n> or <n>,<m>.
     N for user PIN, M for admin PIN.  If M is missing it means M=N.
     0 means to force not to use pinpad.
 
 */
 static void
 parse_login_data (app_t app)
 {
   unsigned char *buffer, *p;
   size_t buflen, len;
   void *relptr;
 
   /* Set defaults.  */
   app->app_local->flags.no_sync = 0;
   app->app_local->flags.def_chv2 = 0;
   app->app_local->pinpad.specified = 0;
   app->app_local->pinpad.fixedlen_user = -1;
   app->app_local->pinpad.fixedlen_admin = -1;
 
   /* Read the DO.  */
   relptr = get_one_do (app, 0x005E, &buffer, &buflen, NULL);
   if (!relptr)
     return; /* Ooops. */
   for (; buflen; buflen--, buffer++)
     if (*buffer == '\n')
       break;
   if (buflen < 2 || buffer[1] != '\x14')
     {
       xfree (relptr);
       return; /* No control sequences.  */
     }
 
   buflen--;
   buffer++;
   do
     {
       buflen--;
       buffer++;
       if (buflen > 1 && *buffer == 'F' && buffer[1] == '=')
         {
           /* Flags control sequence found.  */
           int lastdig = 0;
 
           /* For now we are only interested in the last digit, so skip
              any leading digits but bail out on invalid characters. */
           for (p=buffer+2, len = buflen-2; len && hexdigitp (p); p++, len--)
             lastdig = xtoi_1 (p);
           buffer = p;
           buflen = len;
           if (len && !(*p == '\n' || *p == '\x18'))
             goto next;  /* Invalid characters in field.  */
           app->app_local->flags.no_sync = !!(lastdig & 1);
           app->app_local->flags.def_chv2 = (lastdig & 3) == 3;
         }
       else if (buflen > 1 && *buffer == 'P' && buffer[1] == '=')
         {
           /* Pinpad request control sequence found.  */
           buffer += 2;
           buflen -= 2;
 
           if (buflen)
             {
               if (digitp (buffer))
                 {
                   char *q;
                   int n, m;
 
                   n = strtol (buffer, &q, 10);
                   if (q >= (char *)buffer + buflen
                       || *q == '\x18' || *q == '\n')
                     m = n;
                   else
                     {
                       if (*q++ != ',' || !digitp (q))
                         goto next;
                       m = strtol (q, &q, 10);
                     }
 
                   if (buflen < ((unsigned char *)q - buffer))
                     break;
 
                   buflen -= ((unsigned char *)q - buffer);
                   buffer = q;
 
                   if (buflen && !(*buffer == '\n' || *buffer == '\x18'))
                     goto next;
                   app->app_local->pinpad.specified = 1;
                   app->app_local->pinpad.fixedlen_user = n;
                   app->app_local->pinpad.fixedlen_admin = m;
                 }
             }
         }
     next:
       /* Skip to FS (0x18) or LF (\n).  */
       for (; buflen && *buffer != '\x18' && *buffer != '\n'; buflen--)
         buffer++;
     }
   while (buflen && *buffer != '\n');
 
   xfree (relptr);
 }
 
 
 #define MAX_ARGS_STORE_FPR 3
 
 /* Note, that FPR must be at least 20 bytes. */
 static gpg_error_t
 store_fpr (app_t app, int keynumber, u32 timestamp, unsigned char *fpr,
            int algo, ...)
 {
   unsigned int n, nbits;
   unsigned char *buffer, *p;
   int tag, tag2;
   int rc;
   const unsigned char *m[MAX_ARGS_STORE_FPR];
   size_t mlen[MAX_ARGS_STORE_FPR];
   va_list ap;
   int argc;
   int i;
 
   n = 6;    /* key packet version, 4-byte timestamps, and algorithm */
   if (algo == PUBKEY_ALGO_ECDH)
     argc = 3;
   else
     argc = 2;
 
   va_start (ap, algo);
   for (i = 0; i < argc; i++)
     {
       m[i] = va_arg (ap, const unsigned char *);
       mlen[i] = va_arg (ap, size_t);
       if (algo == PUBKEY_ALGO_RSA || i == 1)
         n += 2;
       n += mlen[i];
     }
   va_end (ap);
 
   p = buffer = xtrymalloc (3 + n);
   if (!buffer)
     return gpg_error_from_syserror ();
 
   *p++ = 0x99;     /* ctb */
   *p++ = n >> 8;   /* 2 byte length header */
   *p++ = n;
   *p++ = 4;        /* key packet version */
   *p++ = timestamp >> 24;
   *p++ = timestamp >> 16;
   *p++ = timestamp >>  8;
   *p++ = timestamp;
   *p++ = algo;
 
   for (i = 0; i < argc; i++)
     {
       if (algo == PUBKEY_ALGO_RSA || i == 1)
         {
           nbits = count_bits (m[i], mlen[i]);
           *p++ = nbits >> 8;
           *p++ = nbits;
         }
       memcpy (p, m[i], mlen[i]);
       p += mlen[i];
     }
 
   gcry_md_hash_buffer (GCRY_MD_SHA1, fpr, buffer, n+3);
 
   xfree (buffer);
 
   tag = (app->appversion > 0x0007? 0xC7 : 0xC6) + keynumber;
   flush_cache_item (app, 0xC5);
   tag2 = 0xCE + keynumber;
   flush_cache_item (app, 0xCD);
 
   rc = iso7816_put_data (app_get_slot (app), 0, tag, fpr, 20);
   if (rc)
     log_error (_("failed to store the fingerprint: %s\n"),gpg_strerror (rc));
 
   if (!rc && app->appversion > 0x0100)
     {
       unsigned char buf[4];
 
       buf[0] = timestamp >> 24;
       buf[1] = timestamp >> 16;
       buf[2] = timestamp >>  8;
       buf[3] = timestamp;
 
       rc = iso7816_put_data (app_get_slot (app), 0, tag2, buf, 4);
       if (rc)
         log_error (_("failed to store the creation date: %s\n"),
                    gpg_strerror (rc));
     }
 
   return rc;
 }
 
 
 static void
 send_fpr_if_not_null (ctrl_t ctrl, const char *keyword,
                       int number, const unsigned char *fpr)
 {
   int i;
   char buf[41];
   char numbuf[25];
 
   for (i=0; i < 20 && !fpr[i]; i++)
     ;
   if (i==20)
     return; /* All zero. */
   bin2hex (fpr, 20, buf);
   if (number == -1)
     *numbuf = 0; /* Don't print the key number */
   else
     sprintf (numbuf, "%d", number);
   send_status_info (ctrl, keyword,
                     numbuf, (size_t)strlen(numbuf),
                     buf, (size_t)strlen (buf), NULL, 0);
 }
 
 static void
 send_fprtime_if_not_null (ctrl_t ctrl, const char *keyword,
                           int number, const unsigned char *stamp)
 {
   char numbuf1[50], numbuf2[50];
   unsigned long value;
 
   value = buf32_to_ulong (stamp);
   if (!value)
     return;
   sprintf (numbuf1, "%d", number);
   sprintf (numbuf2, "%lu", value);
   send_status_info (ctrl, keyword,
                     numbuf1, (size_t)strlen(numbuf1),
                     numbuf2, (size_t)strlen(numbuf2), NULL, 0);
 }
 
 static void
 send_key_data (ctrl_t ctrl, const char *name,
                const unsigned char *a, size_t alen)
 {
   char *buffer, *buf;
   size_t buflen;
 
   buffer = buf = bin2hex (a, alen, NULL);
   if (!buffer)
     {
       log_error ("memory allocation error in send_key_data\n");
       return;
     }
   buflen = strlen (buffer);
 
   /* 768 is the hexified size for the modulus of an 3072 bit key.  We
      use extra chunks to transmit larger data (i.e for 4096 bit).  */
   for ( ;buflen > 768; buflen -= 768, buf += 768)
     send_status_info (ctrl, "KEY-DATA",
                       "-", 1,
                       buf, 768,
                       NULL, 0);
   send_status_info (ctrl, "KEY-DATA",
                     name, (size_t)strlen(name),
                     buf, buflen,
                     NULL, 0);
   xfree (buffer);
 }
 
 
 static void
 send_key_attr (ctrl_t ctrl, app_t app, const char *keyword, int keyno)
 {
   char buffer[200];
 
   log_assert (keyno >=0 && keyno < DIM(app->app_local->keyattr));
 
   /* Note that the code in gpg-card supports prefixing the key number
    * with "OPENPGP." but older code does not yet support this.  There
    * is also a discrepancy with the algorithm numbers: We should use
    * the gcrypt numbers but the current code assumes OpenPGP numbers.  */
   if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
     snprintf (buffer, sizeof buffer, "%d 1 rsa%u %u %d",
               keyno+1,
               app->app_local->keyattr[keyno].rsa.n_bits,
               app->app_local->keyattr[keyno].rsa.e_bits,
               app->app_local->keyattr[keyno].rsa.format);
   else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECC)
     {
       snprintf (buffer, sizeof buffer, "%d %d %s",
                 keyno+1,
                 keyno==1? PUBKEY_ALGO_ECDH :
                 (app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)?
                 PUBKEY_ALGO_EDDSA : PUBKEY_ALGO_ECDSA,
                 app->app_local->keyattr[keyno].ecc.curve);
     }
   else
     snprintf (buffer, sizeof buffer, "%d 0 0 UNKNOWN", keyno+1);
 
   send_status_direct (ctrl, keyword, buffer);
 }
 
 
 #define RSA_SMALL_SIZE_KEY 1952
 #define RSA_SMALL_SIZE_OP  2048
 
 static int
 determine_rsa_response (app_t app, int keyno)
 {
   int size;
 
   size = 2 + 3 /* header */
     + 4 /* tag+len */ + (app->app_local->keyattr[keyno].rsa.n_bits+7)/8
     + 2 /* tag+len */ + (app->app_local->keyattr[keyno].rsa.e_bits+7)/8;
 
   return size;
 }
 
 
 /* Implement the GETATTR command.  This is similar to the LEARN
    command but returns just one value via the status interface. */
 static gpg_error_t
 do_getattr (app_t app, ctrl_t ctrl, const char *name)
 {
   static struct {
     const char *name;
     int tag;
     int special;
   } table[] = {
     { "DISP-NAME",    0x005B },
     { "LOGIN-DATA",   0x005E },
     { "DISP-LANG",    0x5F2D },
     { "DISP-SEX",     0x5F35 },
     { "PUBKEY-URL",   0x5F50 },
     { "KEY-FPR",      0x00C5, 3 },
     { "KEY-TIME",     0x00CD, 4 },
     { "KEY-ATTR",     0x0000, -5 },
     { "CA-FPR",       0x00C6, 3 },
     { "CHV-STATUS",   0x00C4, 1 },
     { "SIG-COUNTER",  0x0093, 2 },
     { "SERIALNO",     0x004F, -1 },
     { "AID",          0x004F },
     { "EXTCAP",       0x0000, -2 },
     { "PRIVATE-DO-1", 0x0101 },
     { "PRIVATE-DO-2", 0x0102 },
     { "PRIVATE-DO-3", 0x0103 },
     { "PRIVATE-DO-4", 0x0104 },
     { "$AUTHKEYID",   0x0000, -3 },
     { "$ENCRKEYID",   0x0000, -6 },
     { "$SIGNKEYID",   0x0000, -7 },
     { "$DISPSERIALNO",0x0000, -4 },
     { "UIF-1",        0x00D6, 0 },
     { "UIF-2",        0x00D7, 0 },
     { "UIF-3",        0x00D8, 0 },
     { "KDF",          0x00F9, 5 },
     { "MANUFACTURER", 0x0000, -8 },
     { "UIF",          0x0000, -9 },  /* Shortcut for all UIF */
     { "KEY-STATUS",   0x00DE,  6 },
     { "KEY-ATTR-INFO", 0x00FA,  7 },
     { NULL, 0 }
   };
   int idx, i, rc;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
 
   for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
     ;
   if (!table[idx].name)
     return gpg_error (GPG_ERR_INV_NAME);
 
   if (table[idx].special == -1)
     {
       /* The serial number is very special.  We could have used the
          AID DO to retrieve it.  The AID DO is available anyway but
          not hex formatted. */
       char *serial = app_get_serialno (app);
 
       if (serial)
         {
           send_status_direct (ctrl, "SERIALNO", serial);
           xfree (serial);
         }
       return 0;
     }
   if (table[idx].special == -2)
     {
       char tmp[110];
 
       snprintf (tmp, sizeof tmp,
                 "gc=%d ki=%d fc=%d pd=%d mcl3=%u aac=%d "
                 "sm=%d si=%u dec=%d bt=%d kdf=%d",
                 app->app_local->extcap.get_challenge,
                 app->app_local->extcap.key_import,
                 app->app_local->extcap.change_force_chv,
                 app->app_local->extcap.private_dos,
                 app->app_local->extcap.max_certlen_3,
                 app->app_local->extcap.algo_attr_change,
                 (app->app_local->extcap.sm_supported
                  ? (app->app_local->extcap.sm_algo == 0? CIPHER_ALGO_3DES :
                     (app->app_local->extcap.sm_algo == 1?
                      CIPHER_ALGO_AES : CIPHER_ALGO_AES256))
                  : 0),
                 app->app_local->status_indicator,
                 app->app_local->extcap.has_decrypt,
                 app->app_local->extcap.has_button,
                 app->app_local->extcap.kdf_do);
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       return 0;
     }
   if (table[idx].special == -3)
     {
       char const tmp[] = "OPENPGP.3";
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       return 0;
     }
   if (table[idx].special == -4)
     {
       char *serial = app_get_serialno (app);
 
       if (serial)
         {
           if (strlen (serial) > 16+12)
             {
               send_status_info (ctrl, table[idx].name, serial+16, 12, NULL, 0);
               xfree (serial);
               return 0;
             }
           xfree (serial);
         }
       return gpg_error (GPG_ERR_INV_NAME);
     }
   if (table[idx].special == -5)
     {
       for (i=0; i < 3; i++)
         send_key_attr (ctrl, app, table[idx].name, i);
       return 0;
     }
   if (table[idx].special == -6)
     {
       char const tmp[] = "OPENPGP.2";
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       return 0;
     }
   if (table[idx].special == -7)
     {
       char const tmp[] = "OPENPGP.1";
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
       return 0;
     }
   if (table[idx].special == -8)
     {
       return send_status_printf
         (ctrl, table[idx].name, "%u %s",
          app->app_local->manufacturer,
          get_manufacturer (app->app_local->manufacturer));
     }
   if (table[idx].special == -9)
     {
       rc = do_getattr (app, ctrl, "UIF-1");
       if (!rc)
         rc = do_getattr (app, ctrl, "UIF-2");
       if (!rc)
         rc = do_getattr (app, ctrl, "UIF-3");
       return rc;
     }
 
   relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &rc);
   if (relptr)
     {
       if (table[idx].special == 1)
         {
           char numbuf[7*23];
 
           for (i=0,*numbuf=0; i < valuelen && i < 7; i++)
             sprintf (numbuf+strlen (numbuf), " %d", value[i]);
           send_status_info (ctrl, table[idx].name,
                             numbuf, strlen (numbuf), NULL, 0);
         }
       else if (table[idx].special == 2)
         {
           char numbuf[50];
 
           sprintf (numbuf, "%lu", convert_sig_counter_value (value, valuelen));
           send_status_info (ctrl, table[idx].name,
                             numbuf, strlen (numbuf), NULL, 0);
         }
       else if (table[idx].special == 3)
         {
           if (valuelen >= 60)
             for (i=0; i < 3; i++)
               send_fpr_if_not_null (ctrl, table[idx].name, i+1, value+i*20);
         }
       else if (table[idx].special == 4)
         {
           if (valuelen >= 12)
             for (i=0; i < 3; i++)
               send_fprtime_if_not_null (ctrl, table[idx].name, i+1, value+i*4);
         }
       else if (table[idx].special == 5)
         {
           if ((valuelen == KDF_DATA_LENGTH_MIN
                || valuelen == KDF_DATA_LENGTH_MAX)
               && (value[2] == 0x03))
             app->app_local->pinpad.disabled = 1;
           else
             app->app_local->pinpad.disabled = 0;
 
           send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);
         }
       else if (table[idx].special == 6)
         {
           for (i=0,rc=0; !rc && i+1 < valuelen; i += 2)
             rc = send_status_printf (ctrl, table[idx].name, "OPENPGP.%u %u",
                                      value[i], value[i+1]);
           if (gpg_err_code (rc) == GPG_ERR_NO_OBJ)
             rc = gpg_error (GPG_ERR_NOT_SUPPORTED);
         }
       else if (table[idx].special == 7)
         {
           const unsigned char *p = value;
           int tag;
           size_t len;
 
           if (valuelen < 2)
             return gpg_error (GPG_ERR_INV_OBJ);
 
           tag = p[0];
           len = p[1];
 
           /* Does it comes tag+len at the head?  */
           if (tag == 0x00FA)
             {
               p += 2;
 
               if (len == 0x81)
                 {
                   if (valuelen < 3)
                     return gpg_error (GPG_ERR_INV_OBJ);
                   len = *p++;
                 }
               else if (len == 0x82)
                 {
                   if (valuelen < 4)
                     return gpg_error (GPG_ERR_INV_OBJ);
                   len = *p++;
                   len = (len << 8) | *p++;
                 }
 
               valuelen -= (p - value);
               value = (unsigned char *)p;
 
               if (valuelen != len)
                 {
                   if (opt.verbose)
                     log_info ("Yubikey bug: length %zu != %zu", valuelen, len);
 
                   if (app->card->cardtype != CARDTYPE_YUBIKEY)
                     return gpg_error (GPG_ERR_INV_OBJ);
                 }
             }
 
           for (; p < value + valuelen; p += len)
             {
               const char *key_algo_str;
               int keyrefno;
 
               if (p + 2 > value + valuelen)
                 break;
 
               tag = *p++;
               len = *p++;
 
               if (tag < 0xc1)
                 continue;
 
               if (tag == 0xda)
                 keyrefno = 0x81;
               else
                 keyrefno = tag - 0xc1 + 1;
 
               if (p + len > value + valuelen)
                 break;
 
               key_algo_str = get_algorithm_attribute_string (p, len);
 
               send_status_printf (ctrl, table[idx].name, "OPENPGP.%u %s",
                                   keyrefno, key_algo_str);
             }
         }
       else
         send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);
 
       xfree (relptr);
     }
   else
     {
       if (table[idx].special == 5)
         app->app_local->pinpad.disabled = 0;
     }
   return rc;
 }
 
 
 /* Return the DISP-NAME without any padding characters.  Caller must
  * free the result.  If not found or empty NULL is returned.  */
 static char *
 get_disp_name (app_t app)
 {
   int rc;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
   char *string;
   char *p, *given;
   char *result;
 
   relptr = get_one_do (app, 0x005B, &value, &valuelen, &rc);
   if (!relptr)
     return NULL;
 
   string = xtrymalloc (valuelen + 1);
   if (!string)
     {
       xfree (relptr);
       return NULL;
     }
   memcpy (string, value, valuelen);
   string[valuelen] = 0;
   xfree (relptr);
 
   /* Swap surname and given name.  */
   given = strstr (string, "<<");
   for (p = string; *p; p++)
     if (*p == '<')
       *p = ' ';
 
   if (given && given[2])
     {
       *given = 0;
       given += 2;
       result = strconcat (given, " ", string, NULL);
     }
   else
     {
       result = string;
       string = NULL;
     }
 
   xfree (string);
   return result;
 }
 
 
 /* Return the pretty formatted serialnumber.  On error NULL is
  * returned.  */
 static char *
 get_disp_serialno (app_t app)
 {
   char *serial = app_get_serialno (app);
 
   /* For our OpenPGP cards we do not want to show the entire serial
    * number but a nicely reformatted actual serial number.  */
   if (serial && strlen (serial) > 16+12)
     {
       memmove (serial, serial+16, 4);
       serial[4] = ' ';
       /* memmove (serial+5, serial+20, 4); */
       /* serial[9] = ' '; */
       /* memmove (serial+10, serial+24, 4); */
       /* serial[14] = 0; */
       memmove (serial+5, serial+20, 8);
       serial[13] = 0;
     }
   return serial;
 }
 
 
 /* Return the number of remaining tries for the standard or the admin
  * pw.  Returns -1 on card error.  */
 static int
 get_remaining_tries (app_t app, int adminpw)
 {
   void *relptr;
   unsigned char *value;
   size_t valuelen;
   int remaining;
 
   relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
   if (!relptr || valuelen < 7)
     {
       log_error (_("error retrieving CHV status from card\n"));
       xfree (relptr);
       return -1;
     }
   remaining = value[adminpw? 6 : 4];
   xfree (relptr);
   return remaining;
 }
 
 
 /* Retrieve the fingerprint from the card inserted in SLOT and write
    the according hex representation to FPR.  Caller must have provide
    a buffer at FPR of least 41 bytes.  Returns 0 on success or an
    error code. */
 static gpg_error_t
 retrieve_fpr_from_card (app_t app, int keyno, char *fpr)
 {
   gpg_error_t err = 0;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
 
   assert (keyno >=0 && keyno <= 2);
 
   relptr = get_one_do (app, 0x00C5, &value, &valuelen, NULL);
   if (relptr && valuelen >= 60)
     bin2hex (value+keyno*20, 20, fpr);
   else
     err = gpg_error (GPG_ERR_NOT_FOUND);
   xfree (relptr);
   return err;
 }
 
 
 /* Retrieve the creation time of the fingerprint for key KEYNO from
  * the card inserted in the slot of APP and store it at R_FPRTIME.
  * Returns 0 on success or an error code.  */
 static gpg_error_t
 retrieve_fprtime_from_card (app_t app, int keyno, u32 *r_fprtime)
 {
   gpg_error_t err = 0;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
   u32 fprtime;
 
   log_assert (keyno >=0 && keyno <= 2);
 
   relptr = get_one_do (app, 0x00CD, &value, &valuelen, NULL);
   if (relptr && valuelen >= 4*(keyno+1))
     {
       fprtime = buf32_to_u32 (value + 4*keyno);
       if (!fprtime)
         err = gpg_error (GPG_ERR_NOT_FOUND);
       else
         *r_fprtime = fprtime;
     }
   else
     err = gpg_error (GPG_ERR_NOT_FOUND);
   xfree (relptr);
   return err;
 }
 
 
 /* Retrieve the public key material for the RSA key, whose fingerprint
    is FPR, from gpg output, which can be read through the stream FP.
    The RSA modulus will be stored at the address of M and MLEN, the
    public exponent at E and ELEN.  Returns zero on success, an error
    code on failure.  Caller must release the allocated buffers at M
    and E if the function returns success.  */
 static gpg_error_t
 retrieve_key_material (FILE *fp, const char *hexkeyid,
                        const unsigned char **m, size_t *mlen,
                        const unsigned char **e, size_t *elen)
 {
   gcry_error_t err = 0;
   char *line = NULL;    /* read_line() buffer. */
   size_t line_size = 0; /* Helper for for read_line. */
   int found_key = 0;    /* Helper to find a matching key. */
   unsigned char *m_new = NULL;
   unsigned char *e_new = NULL;
   size_t m_new_n = 0;
   size_t e_new_n = 0;
 
   /* Loop over all records until we have found the subkey
      corresponding to the fingerprint. Inm general the first record
      should be the pub record, but we don't rely on that.  Given that
      we only need to look at one key, it is sufficient to compare the
      keyid so that we don't need to look at "fpr" records. */
   for (;;)
     {
       char *p;
       char *fields[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
       int nfields;
       size_t max_length;
       gcry_mpi_t mpi;
       int i;
 
       max_length = 4096;
       i = read_line (fp, &line, &line_size, &max_length);
       if (!i)
         break; /* EOF. */
       if (i < 0)
         {
           err = gpg_error_from_syserror ();
           goto leave; /* Error. */
         }
       if (!max_length)
         {
           err = gpg_error (GPG_ERR_TRUNCATED);
           goto leave;  /* Line truncated - we better stop processing.  */
         }
 
       /* Parse the line into fields. */
       for (nfields=0, p=line; p && nfields < DIM (fields); nfields++)
         {
           fields[nfields] = p;
           p = strchr (p, ':');
           if (p)
             *(p++) = 0;
         }
       if (!nfields)
         continue; /* No fields at all - skip line.  */
 
       if (!found_key)
         {
           if ( (!strcmp (fields[0], "sub") || !strcmp (fields[0], "pub") )
                && nfields > 4 && !strcmp (fields[4], hexkeyid))
             found_key = 1;
           continue;
         }
 
       if ( !strcmp (fields[0], "sub") || !strcmp (fields[0], "pub") )
         break; /* Next key - stop.  */
 
       if ( strcmp (fields[0], "pkd") )
         continue; /* Not a key data record.  */
       if ( nfields < 4 || (i = atoi (fields[1])) < 0 || i > 1
            || (!i && m_new) || (i && e_new))
         {
           err = gpg_error (GPG_ERR_GENERAL);
           goto leave; /* Error: Invalid key data record or not an RSA key.  */
         }
 
       err = gcry_mpi_scan (&mpi, GCRYMPI_FMT_HEX, fields[3], 0, NULL);
       if (err)
         mpi = NULL;
       else if (!i)
         err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &m_new, &m_new_n, mpi);
       else
         err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &e_new, &e_new_n, mpi);
       gcry_mpi_release (mpi);
       if (err)
         goto leave;
     }
 
   if (m_new && e_new)
     {
       *m = m_new;
       *mlen = m_new_n;
       m_new = NULL;
       *e = e_new;
       *elen = e_new_n;
       e_new = NULL;
     }
   else
     err = gpg_error (GPG_ERR_GENERAL);
 
  leave:
   xfree (m_new);
   xfree (e_new);
   xfree (line);
   return err;
 }
 
 
 static gpg_error_t
 rsa_read_pubkey (app_t app, ctrl_t ctrl, u32 created_at,  int keyno,
                  const unsigned char *data, size_t datalen, gcry_sexp_t *r_sexp)
 {
   gpg_error_t err;
   const unsigned char *m, *e;
   size_t mlen, elen;
   unsigned char *mbuf = NULL, *ebuf = NULL;
 
   m = find_tlv (data, datalen, 0x0081, &mlen);
   if (!m)
     {
       log_error (_("response does not contain the RSA modulus\n"));
       return gpg_error (GPG_ERR_CARD);
     }
 
   e = find_tlv (data, datalen, 0x0082, &elen);
   if (!e)
     {
       log_error (_("response does not contain the RSA public exponent\n"));
       return gpg_error (GPG_ERR_CARD);
     }
 
   if (ctrl)
     {
       send_key_data (ctrl, "n", m, mlen);
       send_key_data (ctrl, "e", e, elen);
     }
 
   for (; mlen && !*m; mlen--, m++) /* strip leading zeroes */
     ;
   for (; elen && !*e; elen--, e++) /* strip leading zeroes */
     ;
 
   if (ctrl)
     {
       unsigned char fprbuf[20];
 
       err = store_fpr (app, keyno, created_at, fprbuf, PUBKEY_ALGO_RSA,
                        m, mlen, e, elen);
       if (err)
         return err;
 
       send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf);
     }
 
   mbuf = xtrymalloc (mlen + 1);
   if (!mbuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   /* Prepend numbers with a 0 if needed.  */
   if (mlen && (*m & 0x80))
     {
       *mbuf = 0;
       memcpy (mbuf+1, m, mlen);
       mlen++;
     }
   else
     memcpy (mbuf, m, mlen);
 
   ebuf = xtrymalloc (elen + 1);
   if (!ebuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   /* Prepend numbers with a 0 if needed.  */
   if (elen && (*e & 0x80))
     {
       *ebuf = 0;
       memcpy (ebuf+1, e, elen);
       elen++;
     }
   else
     memcpy (ebuf, e, elen);
 
   err = gcry_sexp_build (r_sexp, NULL, "(public-key(rsa(n%b)(e%b)))",
                          (int)mlen, mbuf, (int)elen, ebuf);
  leave:
   xfree (mbuf);
   xfree (ebuf);
   return err;
 }
 
 
 /* Determine KDF hash algorithm and KEK encryption algorithm by CURVE.  */
 static const unsigned char*
 ecdh_params (const char *curve)
 {
   unsigned int nbits;
 
   openpgp_curve_to_oid (curve, &nbits, NULL);
 
   /* See RFC-6637 for those constants.
          0x03: Number of bytes
          0x01: Version for this parameter format
          KEK digest algorithm
          KEK cipher algorithm
   */
   if (nbits <= 256)
     return (const unsigned char*)"\x03\x01\x08\x07";
   else if (nbits <= 384)
     return (const unsigned char*)"\x03\x01\x09\x09";
   else
     return (const unsigned char*)"\x03\x01\x0a\x09";
 }
 
 static gpg_error_t
 ecc_read_pubkey (app_t app, ctrl_t ctrl, u32 created_at, int keyno,
                  const unsigned char *data, size_t datalen, gcry_sexp_t *r_sexp)
 {
   gpg_error_t err;
   unsigned char *qbuf = NULL;
   const unsigned char *ecc_q;
   size_t ecc_q_len;
   gcry_mpi_t oid = NULL;
   int n;
   const char *curve;
   const char *oidstr;
   const unsigned char *oidbuf;
   size_t oid_len;
   int algo;
   const char *format;
 
   ecc_q = find_tlv (data, datalen, 0x0086, &ecc_q_len);
   if (!ecc_q)
     {
       log_error (_("response does not contain the EC public key\n"));
       return gpg_error (GPG_ERR_CARD);
     }
 
   curve = app->app_local->keyattr[keyno].ecc.curve;
   oidstr = openpgp_curve_to_oid (curve, NULL, NULL);
   err = openpgp_oid_from_str (oidstr, &oid);
   if (err)
     return err;
   oidbuf = gcry_mpi_get_opaque (oid, &n);
   if (!oidbuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   oid_len = (n+7)/8;
 
   qbuf = xtrymalloc (ecc_q_len + 1);
   if (!qbuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   if ((app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
     {               /* Prepend 0x40 prefix.  */
       *qbuf = 0x40;
       memcpy (qbuf+1, ecc_q, ecc_q_len);
       ecc_q_len++;
     }
   else
     memcpy (qbuf, ecc_q, ecc_q_len);
 
   if (ctrl)
     {
       send_key_data (ctrl, "q", qbuf, ecc_q_len);
       send_key_data (ctrl, "curve", oidbuf, oid_len);
     }
 
   if (keyno == 1)
     {
       if (ctrl)
         send_key_data (ctrl, "kdf/kek", ecdh_params (curve), (size_t)4);
       algo = PUBKEY_ALGO_ECDH;
     }
   else
     {
       if ((app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
         algo = PUBKEY_ALGO_EDDSA;
       else
         algo = PUBKEY_ALGO_ECDSA;
     }
 
   if (ctrl)
     {
       unsigned char fprbuf[20];
 
       err = store_fpr (app, keyno, created_at, fprbuf, algo, oidbuf, oid_len,
                        qbuf, ecc_q_len, ecdh_params (curve), (size_t)4);
       if (err)
         goto leave;
 
       send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf);
     }
 
   if (!(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
     format = "(public-key(ecc(curve%s)(q%b)))";
   else if (keyno == 1)
     format = "(public-key(ecc(curve%s)(flags djb-tweak)(q%b)))";
   else
     format = "(public-key(ecc(curve%s)(flags eddsa)(q%b)))";
 
   err = gcry_sexp_build (r_sexp, NULL, format,
                          app->app_local->keyattr[keyno].ecc.curve,
                          (int)ecc_q_len, qbuf);
  leave:
   gcry_mpi_release (oid);
   xfree (qbuf);
   return err;
 }
 
 
 static gpg_error_t
 store_keygrip (app_t app, int keyno)
 {
   gpg_error_t err;
   unsigned char grip[20];
 
   err = keygrip_from_canon_sexp (app->app_local->pk[keyno].key,
                                  app->app_local->pk[keyno].keylen,
                                  grip);
   if (err)
     return err;
 
   bin2hex (grip, 20, app->app_local->pk[keyno].keygrip_str);
   return 0;
 }
 
 
 /* Parse tag-length-value data for public key in BUFFER of BUFLEN
    length.  Key of KEYNO in APP is updated with an S-expression of
    public key.  When CTRL is not NULL, fingerprint is computed with
    CREATED_AT, and fingerprint is written to the card, and key data
    and fingerprint are send back to the client side.
  */
 static gpg_error_t
 read_public_key (app_t app, ctrl_t ctrl, u32 created_at, int keyno,
                  const unsigned char *buffer, size_t buflen)
 {
   gpg_error_t err;
   const unsigned char *data;
   size_t datalen;
   gcry_sexp_t s_pkey = NULL;
 
   data = find_tlv (buffer, buflen, 0x7F49, &datalen);
   if (!data)
     {
       log_error (_("response does not contain the public key data\n"));
       return gpg_error (GPG_ERR_CARD);
     }
 
   if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
     err = rsa_read_pubkey (app, ctrl, created_at, keyno,
                            data, datalen, &s_pkey);
   else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECC)
     err = ecc_read_pubkey (app, ctrl, created_at, keyno,
                            data, datalen, &s_pkey);
   else
     err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
 
   if (!err)
     {
       unsigned char *keybuf;
       size_t len;
 
       len = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0);
       keybuf = xtrymalloc (len);
       if (!data)
         {
           err = gpg_error_from_syserror ();
           gcry_sexp_release (s_pkey);
           return err;
         }
 
       gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, keybuf, len);
       gcry_sexp_release (s_pkey);
 
       app->app_local->pk[keyno].key = keybuf;
       /* Decrement for trailing '\0' */
       app->app_local->pk[keyno].keylen = len - 1;
 
       err = store_keygrip (app, keyno);
     }
 
   return err;
 }
 
 
 /* Get the public key for KEYNO and store it as an S-expression with
    the APP handle.  On error that field gets cleared.  If we already
    know about the public key we will just return.  Note that this does
    not mean a key is available; this is solely indicated by the
    presence of the app->app_local->pk[KEYNO].key field.
 
    Note that GnuPG 1.x does not need this and it would be too time
    consuming to send it just for the fun of it. However, given that we
    use the same code in gpg 1.4, we can't use the gcry S-expression
    here but need to open encode it. */
 static gpg_error_t
 get_public_key (app_t app, int keyno)
 {
   gpg_error_t err = 0;
   unsigned char *buffer;
   const unsigned char *m, *e;
   size_t buflen;
   size_t mlen = 0;
   size_t elen = 0;
   char *keybuf = NULL;
   gcry_sexp_t s_pkey;
   size_t len;
 
   if (keyno < 0 || keyno > 2)
     return gpg_error (GPG_ERR_INV_ID);
 
   /* Already cached? */
   if (app->app_local->pk[keyno].read_done)
     return 0;
 
   xfree (app->app_local->pk[keyno].key);
   app->app_local->pk[keyno].key = NULL;
   app->app_local->pk[keyno].keylen = 0;
 
   m = e = NULL; /* (avoid cc warning) */
 
   if (app->appversion > 0x0100)
     {
       int exmode, le_value;
 
       /* We may simply read the public key out of these cards.  */
       if (app->app_local->cardcap.ext_lc_le
           && app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA
           && app->app_local->keyattr[keyno].rsa.n_bits > RSA_SMALL_SIZE_KEY)
         {
           exmode = 1;    /* Use extended length.  */
           le_value = determine_rsa_response (app, keyno);
         }
       else
         {
           exmode = 0;
           le_value = 256; /* Use legacy value. */
         }
 
       err = iso7816_read_public_key (app_get_slot (app), exmode,
                                      (keyno == 0? "\xB6" :
                                       keyno == 1? "\xB8" : "\xA4"),
                                      2, le_value, &buffer, &buflen);
       if (err)
         {
           /* Yubikey returns wrong code.  Fix it up.  */
           if (app->card->cardtype == CARDTYPE_YUBIKEY)
             err = gpg_error (GPG_ERR_NO_OBJ);
           log_error (_("reading public key failed: %s\n"), gpg_strerror (err));
           goto leave;
         }
 
       err = read_public_key (app, NULL, 0U, keyno, buffer, buflen);
     }
   else
     {
       /* Due to a design problem in v1.0 cards we can't get the public
          key out of these cards without doing a verify on CHV3.
          Clearly that is not an option and thus we try to locate the
          key using an external helper.
 
          The helper we use here is gpg itself, which should know about
          the key in any case.  */
 
       char fpr[41];
       char *hexkeyid;
       char *command = NULL;
       FILE *fp;
       int ret;
 
       buffer = NULL; /* We don't need buffer.  */
 
       err = retrieve_fpr_from_card (app, keyno, fpr);
       if (err)
         {
           log_error ("error while retrieving fpr from card: %s\n",
                      gpg_strerror (err));
           goto leave;
         }
       hexkeyid = fpr + 24;
 
       ret = gpgrt_asprintf
         (&command, "%s --list-keys --with-colons --with-key-data '%s'",
          gnupg_module_name (GNUPG_MODULE_NAME_GPG), fpr);
       if (ret < 0)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
 
       fp = popen (command, "r");
       xfree (command);
       if (!fp)
         {
           err = gpg_error_from_syserror ();
           log_error ("running gpg failed: %s\n", gpg_strerror (err));
           goto leave;
         }
 
       err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen);
       pclose (fp);
       if (err)
         {
           log_error ("error while retrieving key material through pipe: %s\n",
                      gpg_strerror (err));
           goto leave;
         }
 
       err = gcry_sexp_build (&s_pkey, NULL, "(public-key(rsa(n%b)(e%b)))",
                              (int)mlen, m, (int)elen, e);
       if (err)
         goto leave;
 
       len = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0);
 
       keybuf = xtrymalloc (len);
       if (!keybuf)
         {
           err = gpg_error_from_syserror ();
           gcry_sexp_release (s_pkey);
           goto leave;
         }
 
       gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, keybuf, len);
       gcry_sexp_release (s_pkey);
 
       app->app_local->pk[keyno].key = (unsigned char*)keybuf;
       /* Decrement for trailing '\0' */
       app->app_local->pk[keyno].keylen = len - 1;
       err = store_keygrip (app, keyno);
     }
 
  leave:
   /* Set a flag to indicate that we tried to read the key.  */
   if (!err)
     app->app_local->pk[keyno].read_done = 1;
 
   xfree (buffer);
   return err;
 }
 
 
 /* Send the KEYPAIRINFO back. KEY needs to be in the range [1,3].
    This is used by the LEARN command. */
 static gpg_error_t
 send_keypair_info (app_t app, ctrl_t ctrl, int key)
 {
   int keyno = key - 1;
   gpg_error_t err = 0;
   const char *usage;
   u32 fprtime;
+  char *algostr = NULL;
 
   err = get_public_key (app, keyno);
   if (err)
     goto leave;
 
   assert (keyno >= 0 && keyno <= 2);
   if (!app->app_local->pk[keyno].key)
     goto leave; /* No such key - ignore. */
 
   switch (keyno)
     {
     case 0: usage = "sc"; break;
     case 1: usage = "e";  break;
     case 2: usage = "sa"; break;
     default: usage = "-";  break;
     }
 
   if (retrieve_fprtime_from_card (app, keyno, &fprtime))
     fprtime = 0;
 
-  err = send_status_printf (ctrl, "KEYPAIRINFO", "%s OPENPGP.%d %s %lu",
+  {
+    gcry_sexp_t s_pkey;
+    if (gcry_sexp_new (&s_pkey, app->app_local->pk[keyno].key,
+                       app->app_local->pk[keyno].keylen, 0))
+      algostr = xtrystrdup ("?");
+    else
+      {
+        algostr = pubkey_algo_string (s_pkey, NULL);
+        gcry_sexp_release (s_pkey);
+      }
+  }
+  if (!algostr)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  err = send_status_printf (ctrl, "KEYPAIRINFO", "%s OPENPGP.%d %s %lu %s",
                             app->app_local->pk[keyno].keygrip_str,
-                            keyno+1, usage, (unsigned long)fprtime);
+                            keyno+1, usage, (unsigned long)fprtime, algostr);
 
  leave:
+  xfree (algostr);
   return err;
 }
 
 
 /* Handle the LEARN command for OpenPGP.  */
 static gpg_error_t
 do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 {
   (void)flags;
 
   do_getattr (app, ctrl, "EXTCAP");
   do_getattr (app, ctrl, "MANUFACTURER");
   do_getattr (app, ctrl, "DISP-NAME");
   do_getattr (app, ctrl, "DISP-LANG");
   do_getattr (app, ctrl, "DISP-SEX");
   do_getattr (app, ctrl, "PUBKEY-URL");
   do_getattr (app, ctrl, "LOGIN-DATA");
   do_getattr (app, ctrl, "KEY-FPR");
   if (app->appversion > 0x0100)
     do_getattr (app, ctrl, "KEY-TIME");
   do_getattr (app, ctrl, "CA-FPR");
   do_getattr (app, ctrl, "CHV-STATUS");
   do_getattr (app, ctrl, "SIG-COUNTER");
   if (app->app_local->extcap.kdf_do)
     do_getattr (app, ctrl, "KDF");
   if (app->app_local->extcap.has_button)
     do_getattr (app, ctrl, "UIF");
   if (app->app_local->extcap.private_dos)
     {
       do_getattr (app, ctrl, "PRIVATE-DO-1");
       do_getattr (app, ctrl, "PRIVATE-DO-2");
       if (app->did_chv2)
         do_getattr (app, ctrl, "PRIVATE-DO-3");
       if (app->did_chv3)
         do_getattr (app, ctrl, "PRIVATE-DO-4");
     }
   send_keypair_info (app, ctrl, 1);
   send_keypair_info (app, ctrl, 2);
   send_keypair_info (app, ctrl, 3);
   /* Note: We do not send the Cardholder Certificate, because that is
      relatively long and for OpenPGP applications not really needed.  */
   return 0;
 }
 
 
 /* Handle the READKEY command for OpenPGP.  On success a canonical
    encoded S-expression with the public key will get stored at PK and
    its length (for assertions) at PKLEN; the caller must release that
    buffer. On error PK and PKLEN are not changed and an error code is
    returned.  */
 static gpg_error_t
 do_readkey (app_t app, ctrl_t ctrl, const char *keyid, unsigned int flags,
             unsigned char **pk, size_t *pklen)
 {
   gpg_error_t err;
   int keyno;
   unsigned char *buf;
 
   if (strlen (keyid) == 40)
     {
       const unsigned char *keygrip_str;
 
       for (keyno = 0; keyno < 3; keyno++)
         {
           keygrip_str = app->app_local->pk[keyno].keygrip_str;
           if (!strncmp (keygrip_str, keyid, 40))
             break;
         }
 
       if (keyno >= 3)
         return gpg_error (GPG_ERR_INV_ID);
     }
   else if (!ascii_strcasecmp (keyid, "OPENPGP.1"))
     keyno = 0;
   else if (!ascii_strcasecmp (keyid, "OPENPGP.2"))
     keyno = 1;
   else if (!ascii_strcasecmp (keyid, "OPENPGP.3"))
     keyno = 2;
   else
     return gpg_error (GPG_ERR_INV_ID);
 
   err = get_public_key (app, keyno);
   if (err)
     return err;
 
   buf = app->app_local->pk[keyno].key;
   if (!buf)
     return gpg_error (GPG_ERR_NO_PUBKEY);
 
   if ((flags & APP_READKEY_FLAG_INFO))
     {
       err = send_keypair_info (app, ctrl, keyno+1);
       if (err)
         return err;
     }
 
   if (pk && pklen)
     {
       *pklen = app->app_local->pk[keyno].keylen;
       *pk = xtrymalloc (*pklen);
       if (!*pk)
         {
           err = gpg_error_from_syserror ();
           *pklen = 0;
           return err;
         }
       memcpy (*pk, buf, *pklen);
     }
 
   return 0;
 }
 
 /* Read the standard certificate of an OpenPGP v2 card.  It is
    returned in a freshly allocated buffer with that address stored at
    CERT and the length of the certificate stored at CERTLEN.  CERTID
    needs to be set to "OPENPGP.3".  */
 static gpg_error_t
 do_readcert (app_t app, const char *certid,
              unsigned char **cert, size_t *certlen)
 {
   gpg_error_t err;
   unsigned char *buffer;
   size_t buflen;
   void *relptr;
 
   *cert = NULL;
   *certlen = 0;
   if (strcmp (certid, "OPENPGP.3"))
     return gpg_error (GPG_ERR_INV_ID);
   if (!app->app_local->extcap.is_v2)
     return gpg_error (GPG_ERR_NOT_FOUND);
 
   relptr = get_one_do (app, 0x7F21, &buffer, &buflen, NULL);
   if (!relptr)
     return gpg_error (GPG_ERR_NOT_FOUND);
 
   if (!buflen)
     err = gpg_error (GPG_ERR_NOT_FOUND);
   else if (!(*cert = xtrymalloc (buflen)))
     err = gpg_error_from_syserror ();
   else
     {
       memcpy (*cert, buffer, buflen);
       *certlen = buflen;
       err  = 0;
     }
   xfree (relptr);
   return err;
 }
 
 
 /* Decide if we use the pinpad of the reader for PIN input according
    to the user preference on the card, and the capability of the
    reader.  This routine is only called when the reader has pinpad.
    Returns 0 if we use pinpad, 1 otherwise.  */
 static int
 check_pinpad_request (app_t app, pininfo_t *pininfo, int admin_pin)
 {
   if (app->app_local->pinpad.disabled)
     return 1;
 
   if (app->app_local->pinpad.specified == 0) /* No preference on card.  */
     {
       if (pininfo->fixedlen == 0) /* Reader has varlen capability.  */
         return 0;                 /* Then, use pinpad.  */
       else
         /*
          * Reader has limited capability, and it may not match PIN of
          * the card.
          */
         return 1;
     }
 
   if (admin_pin)
     pininfo->fixedlen = app->app_local->pinpad.fixedlen_admin;
   else
     pininfo->fixedlen = app->app_local->pinpad.fixedlen_user;
 
   if (pininfo->fixedlen == 0    /* User requests disable pinpad.  */
       || pininfo->fixedlen < pininfo->minlen
       || pininfo->fixedlen > pininfo->maxlen
       /* Reader doesn't have the capability to input a PIN which
        * length is FIXEDLEN.  */)
     return 1;
 
   return 0;
 }
 
 
 /* Return a string with information about the card for use in a
  * prompt.  Returns NULL on memory failure.  */
 static char *
 get_prompt_info (app_t app, int chvno, unsigned long sigcount, int remaining)
 {
   char *serial, *disp_name, *rembuf, *tmpbuf, *result;
 
   serial = get_disp_serialno (app);
   if (!serial)
     return NULL;
 
   disp_name = get_disp_name (app);
   if (chvno == 1)
     {
       /* TRANSLATORS: Put a \x1f right before a colon.  This can be
        * used by pinentry to nicely align the names and values.  Keep
        * the %s at the start and end of the string.  */
       result = xtryasprintf (_("%s"
                                "Number\x1f: %s%%0A"
                                "Holder\x1f: %s%%0A"
                                "Counter\x1f: %lu"
                                "%s"),
                              "\x1e",
                              serial,
                              disp_name? disp_name:"",
                              sigcount,
                              "");
     }
   else
     {
       result = xtryasprintf (_("%s"
                                "Number\x1f: %s%%0A"
                                "Holder\x1f: %s"
                                "%s"),
                              "\x1e",
                              serial,
                              disp_name? disp_name:"",
                              "");
     }
   xfree (disp_name);
   xfree (serial);
 
   if (remaining != -1)
     {
       /* TRANSLATORS: This is the number of remaining attempts to
        * enter a PIN.  Use %%0A (double-percent,0A) for a linefeed. */
       rembuf = xtryasprintf (_("Remaining attempts: %d"), remaining);
       if (!rembuf)
         {
           xfree (result);
           return NULL;
         }
       tmpbuf = strconcat (result, "%0A%0A", rembuf, NULL);
       xfree (rembuf);
       if (!tmpbuf)
         {
           xfree (result);
           return NULL;
         }
       xfree (result);
       result = tmpbuf;
     }
 
   return result;
 }
 
 /* Compute hash if KDF-DO is available.  CHVNO must be 0 for reset
  * code, 1 or 2 for user pin and 3 for admin pin.  PIN is the original
  * PIN as entered by the user.  R_PINVALUE and r_PINLEN will receive a
  * newly allocated buffer with a possible modified pin.  */
 static gpg_error_t
 pin2hash_if_kdf (app_t app, int chvno, const char *pin,
                  char **r_pinvalue, size_t *r_pinlen)
 {
   gpg_error_t err = 0;
   void *relptr = NULL;
   unsigned char *buffer;
   size_t pinlen, buflen;
   char *dek = NULL;
   size_t deklen = 32;
 
   *r_pinvalue = NULL;
   *r_pinlen = 0;
 
   pinlen = strlen (pin);
   if (app->app_local->extcap.kdf_do
       && (relptr = get_one_do (app, 0x00F9, &buffer, &buflen, NULL))
       && buflen >= KDF_DATA_LENGTH_MIN && (buffer[2] == 0x03))
     {
       const char *salt;
       unsigned long s2k_count;
       int salt_index;
 
       dek = xtrymalloc (deklen);
       if (!dek)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
 
       s2k_count = (((unsigned int)buffer[8] << 24)
                    | (buffer[9] << 16) | (buffer[10] << 8) | buffer[11]);
 
       if (buflen == KDF_DATA_LENGTH_MIN)
         salt_index =14;
       else if (buflen == KDF_DATA_LENGTH_MAX)
         salt_index = (chvno==3 ? 34 : (chvno==0 ? 24 : 14));
       else
         {
           err = gpg_error (GPG_ERR_INV_DATA);
           goto leave;
         }
 
       salt = &buffer[salt_index];
       err = gcry_kdf_derive (pin, pinlen,
                              GCRY_KDF_ITERSALTED_S2K,
                              DIGEST_ALGO_SHA256, salt, 8,
                              s2k_count, deklen, dek);
       if (!err)
         {
           *r_pinlen = deklen;
           *r_pinvalue = dek;
           dek = NULL;
         }
     }
   else
     {
       /* Just copy the PIN to a malloced buffer.  */
       *r_pinvalue = xtrymalloc_secure (pinlen + 1);
       if (!*r_pinvalue)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       strcpy (*r_pinvalue, pin);
       *r_pinlen = pinlen;
     }
 
  leave:
   xfree (dek);
   xfree (relptr);
   return err;
 }
 
 
 static const char *
 chvno_to_keyref (int chvno)
 {
   const char *keyref;
   switch (chvno)
     {
     case 1: keyref = "1"; break;
     case 2: keyref = "2"; break;
     case 3: keyref = "3"; break;
     default: keyref = NULL; break;
     }
   return keyref;
 }
 
 
 /* Helper to cache a PIN.  If PIN is NULL the cache is cleared. */
 static void
 cache_pin (app_t app, ctrl_t ctrl, int chvno, const char *pin)
 {
   const char *keyref = chvno_to_keyref (chvno);
 
   if (!keyref)
     return;
   switch (app->card->cardtype)
     {
     case CARDTYPE_YUBIKEY: break;
     default: return;
     }
 
   pincache_put (ctrl, app_get_slot (app), "openpgp", keyref,
                 pin, pin? strlen (pin):0);
 
   switch (chvno)
     {
     case 1: app->app_local->pincache.maybe_chv1 = !!pin; break;
     case 2: app->app_local->pincache.maybe_chv2 = !!pin; break;
     case 3: app->app_local->pincache.maybe_chv3 = !!pin; break;
     }
 }
 
 
 /* If the PIN cache is expected and really has a valid PIN return that
  * pin at R_PIN.  Returns true if that is the case; otherwise
  * false.  */
 static int
 pin_from_cache (app_t app, ctrl_t ctrl, int chvno, char **r_pin)
 {
   const char *keyref = chvno_to_keyref (chvno);
   int maybe_cached;
 
   *r_pin = NULL;
 
   if (!keyref)
     return 0;
   switch (app->card->cardtype)
     {
     case CARDTYPE_YUBIKEY: break;
     default: return 0;
     }
 
   switch (chvno)
     {
     case 1: maybe_cached = app->app_local->pincache.maybe_chv1; break;
     case 2: maybe_cached = app->app_local->pincache.maybe_chv2; break;
     case 3: maybe_cached = app->app_local->pincache.maybe_chv3; break;
     default: maybe_cached = 0; break;
     }
 
   if (!maybe_cached)
     return 0;
 
   if (pincache_get (ctrl, app_get_slot (app), "openpgp", keyref, r_pin))
     return 0;
 
   return 1;
 }
 
 
 /* Verify a CHV either using the pinentry or if possible by
    using a pinpad.  PINCB and PINCB_ARG describe the usual callback
    for the pinentry.  CHVNO must be either 1 or 2. SIGCOUNT is only
    used with CHV1.  PINVALUE is the address of a pointer which will
    receive a newly allocated block with the actual PIN (this is useful
    in case that PIN shall be used for another verify operation).  The
    caller needs to free this value.  If the function returns with
    success and NULL is stored at PINVALUE, the caller should take this
    as an indication that the pinpad has been used.
    */
 static gpg_error_t
 verify_a_chv (app_t app, ctrl_t ctrl,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg, int chvno, unsigned long sigcount,
               char **r_pinvalue, size_t *r_pinlen)
 {
   int rc = 0;
   char *prompt_buffer = NULL;
   const char *prompt;
   pininfo_t pininfo;
   int minlen = 6;
   int remaining;
   char *pin = NULL;
 
   log_assert (chvno == 1 || chvno == 2);
 
   *r_pinvalue = NULL;
   *r_pinlen = 0;
 
   remaining = get_remaining_tries (app, 0);
   if (remaining == -1)
     return gpg_error (GPG_ERR_CARD);
 
   if (chvno == 2 && app->app_local->flags.def_chv2)
     {
       /* Special case for def_chv2 mechanism. */
       if (opt.verbose)
         log_info (_("using default PIN as %s\n"), "CHV2");
       rc = iso7816_verify (app_get_slot (app), 0x82, "123456", 6);
       if (rc)
         {
           /* Verification of CHV2 with the default PIN failed,
              although the card pretends to have the default PIN set as
              CHV2.  We better disable the def_chv2 flag now. */
           log_info (_("failed to use default PIN as %s: %s"
                       " - disabling further default use\n"),
                     "CHV2", gpg_strerror (rc));
           app->app_local->flags.def_chv2 = 0;
         }
       return rc;
     }
 
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.fixedlen = -1;
   pininfo.minlen = minlen;
 
   {
     const char *firstline = _("||Please unlock the card");
     char *infoblock = get_prompt_info (app, chvno, sigcount,
                                        remaining < 3? remaining : -1);
 
     prompt_buffer = strconcat (firstline, "%0A%0A", infoblock, NULL);
     if (prompt_buffer)
       prompt = prompt_buffer;
     else
       prompt = firstline;  /* ENOMEM fallback.  */
 
     xfree (infoblock);
   }
 
   if (!opt.disable_pinpad
       && !iso7816_check_pinpad (app_get_slot (app), ISO7816_VERIFY, &pininfo)
       && !check_pinpad_request (app, &pininfo, 0))
     {
       /* The reader supports the verify command through the pinpad.
        * In this case we do not utilize the PIN cache because by using
        * a pinpad the PIN can't have been cached.
        * Note that the pincb appends a text to the prompt telling the
        * user to use the pinpad. */
       rc = pincb (pincb_arg, prompt, NULL);
       prompt = NULL;
       xfree (prompt_buffer);
       prompt_buffer = NULL;
       if (rc)
         {
           log_info (_("PIN callback returned error: %s\n"),
                     gpg_strerror (rc));
           return rc;
         }
       rc = iso7816_verify_kp (app_get_slot (app), 0x80+chvno, &pininfo);
       /* Dismiss the prompt. */
       pincb (pincb_arg, NULL, NULL);
     }
   else
     {
       /* The reader has no pinpad or we don't want to use it.  If we
        * have at least the standard 3 remaining tries we first try to
        * get the PIN from the cache.  With less remaining tries it is
        * better to let the user know about failed attempts (which
        * might be due to a bug in the PIN cache handling). */
       if (remaining >= 3 && pin_from_cache (app, ctrl, chvno, &pin))
         rc = 0;
       else
         rc = pincb (pincb_arg, prompt, &pin);
       prompt = NULL;
       xfree (prompt_buffer);
       prompt_buffer = NULL;
       if (rc)
         {
           log_info (_("PIN callback returned error: %s\n"),
                     gpg_strerror (rc));
           return rc;
         }
 
       if (strlen (pin) < minlen)
         {
           log_error (_("PIN for CHV%d is too short;"
                        " minimum length is %d\n"), chvno, minlen);
           wipe_and_free_string (pin);
           return gpg_error (GPG_ERR_BAD_PIN);
         }
 
       rc = pin2hash_if_kdf (app, chvno, pin, r_pinvalue, r_pinlen);
       if (!rc)
         rc = iso7816_verify (app_get_slot (app),
                              0x80 + chvno, *r_pinvalue, *r_pinlen);
       if (!rc)
         cache_pin (app, ctrl, chvno, pin);
     }
 
   wipe_and_free_string (pin);
   if (rc)
     {
       log_error (_("verify CHV%d failed: %s\n"), chvno, gpg_strerror (rc));
       xfree (*r_pinvalue);
       *r_pinvalue = NULL;
       *r_pinlen = 0;
       flush_cache_after_error (app);
     }
 
   return rc;
 }
 
 
 /* Verify CHV2 if required.  Depending on the configuration of the
    card CHV1 will also be verified. */
 static gpg_error_t
 verify_chv2 (app_t app, ctrl_t ctrl,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg)
 {
   int rc;
   char *pinvalue;
   size_t pinlen;
 
   if (app->did_chv2)
     return 0;  /* We already verified CHV2.  */
 
   if (app->app_local->pk[1].key || app->app_local->pk[2].key)
     {
       rc = verify_a_chv (app, ctrl, pincb, pincb_arg, 2, 0, &pinvalue, &pinlen);
       if (rc)
         return rc;
       app->did_chv2 = 1;
 
       if (!app->did_chv1 && !app->force_chv1 && pinvalue)
         {
           /* For convenience we verify CHV1 here too.  We do this only if
              the card is not configured to require a verification before
              each CHV1 controlled operation (force_chv1) and if we are not
              using the pinpad (PINVALUE == NULL). */
           rc = iso7816_verify (app_get_slot (app), 0x81, pinvalue, pinlen);
           if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
             rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
           if (rc)
             {
               log_error (_("verify CHV%d failed: %s\n"), 1, gpg_strerror (rc));
               flush_cache_after_error (app);
             }
           else
             {
               app->did_chv1 = 1;
               /* Note that we are not able to cache the CHV 1 here because
                * it is possible that due to the use of a KDF-DO PINVALUE
                * has the hashed binary PIN of length PINLEN.  */
             }
         }
     }
   else
     {
       rc = verify_a_chv (app, ctrl, pincb, pincb_arg, 1, 0, &pinvalue, &pinlen);
       if (rc)
         return rc;
     }
 
   wipe_and_free (pinvalue, pinlen);
 
   return rc;
 }
 
 
 /* Build the prompt to enter the Admin PIN.  The prompt depends on the
  * current state of the card.  If R_REMAINING is not NULL the
  * remaining tries are stored there.  */
 static gpg_error_t
 build_enter_admin_pin_prompt (app_t app, char **r_prompt, int *r_remaining)
 {
   int remaining;
   char *prompt;
   char *infoblock;
 
   *r_prompt = NULL;
   if (r_remaining)
     *r_remaining = 0;
 
   remaining = get_remaining_tries (app, 1);
   if (remaining == -1)
     return gpg_error (GPG_ERR_CARD);
   if (!remaining)
     {
       log_info (_("card is permanently locked!\n"));
       return gpg_error (GPG_ERR_BAD_PIN);
     }
 
   log_info (ngettext("%d Admin PIN attempt remaining before card"
                      " is permanently locked\n",
                      "%d Admin PIN attempts remaining before card"
                      " is permanently locked\n",
                      remaining), remaining);
 
   infoblock = get_prompt_info (app, 3, 0, remaining < 3? remaining : -1);
 
   /* TRANSLATORS: Do not translate the "|A|" prefix but keep it at
      the start of the string.  Use %0A (single percent) for a linefeed.  */
   prompt = strconcat (_("|A|Please enter the Admin PIN"),
                       "%0A%0A", infoblock, NULL);
   xfree (infoblock);
   if (!prompt)
     return gpg_error_from_syserror ();
 
   *r_prompt = prompt;
   if (r_remaining)
     *r_remaining = remaining;
   return 0;
 }
 
 
 /* Verify CHV3 if required. */
 static gpg_error_t
 verify_chv3 (app_t app, ctrl_t ctrl,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg)
 {
   int rc = 0;
 
   if (!opt.allow_admin)
     {
       log_info (_("access to admin commands is not configured\n"));
       return gpg_error (GPG_ERR_EACCES);
     }
 
   if (!app->did_chv3)
     {
       pininfo_t pininfo;
       int minlen = 8;
       char *prompt;
       int remaining;
 
       memset (&pininfo, 0, sizeof pininfo);
       pininfo.fixedlen = -1;
       pininfo.minlen = minlen;
 
       rc = build_enter_admin_pin_prompt (app, &prompt, &remaining);
       if (rc)
         return rc;
 
       if (!opt.disable_pinpad
           && !iso7816_check_pinpad (app_get_slot (app),
                                     ISO7816_VERIFY, &pininfo)
           && !check_pinpad_request (app, &pininfo, 1))
         {
           /* The reader supports the verify command through the pinpad. */
           rc = pincb (pincb_arg, prompt, NULL);
           xfree (prompt);
           prompt = NULL;
           if (rc)
             {
               log_info (_("PIN callback returned error: %s\n"),
                         gpg_strerror (rc));
               return rc;
             }
           rc = iso7816_verify_kp (app_get_slot (app), 0x83, &pininfo);
           /* Dismiss the prompt. */
           pincb (pincb_arg, NULL, NULL);
         }
       else
         {
           char *pin;
           char *pinvalue;
           size_t pinlen;
 
           if (remaining >= 3 && pin_from_cache (app, ctrl, 3, &pin))
             rc = 0;
           else
             rc = pincb (pincb_arg, prompt, &pin);
           xfree (prompt);
           prompt = NULL;
           if (rc)
             {
               log_info (_("PIN callback returned error: %s\n"),
                         gpg_strerror (rc));
               return rc;
             }
 
           if (strlen (pin) < minlen)
             {
               log_error (_("PIN for CHV%d is too short;"
                            " minimum length is %d\n"), 3, minlen);
               wipe_and_free_string (pin);
               return gpg_error (GPG_ERR_BAD_PIN);
             }
 
           rc = pin2hash_if_kdf (app, 3, pin, &pinvalue, &pinlen);
           if (!rc)
             rc = iso7816_verify (app_get_slot (app), 0x83, pinvalue, pinlen);
           if (!rc)
             cache_pin (app, ctrl, 3, pin);
           wipe_and_free_string (pin);
           wipe_and_free (pinvalue, pinlen);
         }
 
       if (rc)
         {
           log_error (_("verify CHV%d failed: %s\n"), 3, gpg_strerror (rc));
           flush_cache_after_error (app);
           return rc;
         }
       app->did_chv3 = 1;
     }
 
   return rc;
 }
 
 
 /* Handle the SETATTR operation. All arguments are already basically
    checked. */
 static gpg_error_t
 do_setattr (app_t app, ctrl_t ctrl, const char *name,
             gpg_error_t (*pincb)(void*, const char *, char **),
             void *pincb_arg,
             const unsigned char *value, size_t valuelen)
 {
   gpg_error_t rc;
   int idx;
   static struct {
     const char *name;
     int tag;
     int flush_tag;  /* The tag which needs to be flushed or 0. */
     int need_chv;
     int special;
     unsigned int need_v2:1;
   } table[] = {
     { "DISP-NAME",    0x005B, 0,      3 },
     { "LOGIN-DATA",   0x005E, 0,      3, 2 },
     { "DISP-LANG",    0x5F2D, 0,      3 },
     { "DISP-SEX",     0x5F35, 0,      3 },
     { "PUBKEY-URL",   0x5F50, 0,      3 },
     { "CHV-STATUS-1", 0x00C4, 0,      3, 1 },
     { "CA-FPR-1",     0x00CA, 0x00C6, 3 },
     { "CA-FPR-2",     0x00CB, 0x00C6, 3 },
     { "CA-FPR-3",     0x00CC, 0x00C6, 3 },
     { "PRIVATE-DO-1", 0x0101, 0,      2 },
     { "PRIVATE-DO-2", 0x0102, 0,      3 },
     { "PRIVATE-DO-3", 0x0103, 0,      2 },
     { "PRIVATE-DO-4", 0x0104, 0,      3 },
     { "CERT-3",       0x7F21, 0,      3, 0, 1 },
     { "SM-KEY-ENC",   0x00D1, 0,      3, 0, 1 },
     { "SM-KEY-MAC",   0x00D2, 0,      3, 0, 1 },
     { "KEY-ATTR",     0,      0,      0, 3, 1 },
     { "AESKEY",       0x00D5, 0,      3, 0, 1 },
     { "UIF-1",        0x00D6, 0,      3, 5, 1 },
     { "UIF-2",        0x00D7, 0,      3, 5, 1 },
     { "UIF-3",        0x00D8, 0,      3, 5, 1 },
     { "KDF",          0x00F9, 0,      0, 4, 1 },
     { NULL, 0 }
   };
   int exmode;
 
   for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
     ;
   if (!table[idx].name)
     return gpg_error (GPG_ERR_INV_NAME);
   if (table[idx].need_v2 && !app->app_local->extcap.is_v2)
     return gpg_error (GPG_ERR_NOT_SUPPORTED); /* Not yet supported.  */
 
   if (table[idx].special == 5 && app->app_local->extcap.has_button == 0)
     return gpg_error (GPG_ERR_INV_OBJ);
 
   if (table[idx].special == 3)
     return change_keyattr_from_string (app, ctrl, pincb, pincb_arg,
                                        NULL, NULL,
                                        value, valuelen);
 
   switch (table[idx].need_chv)
     {
     case 2:
       rc = verify_chv2 (app, ctrl, pincb, pincb_arg);
       break;
     case 3:
       rc = verify_chv3 (app, ctrl, pincb, pincb_arg);
       break;
     default:
       rc = 0;
     }
   if (rc)
     return rc;
 
   /* Flush the cache before writing it, so that the next get operation
      will reread the data from the card and thus get synced in case of
      errors (e.g. data truncated by the card). */
   flush_cache_item (app, table[idx].flush_tag? table[idx].flush_tag
                     /* */                    : table[idx].tag);
 
   if (app->app_local->cardcap.ext_lc_le && valuelen > 254)
     exmode = 1;    /* Use extended length w/o a limit.  */
   else if (app->app_local->cardcap.cmd_chaining && valuelen > 254)
     exmode = -254; /* Command chaining with max. 254 bytes.  */
   else
     exmode = 0;
 
   if (table[idx].special == 4)
     {
       if (app->card->cardtype == CARDTYPE_YUBIKEY
           || app->card->cardtype == CARDTYPE_GNUK)
         {
           rc = verify_chv3 (app, ctrl, pincb, pincb_arg);
           if (rc)
             return rc;
 
           if (valuelen == 3
               && app->card->cardtype == CARDTYPE_GNUK)
             {
               value = NULL;
               valuelen = 0;
             }
 
           cache_pin (app, ctrl, 1, NULL);
           cache_pin (app, ctrl, 2, NULL);
           cache_pin (app, ctrl, 3, NULL);
         }
       else
         {
           char *oldpinvalue = NULL;
           char *buffer1 = NULL;
           size_t bufferlen1;
           const char *u, *a;
           size_t ulen, alen;
 
           if (valuelen == 3)
             {
               u = "123456";
               a = "12345678";
               ulen = 6;
               alen = 8;
             }
           else if (valuelen == KDF_DATA_LENGTH_MAX)
             {
               u = (const char *)value + 44;
               a = u + 34;
               ulen = alen = 32;
             }
           else
             return gpg_error (GPG_ERR_INV_OBJ);
 
           if (!pin_from_cache (app, ctrl, 3, &oldpinvalue))
             {
               char *prompt;
 
               rc = build_enter_admin_pin_prompt (app, &prompt, NULL);
               if (rc)
                 return rc;
 
               rc = pincb (pincb_arg, prompt, &oldpinvalue);
               if (rc)
                 {
                   log_info (_("PIN callback returned error: %s\n"),
                             gpg_strerror (rc));
                   return rc;
                 }
             }
 
           rc = pin2hash_if_kdf (app, 3, oldpinvalue, &buffer1, &bufferlen1);
           if (!rc)
             rc = iso7816_change_reference_data (app_get_slot (app),
                                                 0x83,
                                                 buffer1, bufferlen1,
                                                 a, alen);
           if (!rc)
             rc = iso7816_verify (app_get_slot (app), 0x83, a, alen);
           if (!rc)
             cache_pin (app, ctrl, 3, "12345678");
 
           if (!rc)
             rc = iso7816_reset_retry_counter (app_get_slot (app), 0x81, u, ulen);
           if (!rc)
             cache_pin (app, ctrl, 1, "123456");
 
           if (!rc)
             rc = iso7816_put_data (app_get_slot (app), 0, 0xD3, NULL, 0);
 
           wipe_and_free (buffer1, bufferlen1);
           wipe_and_free_string (oldpinvalue);
         }
 
       /* Flush the cache again, because pin2hash_if_kdf uses the DO.  */
       flush_cache_item (app, 0x00F9);
     }
 
   rc = iso7816_put_data (app_get_slot (app),
                          exmode, table[idx].tag, value, valuelen);
   if (rc)
     log_error ("failed to set '%s': %s\n", table[idx].name, gpg_strerror (rc));
 
   if (table[idx].special == 1)
     app->force_chv1 = (valuelen && *value == 0);
   else if (table[idx].special == 2)
     parse_login_data (app);
   else if (table[idx].special == 4)
     {
       app->did_chv1 = 0;
       app->did_chv2 = 0;
       app->did_chv3 = 0;
 
       if ((valuelen == KDF_DATA_LENGTH_MIN || valuelen == KDF_DATA_LENGTH_MAX)
           && (value[2] == 0x03))
         app->app_local->pinpad.disabled = 1;
       else
         app->app_local->pinpad.disabled = 0;
     }
 
   return rc;
 }
 
 
 /* Handle the WRITECERT command for OpenPGP.  This writes the standard
  * certificate to the card; CERTID needs to be set to "OPENPGP.3".
  * PINCB and PINCB_ARG are the usual arguments for the pinentry
  * callback.  */
 static gpg_error_t
 do_writecert (app_t app, ctrl_t ctrl,
               const char *certidstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg,
               const unsigned char *certdata, size_t certdatalen)
 {
   if (strcmp (certidstr, "OPENPGP.3"))
     return gpg_error (GPG_ERR_INV_ID);
   if (!certdata || !certdatalen)
     return gpg_error (GPG_ERR_INV_ARG);
   if (!app->app_local->extcap.is_v2)
     return gpg_error (GPG_ERR_NOT_SUPPORTED);
   if (certdatalen > app->app_local->extcap.max_certlen_3)
     return gpg_error (GPG_ERR_TOO_LARGE);
   return do_setattr (app, ctrl, "CERT-3", pincb, pincb_arg,
                      certdata, certdatalen);
 }
 
 
 static gpg_error_t
 clear_chv_status (app_t app, ctrl_t ctrl, int chvno)
 {
   unsigned char apdu[4];
   gpg_error_t err;
 
   cache_pin (app, ctrl, chvno, NULL);
 
   if (!app->app_local->extcap.is_v2)
     return GPG_ERR_UNSUPPORTED_OPERATION;
 
   apdu[0] = 0x00;
   apdu[1] = ISO7816_VERIFY;
   apdu[2] = 0xff;
   apdu[3] = 0x80+chvno;
 
   err = iso7816_apdu_direct (app_get_slot (app), apdu, 4, 0, NULL, NULL, NULL);
   if (err)
     {
       if (gpg_err_code (err) == GPG_ERR_INV_VALUE)
         err = gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
       return err;
     }
 
   if (chvno == 1)
     {
       apdu[3]++;
       err = iso7816_apdu_direct (app_get_slot (app),
                                  apdu, 4, 0, NULL, NULL, NULL);
       app->did_chv1 = app->did_chv2 = 0;
     }
   else if (chvno == 2)
     app->did_chv2 = 0;
   else if (chvno == 3)
     app->did_chv3 = 0;
 
   return err;
 }
 
 
 /* Handle the PASSWD command.  The following combinations are
    possible:
 
     Flags  CHVNO Vers.  Description
     RESET    1   1      Verify CHV3 and set a new CHV1 and CHV2
     RESET    1   2      Verify PW3 and set a new PW1.
     RESET    2   1      Verify CHV3 and set a new CHV1 and CHV2.
     RESET    2   2      Verify PW3 and set a new Reset Code.
     RESET    3   any    Returns GPG_ERR_INV_ID.
      -       1   1      Verify CHV2 and set a new CHV1 and CHV2.
      -       1   2      Verify PW1 and set a new PW1.
      -       2   1      Verify CHV2 and set a new CHV1 and CHV2.
      -       2   2      Verify Reset Code and set a new PW1.
      -       3   any    Verify CHV3/PW3 and set a new CHV3/PW3.
 
    The CHVNO can be prefixed with "OPENPGP.".
  */
 static gpg_error_t
 do_change_pin (app_t app, ctrl_t ctrl,  const char *chvnostr,
                unsigned int flags,
                gpg_error_t (*pincb)(void*, const char *, char **),
                void *pincb_arg)
 {
   int rc = 0;
   int chvno;
   char *resetcode = NULL;
   char *oldpinvalue = NULL;
   char *pinvalue = NULL;
   int reset_mode = !!(flags & APP_CHANGE_FLAG_RESET);
   int set_resetcode = 0;
   pininfo_t pininfo;
   int use_pinpad = 0;
   int minlen = 6;
 
   if (digitp (chvnostr))
     chvno = atoi (chvnostr);
   else if (!ascii_strcasecmp (chvnostr, "OPENPGP.1"))
     chvno = 1;
   else if (!ascii_strcasecmp (chvnostr, "OPENPGP.2"))
     chvno = 2;
   else if (!ascii_strcasecmp (chvnostr, "OPENPGP.3"))
     chvno = 3;
   else
     return gpg_error (GPG_ERR_INV_ID);
 
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.fixedlen = -1;
   pininfo.minlen = minlen;
 
   /* Better clear all the PIN caches first.  */
   cache_pin (app, ctrl, 1, NULL);
   cache_pin (app, ctrl, 2, NULL);
   cache_pin (app, ctrl, 3, NULL);
 
   if ((flags & APP_CHANGE_FLAG_CLEAR))
     return clear_chv_status (app, ctrl, chvno);
 
   if (reset_mode && chvno == 3)
     {
       rc = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
 
   if (!app->app_local->extcap.is_v2)
     {
       /* Version 1 cards.  */
 
       if (reset_mode || chvno == 3)
         {
           /* We always require that the PIN is entered. */
           app->did_chv3 = 0;
           rc = verify_chv3 (app, ctrl, pincb, pincb_arg);
           if (rc)
             goto leave;
         }
       else if (chvno == 1 || chvno == 2)
         {
           /* On a v1.x card CHV1 and CVH2 should always have the same
              value, thus we enforce it here.  */
           int save_force = app->force_chv1;
 
           app->force_chv1 = 0;
           app->did_chv1 = 0;
           app->did_chv2 = 0;
           rc = verify_chv2 (app, ctrl, pincb, pincb_arg);
           app->force_chv1 = save_force;
           if (rc)
             goto leave;
         }
       else
         {
           rc = gpg_error (GPG_ERR_INV_ID);
           goto leave;
         }
     }
   else
     {
       /* Version 2 cards.  */
 
       if (!opt.disable_pinpad
           && !iso7816_check_pinpad (app_get_slot (app),
                                     ISO7816_CHANGE_REFERENCE_DATA, &pininfo)
           && !check_pinpad_request (app, &pininfo, chvno == 3))
         use_pinpad = 1;
 
       if (reset_mode)
         {
           /* To reset a PIN the Admin PIN is required. */
           use_pinpad = 0;
           app->did_chv3 = 0;
           rc = verify_chv3 (app, ctrl, pincb, pincb_arg);
           if (rc)
             goto leave;
 
           if (chvno == 2)
             set_resetcode = 1;
         }
       else if (chvno == 1 || chvno == 3)
         {
           if (!use_pinpad)
             {
               char *promptbuf = NULL;
               const char *prompt;
 
               if (chvno == 3)
                 {
                   minlen = 8;
                   rc = build_enter_admin_pin_prompt (app, &promptbuf, NULL);
                   if (rc)
                     goto leave;
                   prompt = promptbuf;
                 }
               else
                 prompt = _("||Please enter the PIN");
               rc = pincb (pincb_arg, prompt, &oldpinvalue);
               xfree (promptbuf);
               promptbuf = NULL;
               if (rc)
                 {
                   log_info (_("PIN callback returned error: %s\n"),
                             gpg_strerror (rc));
                   goto leave;
                 }
 
               if (strlen (oldpinvalue) < minlen)
                 {
                   log_info (_("PIN for CHV%d is too short;"
                               " minimum length is %d\n"), chvno, minlen);
                   rc = gpg_error (GPG_ERR_BAD_PIN);
                   goto leave;
                 }
             }
         }
       else if (chvno == 2)
         {
           /* There is no PW2 for v2 cards.  We use this condition to
              allow a PW reset using the Reset Code.  */
           void *relptr;
           unsigned char *value;
           size_t valuelen;
           int remaining;
 
           use_pinpad = 0;
           minlen = 8;
           relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
           if (!relptr || valuelen < 7)
             {
               log_error (_("error retrieving CHV status from card\n"));
               xfree (relptr);
               rc = gpg_error (GPG_ERR_CARD);
               goto leave;
             }
           remaining = value[5];
           xfree (relptr);
           if (!remaining)
             {
               log_error (_("Reset Code not or not anymore available\n"));
               rc = gpg_error (GPG_ERR_BAD_PIN);
               goto leave;
             }
 
           rc = pincb (pincb_arg,
                       _("||Please enter the Reset Code for the card"),
                       &resetcode);
           if (rc)
             {
               log_info (_("PIN callback returned error: %s\n"),
                         gpg_strerror (rc));
               goto leave;
             }
           if (strlen (resetcode) < minlen)
             {
               log_info (_("Reset Code is too short; minimum length is %d\n"),
                         minlen);
               rc = gpg_error (GPG_ERR_BAD_PIN);
               goto leave;
             }
         }
       else
         {
           rc = gpg_error (GPG_ERR_INV_ID);
           goto leave;
         }
     }
 
   if (chvno == 3)
     app->did_chv3 = 0;
   else
     app->did_chv1 = app->did_chv2 = 0;
 
   if (!use_pinpad)
     {
       /* TRANSLATORS: Do not translate the "|*|" prefixes but
          keep it at the start of the string.  We need this elsewhere
          to get some infos on the string. */
       rc = pincb (pincb_arg, set_resetcode? _("|RN|New Reset Code") :
                   chvno == 3? _("|AN|New Admin PIN") : _("|N|New PIN"),
                   &pinvalue);
       if (rc || pinvalue == NULL)
         {
           log_error (_("error getting new PIN: %s\n"), gpg_strerror (rc));
           goto leave;
         }
     }
 
 
   if (resetcode)
     {
       char *result1 = NULL;
       char *result2 = NULL;
       char *buffer = NULL;
       size_t resultlen1, resultlen2=0, bufferlen=0;
 
       rc = pin2hash_if_kdf (app, 0, resetcode, &result1, &resultlen1);
       if (!rc)
         rc = pin2hash_if_kdf (app, 0, pinvalue, &result2, &resultlen2);
       if (!rc)
         {
           bufferlen = resultlen1 + resultlen2;
           buffer = xtrymalloc (bufferlen);
           if (!buffer)
             rc = gpg_error_from_syserror ();
           else
             {
               memcpy (buffer, result1, resultlen1);
               memcpy (buffer+resultlen1, result2, resultlen2);
             }
         }
       if (!rc)
         rc = iso7816_reset_retry_counter_with_rc (app_get_slot (app), 0x81,
                                                   buffer, bufferlen);
       wipe_and_free (result1, resultlen1);
       wipe_and_free (result2, resultlen2);
       wipe_and_free (buffer, bufferlen);
     }
   else if (set_resetcode)
     {
       if (strlen (pinvalue) < 8)
         {
           log_error (_("Reset Code is too short; minimum length is %d\n"), 8);
           rc = gpg_error (GPG_ERR_BAD_PIN);
         }
       else
         {
           char *buffer = NULL;
           size_t bufferlen;
 
           rc = pin2hash_if_kdf (app, 0, pinvalue, &buffer, &bufferlen);
           if (!rc)
             rc = iso7816_put_data (app_get_slot (app),
                                    0, 0xD3, buffer, bufferlen);
 
           wipe_and_free (buffer, bufferlen);
         }
     }
   else if (reset_mode)
     {
       char *buffer = NULL;
       size_t bufferlen;
 
       rc = pin2hash_if_kdf (app, 1, pinvalue, &buffer, &bufferlen);
       if (!rc)
         rc = iso7816_reset_retry_counter (app_get_slot (app),
                                           0x81, buffer, bufferlen);
       if (!rc && !app->app_local->extcap.is_v2)
         rc = iso7816_reset_retry_counter (app_get_slot (app),
                                           0x82, buffer, bufferlen);
 
       wipe_and_free (buffer, bufferlen);
     }
   else if (!app->app_local->extcap.is_v2)
     {
       /* Version 1 cards.  */
       if (chvno == 1 || chvno == 2)
         {
           rc = iso7816_change_reference_data (app_get_slot (app),
                                               0x81, NULL, 0,
                                               pinvalue, strlen (pinvalue));
           if (!rc)
             rc = iso7816_change_reference_data (app_get_slot (app),
                                                 0x82, NULL, 0,
                                                 pinvalue, strlen (pinvalue));
         }
       else /* CHVNO == 3 */
         {
           rc = iso7816_change_reference_data (app_get_slot (app),
                                               0x80 + chvno, NULL, 0,
                                               pinvalue, strlen (pinvalue));
         }
     }
   else
     {
       /* Version 2 cards.  */
       assert (chvno == 1 || chvno == 3);
 
       if (use_pinpad)
         {
           rc = pincb (pincb_arg,
                       chvno == 3 ?
                       _("||Please enter the Admin PIN and New Admin PIN") :
                       _("||Please enter the PIN and New PIN"), NULL);
           if (rc)
             {
               log_info (_("PIN callback returned error: %s\n"),
                         gpg_strerror (rc));
               goto leave;
             }
           rc = iso7816_change_reference_data_kp (app_get_slot (app),
                                                  0x80 + chvno, 0,
                                                  &pininfo);
           pincb (pincb_arg, NULL, NULL); /* Dismiss the prompt. */
         }
       else
         {
           char *buffer1 = NULL;
           char *buffer2 = NULL;
           size_t bufferlen1, bufferlen2 = 0;
 
           rc = pin2hash_if_kdf (app, chvno, oldpinvalue, &buffer1, &bufferlen1);
           if (!rc)
             rc = pin2hash_if_kdf (app, chvno, pinvalue, &buffer2, &bufferlen2);
           if (!rc)
             rc = iso7816_change_reference_data (app_get_slot (app),
                                                 0x80 + chvno,
                                                 buffer1, bufferlen1,
                                                 buffer2, bufferlen2);
           wipe_and_free (buffer1, bufferlen1);
           wipe_and_free (buffer2, bufferlen2);
         }
     }
 
   wipe_and_free_string (pinvalue);
   if (rc)
     flush_cache_after_error (app);
 
  leave:
   wipe_and_free_string (resetcode);
   wipe_and_free_string (oldpinvalue);
   return rc;
 }
 
 
 /* Check whether a key already exists.  KEYIDX is the index of the key
    (0..2).  If FORCE is TRUE a diagnositic will be printed but no
    error returned if the key already exists.  The flag GENERATING is
    only used to print correct messages. */
 static gpg_error_t
 does_key_exist (app_t app, int keyidx, int generating, int force)
 {
   const unsigned char *fpr;
   unsigned char *buffer;
   size_t buflen, n;
   int i;
 
   assert (keyidx >=0 && keyidx <= 2);
 
   if (iso7816_get_data (app_get_slot (app), 0, 0x006E, &buffer, &buflen))
     {
       log_error (_("error reading application data\n"));
       return gpg_error (GPG_ERR_GENERAL);
     }
   fpr = find_tlv (buffer, buflen, 0x00C5, &n);
   if (!fpr || n < 60)
     {
       log_error (_("error reading fingerprint DO\n"));
       xfree (buffer);
       return gpg_error (GPG_ERR_GENERAL);
     }
   fpr += 20*keyidx;
   for (i=0; i < 20 && !fpr[i]; i++)
     ;
   xfree (buffer);
   if (i!=20 && !force)
     {
       log_error (_("key already exists\n"));
       return gpg_error (GPG_ERR_EEXIST);
     }
   else if (i!=20)
     log_info (_("existing key will be replaced\n"));
   else if (generating)
     log_info (_("generating new key\n"));
   else
     log_info (_("writing new key\n"));
   return 0;
 }
 
 
 /* Create a TLV tag and value and store it at BUFFER.  Return the length
    of tag and length.  A LENGTH greater than 65535 is truncated. */
 static size_t
 add_tlv (unsigned char *buffer, unsigned int tag, size_t length)
 {
   unsigned char *p = buffer;
 
   assert (tag <= 0xffff);
   if ( tag > 0xff )
     *p++ = tag >> 8;
   *p++ = tag;
   if (length < 128)
     *p++ = length;
   else if (length < 256)
     {
       *p++ = 0x81;
       *p++ = length;
     }
   else
     {
       if (length > 0xffff)
         length = 0xffff;
       *p++ = 0x82;
       *p++ = length >> 8;
       *p++ = length;
     }
 
   return p - buffer;
 }
 
 
 static gpg_error_t
 build_privkey_template (app_t app, int keyno,
                         const unsigned char *rsa_n, size_t rsa_n_len,
                         const unsigned char *rsa_e, size_t rsa_e_len,
                         const unsigned char *rsa_p, size_t rsa_p_len,
                         const unsigned char *rsa_q, size_t rsa_q_len,
                         const unsigned char *rsa_u, size_t rsa_u_len,
                         const unsigned char *rsa_dp, size_t rsa_dp_len,
                         const unsigned char *rsa_dq, size_t rsa_dq_len,
                         unsigned char **result, size_t *resultlen)
 {
   size_t rsa_e_reqlen;
   unsigned char privkey[7*(1+3+3)];
   size_t privkey_len;
   unsigned char exthdr[2+2+3];
   size_t exthdr_len;
   unsigned char suffix[2+3];
   size_t suffix_len;
   unsigned char *tp;
   size_t datalen;
   unsigned char *template;
   size_t template_size;
 
   *result = NULL;
   *resultlen = 0;
 
   switch (app->app_local->keyattr[keyno].rsa.format)
     {
     case RSA_STD:
     case RSA_STD_N:
     case RSA_CRT:
     case RSA_CRT_N:
       break;
 
     default:
       return gpg_error (GPG_ERR_INV_VALUE);
     }
 
   /* Get the required length for E. Rounded up to the nearest byte  */
   rsa_e_reqlen = (app->app_local->keyattr[keyno].rsa.e_bits + 7) / 8;
   assert (rsa_e_len <= rsa_e_reqlen);
 
   /* Build the 7f48 cardholder private key template.  */
   datalen = 0;
   tp = privkey;
 
   tp += add_tlv (tp, 0x91, rsa_e_reqlen);
   datalen += rsa_e_reqlen;
 
   tp += add_tlv (tp, 0x92, rsa_p_len);
   datalen += rsa_p_len;
 
   tp += add_tlv (tp, 0x93, rsa_q_len);
   datalen += rsa_q_len;
 
   if (app->app_local->keyattr[keyno].rsa.format == RSA_CRT
       || app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
     {
       tp += add_tlv (tp, 0x94, rsa_u_len);
       datalen += rsa_u_len;
       tp += add_tlv (tp, 0x95, rsa_dp_len);
       datalen += rsa_dp_len;
       tp += add_tlv (tp, 0x96, rsa_dq_len);
       datalen += rsa_dq_len;
     }
 
   if (app->app_local->keyattr[keyno].rsa.format == RSA_STD_N
       || app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
     {
       tp += add_tlv (tp, 0x97, rsa_n_len);
       datalen += rsa_n_len;
     }
   privkey_len = tp - privkey;
 
   /* Build the extended header list without the private key template.  */
   tp = exthdr;
   *tp++ = keyno ==0 ? 0xb6 : keyno == 1? 0xb8 : 0xa4;
   *tp++ = 0;
   tp += add_tlv (tp, 0x7f48, privkey_len);
   exthdr_len = tp - exthdr;
 
   /* Build the 5f48 suffix of the data.  */
   tp = suffix;
   tp += add_tlv (tp, 0x5f48, datalen);
   suffix_len = tp - suffix;
 
   /* Now concatenate everything.  */
   template_size = (1 + 3   /* 0x4d and len. */
                    + exthdr_len
                    + privkey_len
                    + suffix_len
                    + datalen);
   tp = template = xtrymalloc_secure (template_size);
   if (!template)
     return gpg_error_from_syserror ();
 
   tp += add_tlv (tp, 0x4d, exthdr_len + privkey_len + suffix_len + datalen);
   memcpy (tp, exthdr, exthdr_len);
   tp += exthdr_len;
   memcpy (tp, privkey, privkey_len);
   tp += privkey_len;
   memcpy (tp, suffix, suffix_len);
   tp += suffix_len;
 
   memcpy (tp, rsa_e, rsa_e_len);
   if (rsa_e_len < rsa_e_reqlen)
     {
       /* Right justify E. */
       memmove (tp + rsa_e_reqlen - rsa_e_len, tp, rsa_e_len);
       memset (tp, 0, rsa_e_reqlen - rsa_e_len);
     }
   tp += rsa_e_reqlen;
 
   memcpy (tp, rsa_p, rsa_p_len);
   tp += rsa_p_len;
 
   memcpy (tp, rsa_q, rsa_q_len);
   tp += rsa_q_len;
 
   if (app->app_local->keyattr[keyno].rsa.format == RSA_CRT
       || app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
     {
       memcpy (tp, rsa_u, rsa_u_len);
       tp += rsa_u_len;
       memcpy (tp, rsa_dp, rsa_dp_len);
       tp += rsa_dp_len;
       memcpy (tp, rsa_dq, rsa_dq_len);
       tp += rsa_dq_len;
     }
 
   if (app->app_local->keyattr[keyno].rsa.format == RSA_STD_N
       || app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
     {
       memcpy (tp, rsa_n, rsa_n_len);
       tp += rsa_n_len;
     }
 
   /* Sanity check.  We don't know the exact length because we
      allocated 3 bytes for the first length header.  */
   assert (tp - template <= template_size);
 
   *result = template;
   *resultlen = tp - template;
   return 0;
 }
 
 static gpg_error_t
 build_ecc_privkey_template (app_t app, int keyno,
                             const unsigned char *ecc_d, size_t ecc_d_len,
                             const unsigned char *ecc_q, size_t ecc_q_len,
                             unsigned char **result, size_t *resultlen)
 {
   unsigned char privkey[2*(1+3)];
   size_t privkey_len;
   unsigned char exthdr[2+2+3];
   size_t exthdr_len;
   unsigned char suffix[2+3];
   size_t suffix_len;
   unsigned char *tp;
   size_t datalen;
   unsigned char *template;
   size_t template_size;
   int pubkey_required;
 
   pubkey_required = !!(app->app_local->keyattr[keyno].ecc.flags
                        & ECC_FLAG_PUBKEY);
 
   *result = NULL;
   *resultlen = 0;
 
   /* Build the 7f48 cardholder private key template.  */
   datalen = 0;
   tp = privkey;
 
   tp += add_tlv (tp, 0x92, ecc_d_len);
   datalen += ecc_d_len;
 
   if (pubkey_required)
     {
       tp += add_tlv (tp, 0x99, ecc_q_len);
       datalen += ecc_q_len;
     }
 
   privkey_len = tp - privkey;
 
 
   /* Build the extended header list without the private key template.  */
   tp = exthdr;
   *tp++ = keyno ==0 ? 0xb6 : keyno == 1? 0xb8 : 0xa4;
   *tp++ = 0;
   tp += add_tlv (tp, 0x7f48, privkey_len);
   exthdr_len = tp - exthdr;
 
   /* Build the 5f48 suffix of the data.  */
   tp = suffix;
   tp += add_tlv (tp, 0x5f48, datalen);
   suffix_len = tp - suffix;
 
   /* Now concatenate everything.  */
   template_size = (1 + 1   /* 0x4d and len. */
                    + exthdr_len
                    + privkey_len
                    + suffix_len
                    + datalen);
   if (exthdr_len + privkey_len + suffix_len + datalen >= 128)
     template_size++;
   tp = template = xtrymalloc_secure (template_size);
   if (!template)
     return gpg_error_from_syserror ();
 
   tp += add_tlv (tp, 0x4d, exthdr_len + privkey_len + suffix_len + datalen);
   memcpy (tp, exthdr, exthdr_len);
   tp += exthdr_len;
   memcpy (tp, privkey, privkey_len);
   tp += privkey_len;
   memcpy (tp, suffix, suffix_len);
   tp += suffix_len;
 
   memcpy (tp, ecc_d, ecc_d_len);
   tp += ecc_d_len;
 
   if (pubkey_required)
     {
       memcpy (tp, ecc_q, ecc_q_len);
       tp += ecc_q_len;
     }
 
   assert (tp - template == template_size);
 
   *result = template;
   *resultlen = tp - template;
   return 0;
 }
 
 
 /* Helper for do_writekey to change the size of a key.  Not ethat
    this deletes the entire key without asking.  */
 static gpg_error_t
 change_keyattr (app_t app, ctrl_t ctrl,
                 int keyno, const unsigned char *buf, size_t buflen,
                 gpg_error_t (*pincb)(void*, const char *, char **),
                 void *pincb_arg)
 {
   gpg_error_t err;
 
   assert (keyno >=0 && keyno <= 2);
 
   /* Prepare for storing the key.  */
   err = verify_chv3 (app, ctrl, pincb, pincb_arg);
   if (err)
     return err;
 
   /* Change the attribute.  */
   err = iso7816_put_data (app_get_slot (app), 0, 0xC1+keyno, buf, buflen);
   if (err)
     log_error ("error changing key attribute of OPENPGP.%d\n",
                keyno+1);
   else
     log_info ("key attribute of OPENPGP.%d changed\n", keyno+1);
   flush_cache (app);
   parse_algorithm_attribute (app, keyno);
   app->did_chv1 = 0;
   app->did_chv2 = 0;
   app->did_chv3 = 0;
   cache_pin (app, ctrl, 1, NULL);
   cache_pin (app, ctrl, 2, NULL);
   cache_pin (app, ctrl, 3, NULL);
   return err;
 }
 
 
 static gpg_error_t
 change_rsa_keyattr (app_t app, ctrl_t ctrl, int keyno, unsigned int nbits,
                     gpg_error_t (*pincb)(void*, const char *, char **),
                     void *pincb_arg)
 {
   gpg_error_t err = 0;
   unsigned char *buf;
   size_t buflen;
   void *relptr;
 
   /* Read the current attributes into a buffer.  */
   relptr = get_one_do (app, 0xC1+keyno, &buf, &buflen, NULL);
   if (!relptr)
     err = gpg_error (GPG_ERR_CARD);
   else if (buflen < 6)
     {
       /* Attributes too short.  */
       xfree (relptr);
       err = gpg_error (GPG_ERR_CARD);
     }
   else
     {
       /* If key attribute was RSA, we only change n_bits and don't
          touch anything else.  Before we do so, we round up NBITS to a
          sensible way in the same way as gpg's key generation does it.
          This may help to sort out problems with a few bits too short
          keys.  */
       nbits = ((nbits + 31) / 32) * 32;
       buf[1] = (nbits >> 8);
       buf[2] = nbits;
 
       /* If it was not RSA, we need to fill other parts.  */
       if (buf[0] != PUBKEY_ALGO_RSA)
         {
           buf[0] = PUBKEY_ALGO_RSA;
           buf[3] = 0;
           buf[4] = 32;
           buf[5] = 0;
           buflen = 6;
         }
 
       err = change_keyattr (app, ctrl, keyno, buf, buflen, pincb, pincb_arg);
       xfree (relptr);
     }
 
   return err;
 }
 
 
 /* Helper to process an setattr command for name KEY-ATTR.
  *
  * If KEYREF and KEYALGO are NULL (VALUE,VALUELEN) are expected to
  * contain one of the following strings:
  *       RSA: "--force <key> <algo> rsa<nbits>"
  *       ECC: "--force <key> <algo> <curvename>"
  *
  * If KEYREF and KEYALGO is given the key attribute for KEYREF are
  * changed to what is described by KEYALGO (e.g. "rsa3072", "rsa2048",
  * or "ed25519").
  */
 static gpg_error_t
 change_keyattr_from_string (app_t app, ctrl_t ctrl,
                             gpg_error_t (*pincb)(void*, const char *, char **),
                             void *pincb_arg,
                             const char *keyref, const char *keyalgo,
                             const void *value, size_t valuelen)
 {
   gpg_error_t err = 0;
   char *string = NULL;
   int key, keyno, algo;
   unsigned int nbits = 0;
   const char *oidstr = NULL; /* OID of the curve.  */
   char *endp;
 
   if (keyref && keyalgo && *keyref && *keyalgo)
     {
       if (!ascii_strcasecmp (keyref, "OPENPGP.1"))
         keyno = 0;
       else if (!ascii_strcasecmp (keyref, "OPENPGP.2"))
         keyno = 1;
       else if (!ascii_strcasecmp (keyref, "OPENPGP.3"))
         keyno = 2;
       else
         {
           err = gpg_error (GPG_ERR_INV_ID);
           goto leave;
         }
 
       if (!strncmp (keyalgo, "rsa", 3) && digitp (keyalgo+3))
         {
           errno = 0;
           nbits = strtoul (keyalgo+3, &endp, 10);
           if (errno || *endp)
             {
               err = gpg_error (GPG_ERR_INV_DATA);
               goto leave;
             }
           algo = PUBKEY_ALGO_RSA;
         }
       else if ((!strncmp (keyalgo, "dsa", 3) || !strncmp (keyalgo, "elg", 3))
                && digitp (keyalgo+3))
         {
           err = gpg_error (GPG_ERR_PUBKEY_ALGO);
           goto leave;
         }
       else
         {
           nbits = 0;
           oidstr = openpgp_curve_to_oid (keyalgo, NULL, &algo);
           if (!oidstr)
             {
               err = gpg_error (GPG_ERR_INV_DATA);
               goto leave;
             }
           if (!algo)
             algo = keyno == 1? PUBKEY_ALGO_ECDH : PUBKEY_ALGO_ECDSA;
         }
 
     }
   else if (!keyref && !keyalgo && value)
     {
       int n;
 
       /* VALUE is expected to be a string but not guaranteed to be
        * terminated.  Thus copy it to an allocated buffer first. */
       string = xtrymalloc (valuelen+1);
       if (!string)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       memcpy (string, value, valuelen);
       string[valuelen] = 0;
 
       /* Because this function deletes the key we require the string
        * "--force" in the data to make clear that something serious
        * might happen.  */
       n = 0;
       sscanf (string, "--force %d %d %n", &key, &algo, &n);
       if (n < 12)
         {
           err = gpg_error (GPG_ERR_INV_DATA);
           goto leave;
         }
       keyno = key - 1;
       if (algo == PUBKEY_ALGO_RSA)
         {
           errno = 0;
           nbits = strtoul (string+n+3, NULL, 10);
           if (errno)
             {
               err = gpg_error (GPG_ERR_INV_DATA);
               goto leave;
             }
         }
       else if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ECDSA
                || algo == PUBKEY_ALGO_EDDSA)
         {
           oidstr = openpgp_curve_to_oid (string+n, NULL, NULL);
           if (!oidstr)
             {
               err = gpg_error (GPG_ERR_INV_DATA);
               goto leave;
             }
         }
       else
         {
           err = gpg_error (GPG_ERR_PUBKEY_ALGO);
           goto leave;
         }
     }
   else
     {
       err = gpg_error (GPG_ERR_INV_ARG);
       goto leave;
     }
 
   if (keyno < 0 || keyno > 2)
     err = gpg_error (GPG_ERR_INV_ID);
   else if (algo == PUBKEY_ALGO_RSA)
     {
       if (nbits < 1024)
         err = gpg_error (GPG_ERR_TOO_SHORT);
       else if (nbits > 4096)
         err = gpg_error (GPG_ERR_TOO_LARGE);
       else
         err = change_rsa_keyattr (app, ctrl, keyno, nbits, pincb, pincb_arg);
     }
   else if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ECDSA
            || algo == PUBKEY_ALGO_EDDSA)
     {
       gcry_mpi_t oid;
       const unsigned char *oidbuf;
       size_t oid_len;
       unsigned int n;
 
       /* Check that the requested algo matches the properties of the
        * key slot.  */
       if (keyno == 1 && algo != PUBKEY_ALGO_ECDH)
         err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
       else if (keyno != 1 && algo == PUBKEY_ALGO_ECDH)
         err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
       else
         err = 0;
       if (err)
         goto leave;
 
       /* Convert the OID string to an OpenPGP formatted OID.  */
       err = openpgp_oid_from_str (oidstr, &oid);
       if (err)
         goto leave;
 
       oidbuf = gcry_mpi_get_opaque (oid, &n);
       oid_len = (n+7)/8;
 
       /* Create the template.  */
       xfree (string);
       string = xtrymalloc (1 + oid_len);
       if (!string)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       string[0] = algo;
       memcpy (string+1, oidbuf+1, oid_len-1);
       err = change_keyattr (app, ctrl,keyno, string, oid_len, pincb, pincb_arg);
       gcry_mpi_release (oid);
     }
   else
     err = gpg_error (GPG_ERR_PUBKEY_ALGO);
 
  leave:
   xfree (string);
   return err;
 }
 
 
 static gpg_error_t
 rsa_writekey (app_t app, ctrl_t ctrl,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg, int keyno,
               const unsigned char *buf, size_t buflen, int depth)
 {
   gpg_error_t err;
   const unsigned char *tok;
   size_t toklen;
   int last_depth1, last_depth2;
   const unsigned char *rsa_n = NULL;
   const unsigned char *rsa_e = NULL;
   const unsigned char *rsa_p = NULL;
   const unsigned char *rsa_q = NULL;
   size_t rsa_n_len, rsa_e_len, rsa_p_len, rsa_q_len;
   unsigned int nbits;
   unsigned int maxbits;
   unsigned char *template = NULL;
   unsigned char *tp;
   size_t template_len;
   unsigned char fprbuf[20];
   u32 created_at = 0;
 
   if (app->app_local->keyattr[keyno].key_type != KEY_TYPE_RSA)
     {
       log_error (_("unsupported algorithm: %s"), "RSA");
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
 
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
       if (tok && toklen == 1)
         {
           const unsigned char **mpi;
           size_t *mpi_len;
 
           switch (*tok)
             {
             case 'n': mpi = &rsa_n; mpi_len = &rsa_n_len; break;
             case 'e': mpi = &rsa_e; mpi_len = &rsa_e_len; break;
             case 'p': mpi = &rsa_p; mpi_len = &rsa_p_len; break;
             case 'q': mpi = &rsa_q; mpi_len = &rsa_q_len;break;
             default: mpi = NULL;  mpi_len = NULL; break;
             }
           if (mpi && *mpi)
             {
               err = gpg_error (GPG_ERR_DUP_VALUE);
               goto leave;
             }
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
           if (tok && mpi)
             {
               /* Strip off leading zero bytes and save. */
               for (;toklen && !*tok; toklen--, tok++)
                 ;
               *mpi = tok;
               *mpi_len = toklen;
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
   /* Parse other attributes. */
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
       if (tok && toklen == 10 && !memcmp ("created-at", tok, toklen))
         {
           if ((err = parse_sexp (&buf,&buflen,&depth,&tok,&toklen)))
             goto leave;
           if (tok)
             {
               for (created_at=0; toklen && *tok && *tok >= '0' && *tok <= '9';
                    tok++, toklen--)
                 created_at = created_at*10 + (*tok - '0');
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
 
 
   /* Check that we have all parameters and that they match the card
      description. */
   if (!created_at)
     {
       log_error (_("creation timestamp missing\n"));
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
 
   maxbits = app->app_local->keyattr[keyno].rsa.n_bits;
   nbits = rsa_n? count_bits (rsa_n, rsa_n_len) : 0;
   if (opt.verbose)
     log_info ("RSA modulus size is %u bits\n", nbits);
   if (nbits && nbits != maxbits
       && app->app_local->extcap.algo_attr_change)
     {
       /* Try to switch the key to a new length.  */
       err = change_rsa_keyattr (app, ctrl, keyno, nbits, pincb, pincb_arg);
       if (!err)
         maxbits = app->app_local->keyattr[keyno].rsa.n_bits;
     }
   if (nbits != maxbits)
     {
       log_error (_("RSA modulus missing or not of size %d bits\n"),
                  (int)maxbits);
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
 
   maxbits = app->app_local->keyattr[keyno].rsa.e_bits;
   if (maxbits > 32 && !app->app_local->extcap.is_v2)
     maxbits = 32; /* Our code for v1 does only support 32 bits.  */
   nbits = rsa_e? count_bits (rsa_e, rsa_e_len) : 0;
   if (nbits < 2 || nbits > maxbits)
     {
       log_error (_("RSA public exponent missing or larger than %d bits\n"),
                  (int)maxbits);
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
 
   maxbits = app->app_local->keyattr[keyno].rsa.n_bits/2;
   nbits = rsa_p? count_bits (rsa_p, rsa_p_len) : 0;
   if (nbits != maxbits)
     {
       log_error (_("RSA prime %s missing or not of size %d bits\n"),
                  "P", (int)maxbits);
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
   nbits = rsa_q? count_bits (rsa_q, rsa_q_len) : 0;
   if (nbits != maxbits)
     {
       log_error (_("RSA prime %s missing or not of size %d bits\n"),
                  "Q", (int)maxbits);
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
 
   /* We need to remove the cached public key.  */
   xfree (app->app_local->pk[keyno].key);
   app->app_local->pk[keyno].key = NULL;
   app->app_local->pk[keyno].keylen = 0;
   app->app_local->pk[keyno].read_done = 0;
 
 
   if (app->app_local->extcap.is_v2)
     {
       unsigned char *rsa_u, *rsa_dp, *rsa_dq;
       size_t rsa_u_len, rsa_dp_len, rsa_dq_len;
       gcry_mpi_t mpi_e, mpi_p, mpi_q;
       gcry_mpi_t mpi_u = gcry_mpi_snew (0);
       gcry_mpi_t mpi_dp = gcry_mpi_snew (0);
       gcry_mpi_t mpi_dq = gcry_mpi_snew (0);
       gcry_mpi_t mpi_tmp = gcry_mpi_snew (0);
       int exmode;
 
       /* Calculate the u, dp and dq components needed by RSA_CRT cards */
       gcry_mpi_scan (&mpi_e, GCRYMPI_FMT_USG, rsa_e, rsa_e_len, NULL);
       gcry_mpi_scan (&mpi_p, GCRYMPI_FMT_USG, rsa_p, rsa_p_len, NULL);
       gcry_mpi_scan (&mpi_q, GCRYMPI_FMT_USG, rsa_q, rsa_q_len, NULL);
 
       gcry_mpi_invm (mpi_u, mpi_q, mpi_p);
       gcry_mpi_sub_ui (mpi_tmp, mpi_p, 1);
       gcry_mpi_invm (mpi_dp, mpi_e, mpi_tmp);
       gcry_mpi_sub_ui (mpi_tmp, mpi_q, 1);
       gcry_mpi_invm (mpi_dq, mpi_e, mpi_tmp);
 
       gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_u, &rsa_u_len, mpi_u);
       gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dp, &rsa_dp_len, mpi_dp);
       gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dq, &rsa_dq_len, mpi_dq);
 
       gcry_mpi_release (mpi_e);
       gcry_mpi_release (mpi_p);
       gcry_mpi_release (mpi_q);
       gcry_mpi_release (mpi_u);
       gcry_mpi_release (mpi_dp);
       gcry_mpi_release (mpi_dq);
       gcry_mpi_release (mpi_tmp);
 
       /* Build the private key template as described in section 4.3.3.7 of
          the OpenPGP card specs version 2.0.  */
       err = build_privkey_template (app, keyno,
                                     rsa_n, rsa_n_len,
                                     rsa_e, rsa_e_len,
                                     rsa_p, rsa_p_len,
                                     rsa_q, rsa_q_len,
                                     rsa_u, rsa_u_len,
                                     rsa_dp, rsa_dp_len,
                                     rsa_dq, rsa_dq_len,
                                     &template, &template_len);
       xfree(rsa_u);
       xfree(rsa_dp);
       xfree(rsa_dq);
 
       if (err)
         goto leave;
 
       /* Prepare for storing the key.  */
       err = verify_chv3 (app, ctrl, pincb, pincb_arg);
       if (err)
         goto leave;
 
       /* Store the key. */
       if (app->app_local->cardcap.ext_lc_le && template_len > 254)
         exmode = 1;    /* Use extended length w/o a limit.  */
       else if (app->app_local->cardcap.cmd_chaining && template_len > 254)
         exmode = -254;
       else
         exmode = 0;
       err = iso7816_put_data_odd (app_get_slot (app), exmode, 0x3fff,
                                   template, template_len);
     }
   else
     {
       /* Build the private key template as described in section 4.3.3.6 of
          the OpenPGP card specs version 1.1:
          0xC0   <length> public exponent
          0xC1   <length> prime p
          0xC2   <length> prime q
       */
       assert (rsa_e_len <= 4);
       template_len = (1 + 1 + 4
                       + 1 + 1 + rsa_p_len
                       + 1 + 1 + rsa_q_len);
       template = tp = xtrymalloc_secure (template_len);
       if (!template)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       *tp++ = 0xC0;
       *tp++ = 4;
       memcpy (tp, rsa_e, rsa_e_len);
       if (rsa_e_len < 4)
         {
           /* Right justify E. */
           memmove (tp+4-rsa_e_len, tp, rsa_e_len);
           memset (tp, 0, 4-rsa_e_len);
         }
       tp += 4;
 
       *tp++ = 0xC1;
       *tp++ = rsa_p_len;
       memcpy (tp, rsa_p, rsa_p_len);
       tp += rsa_p_len;
 
       *tp++ = 0xC2;
       *tp++ = rsa_q_len;
       memcpy (tp, rsa_q, rsa_q_len);
       tp += rsa_q_len;
 
       assert (tp - template == template_len);
 
       /* Prepare for storing the key.  */
       err = verify_chv3 (app, ctrl, pincb, pincb_arg);
       if (err)
         goto leave;
 
       /* Store the key. */
       err = iso7816_put_data (app_get_slot (app), 0,
                               (app->appversion > 0x0007? 0xE0:0xE9)+keyno,
                               template, template_len);
     }
   if (err)
     {
       log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
       goto leave;
     }
 
   err = store_fpr (app, keyno, created_at, fprbuf, PUBKEY_ALGO_RSA,
                    rsa_n, rsa_n_len, rsa_e, rsa_e_len);
   if (err)
     goto leave;
 
 
  leave:
   xfree (template);
   return err;
 }
 
 
 static gpg_error_t
 ecc_writekey (app_t app, ctrl_t ctrl,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg, int keyno,
               const unsigned char *buf, size_t buflen, int depth)
 {
   gpg_error_t err;
   const unsigned char *tok;
   size_t toklen;
   int last_depth1, last_depth2;
   const unsigned char *ecc_q = NULL;
   const unsigned char *ecc_d = NULL;
   size_t ecc_q_len, ecc_d_len;
   const char *curve = NULL;
   u32 created_at = 0;
   const char *oidstr;
   int flag_djb_tweak = 0;
   int algo;
   gcry_mpi_t oid = NULL;
   const unsigned char *oidbuf;
   unsigned int n;
   size_t oid_len;
   unsigned char fprbuf[20];
 
   /* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)):
      curve = "NIST P-256" */
   /* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)):
      curve = "secp256k1" */
   /* (private-key(ecc(curve%s)(flags eddsa)(q%m)(d%m))(created-at%d)):
       curve = "Ed25519" */
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
 
       if (tok && toklen == 5 && !memcmp (tok, "curve", 5))
         {
           char *curve_name;
 
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
 
           curve_name = xtrymalloc (toklen+1);
           if (!curve_name)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
 
           memcpy (curve_name, tok, toklen);
           curve_name[toklen] = 0;
           curve = openpgp_is_curve_supported (curve_name, NULL, NULL);
           xfree (curve_name);
         }
       else if (tok && toklen == 5 && !memcmp (tok, "flags", 5))
         {
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
 
           if (tok)
             {
               if ((toklen == 5 && !memcmp (tok, "eddsa", 5))
                   || (toklen == 9 && !memcmp (tok, "djb-tweak", 9)))
                 flag_djb_tweak = 1;
             }
         }
       else if (tok && toklen == 1)
         {
           const unsigned char **buf2;
           size_t *buf2len;
           int native = flag_djb_tweak;
 
           switch (*tok)
             {
             case 'q': buf2 = &ecc_q; buf2len = &ecc_q_len; break;
             case 'd': buf2 = &ecc_d; buf2len = &ecc_d_len; native = 0; break;
             default: buf2 = NULL;  buf2len = NULL; break;
             }
           if (buf2 && *buf2)
             {
               err = gpg_error (GPG_ERR_DUP_VALUE);
               goto leave;
             }
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
           if (tok && buf2)
             {
               if (!native)
                 /* Strip off leading zero bytes and save. */
                 for (;toklen && !*tok; toklen--, tok++)
                   ;
 
               *buf2 = tok;
               *buf2len = toklen;
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
   /* Parse other attributes. */
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
       if (tok && toklen == 10 && !memcmp ("created-at", tok, toklen))
         {
           if ((err = parse_sexp (&buf,&buflen,&depth,&tok,&toklen)))
             goto leave;
           if (tok)
             {
               for (created_at=0; toklen && *tok && *tok >= '0' && *tok <= '9';
                    tok++, toklen--)
                 created_at = created_at*10 + (*tok - '0');
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
 
 
   /* Check that we have all parameters and that they match the card
      description. */
   if (!curve)
     {
       log_error (_("unsupported curve\n"));
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
   if (!created_at)
     {
       log_error (_("creation timestamp missing\n"));
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
   if (flag_djb_tweak && keyno != 1)
     algo = PUBKEY_ALGO_EDDSA;
   else if (keyno == 1)
     algo = PUBKEY_ALGO_ECDH;
   else
     algo = PUBKEY_ALGO_ECDSA;
 
   oidstr = openpgp_curve_to_oid (curve, NULL, NULL);
   err = openpgp_oid_from_str (oidstr, &oid);
   if (err)
     goto leave;
   oidbuf = gcry_mpi_get_opaque (oid, &n);
   if (!oidbuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   oid_len = (n+7)/8;
 
   if (app->app_local->keyattr[keyno].key_type != KEY_TYPE_ECC
       || app->app_local->keyattr[keyno].ecc.curve != curve
       || (flag_djb_tweak !=
           (app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)))
     {
       if (app->app_local->extcap.algo_attr_change)
         {
           unsigned char *keyattr;
 
           if (!oid_len)
             {
               err = gpg_error (GPG_ERR_INTERNAL);
               goto leave;
             }
           keyattr = xtrymalloc (oid_len);
           if (!keyattr)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           keyattr[0] = algo;
           memcpy (keyattr+1, oidbuf+1, oid_len-1);
           err = change_keyattr (app, ctrl, keyno,
                                 keyattr, oid_len, pincb, pincb_arg);
           xfree (keyattr);
           if (err)
             goto leave;
         }
       else
         {
           log_error ("key attribute on card doesn't match\n");
           err = gpg_error (GPG_ERR_INV_VALUE);
           goto leave;
         }
     }
 
   if (opt.verbose)
     log_info ("ECC private key size is %u bytes\n", (unsigned int)ecc_d_len);
 
   /* We need to remove the cached public key.  */
   xfree (app->app_local->pk[keyno].key);
   app->app_local->pk[keyno].key = NULL;
   app->app_local->pk[keyno].keylen = 0;
   app->app_local->pk[keyno].read_done = 0;
 
   if (app->app_local->extcap.is_v2)
     {
       /* Build the private key template as described in section 4.3.3.7 of
          the OpenPGP card specs version 2.0.  */
       unsigned char *template;
       size_t template_len;
       int exmode;
 
       err = build_ecc_privkey_template (app, keyno,
                                         ecc_d, ecc_d_len,
                                         ecc_q, ecc_q_len,
                                         &template, &template_len);
       if (err)
         goto leave;
 
       /* Prepare for storing the key.  */
       err = verify_chv3 (app, ctrl, pincb, pincb_arg);
       if (err)
         {
           xfree (template);
           goto leave;
         }
 
       /* Store the key. */
       if (app->app_local->cardcap.ext_lc_le && template_len > 254)
         exmode = 1;    /* Use extended length w/o a limit.  */
       else if (app->app_local->cardcap.cmd_chaining && template_len > 254)
         exmode = -254;
       else
         exmode = 0;
       err = iso7816_put_data_odd (app_get_slot (app), exmode, 0x3fff,
                                   template, template_len);
       xfree (template);
     }
   else
     err = gpg_error (GPG_ERR_NOT_SUPPORTED);
 
   if (err)
     {
       log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
       goto leave;
     }
 
   err = store_fpr (app, keyno, created_at, fprbuf, algo, oidbuf, oid_len,
                    ecc_q, ecc_q_len, ecdh_params (curve), (size_t)4);
 
  leave:
   gcry_mpi_release (oid);
   return err;
 }
 
 
 /* Handle the WRITEKEY command for OpenPGP.  This function expects a
    canonical encoded S-expression with the secret key in KEYDATA and
    its length (for assertions) in KEYDATALEN.  KEYID needs to be the
    usual keyid which for OpenPGP is the string "OPENPGP.n" with
    n=1,2,3.  Bit 0 of FLAGS indicates whether an existing key shall
    get overwritten.  PINCB and PINCB_ARG are the usual arguments for
    the pinentry callback.  */
 static gpg_error_t
 do_writekey (app_t app, ctrl_t ctrl,
              const char *keyid, unsigned int flags,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const unsigned char *keydata, size_t keydatalen)
 {
   gpg_error_t err;
   int force = (flags & 1);
   int keyno;
   const unsigned char *buf, *tok;
   size_t buflen, toklen;
   int depth;
 
   (void)ctrl;
 
   if (!ascii_strcasecmp (keyid, "OPENPGP.1"))
     keyno = 0;
   else if (!ascii_strcasecmp (keyid, "OPENPGP.2"))
     keyno = 1;
   else if (!ascii_strcasecmp (keyid, "OPENPGP.3"))
     keyno = 2;
   else
     return gpg_error (GPG_ERR_INV_ID);
 
   err = does_key_exist (app, keyno, 0, force);
   if (err)
     return err;
 
 
   /*
      Parse the S-expression
    */
   buf = keydata;
   buflen = keydatalen;
   depth = 0;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if (!tok || toklen != 11 || memcmp ("private-key", tok, toklen))
     {
       if (!tok)
         ;
       else if (toklen == 21 && !memcmp ("protected-private-key", tok, toklen))
         log_info ("protected-private-key passed to writekey\n");
       else if (toklen == 20 && !memcmp ("shadowed-private-key", tok, toklen))
         log_info ("shadowed-private-key passed to writekey\n");
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if (tok && toklen == 3 && memcmp ("rsa", tok, toklen) == 0)
     err = rsa_writekey (app, ctrl, pincb, pincb_arg, keyno, buf, buflen, depth);
   else if (tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0)
     err = ecc_writekey (app, ctrl, pincb, pincb_arg, keyno, buf, buflen, depth);
   else
     {
       err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
       goto leave;
     }
 
  leave:
   return err;
 }
 
 
 
 /* Handle the GENKEY command. */
 static gpg_error_t
 do_genkey (app_t app, ctrl_t ctrl,  const char *keyref, const char *keyalgo,
            unsigned int flags, time_t createtime,
            gpg_error_t (*pincb)(void*, const char *, char **),
            void *pincb_arg)
 {
   gpg_error_t err;
   char numbuf[30];
   const char *keynostr;
   unsigned char *buffer = NULL;
   const unsigned char *keydata;
   size_t buflen, keydatalen;
   u32 created_at;
   int keyno;
   int force = !!(flags & APP_GENKEY_FLAG_FORCE);
   time_t start_at;
   int exmode = 0;
   int le_value = 256; /* Use legacy value. */
 
   /* Strip the OpenPGP prefix which is for historical reasons optional.  */
   keynostr = keyref;
   if (!ascii_strncasecmp (keynostr, "OPENPGP.", 8))
     keynostr += 8;
 
   keyno = atoi (keynostr) - 1;
   if (!digitp (keynostr) || keyno < 0 || keyno > 2)
     return gpg_error (GPG_ERR_INV_ID);
 
   /* We flush the cache to increase the traffic before a key
      generation.  This _might_ help a card to gather more entropy. */
   flush_cache (app);
 
   /* Obviously we need to remove the cached public key.  */
   xfree (app->app_local->pk[keyno].key);
   app->app_local->pk[keyno].key = NULL;
   app->app_local->pk[keyno].keylen = 0;
   app->app_local->pk[keyno].read_done = 0;
 
   /* Check whether a key already exists.  */
   err = does_key_exist (app, keyno, 1, force);
   if (err)
     return err;
 
   if (keyalgo && app->app_local->keyattr[keyno].keyalgo
       && strcmp (keyalgo, app->app_local->keyattr[keyno].keyalgo))
     {
       /* Specific algorithm requested which is not the currently
        * configured algorithm.  Change it.  */
       log_info ("openpgp: changing key attribute from %s to %s\n",
                  app->app_local->keyattr[keyno].keyalgo, keyalgo);
       err = change_keyattr_from_string (app, ctrl, pincb, pincb_arg,
                                         keyref, keyalgo, NULL, 0);
       if (err)
         return err;
     }
 
   if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
     {
       unsigned int keybits = app->app_local->keyattr[keyno].rsa.n_bits;
 
       /* Because we send the key parameter back via status lines we need
          to put a limit on the max. allowed keysize.  2048 bit will
          already lead to a 527 byte long status line and thus a 4096 bit
          key would exceed the Assuan line length limit.  */
       if (keybits > 4096)
         return gpg_error (GPG_ERR_TOO_LARGE);
 
       if (app->app_local->cardcap.ext_lc_le && keybits > RSA_SMALL_SIZE_KEY
           && app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
         {
           exmode = 1;    /* Use extended length w/o a limit.  */
           le_value = determine_rsa_response (app, keyno);
           /* No need to check le_value because it comes from a 16 bit
              value and thus can't create an overflow on a 32 bit
              system.  */
         }
     }
 
   /* Prepare for key generation by verifying the Admin PIN.  */
   err = verify_chv3 (app, ctrl, pincb, pincb_arg);
   if (err)
     return err;
 
 
   log_info (_("please wait while key is being generated ...\n"));
   start_at = time (NULL);
   err = iso7816_generate_keypair (app_get_slot (app), exmode, 0x80, 0,
                                   (keyno == 0? "\xB6" :
                                    keyno == 1? "\xB8" : "\xA4"),
                                   2, le_value, &buffer, &buflen);
   if (err)
     {
       log_error (_("generating key failed\n"));
       return gpg_error (GPG_ERR_CARD);
     }
 
   {
     int nsecs = (int)(time (NULL) - start_at);
     log_info (ngettext("key generation completed (%d second)\n",
                        "key generation completed (%d seconds)\n",
                        nsecs), nsecs);
   }
 
   keydata = find_tlv (buffer, buflen, 0x7F49, &keydatalen);
   if (!keydata)
     {
       err = gpg_error (GPG_ERR_CARD);
       log_error (_("response does not contain the public key data\n"));
       goto leave;
     }
 
   created_at = (u32)(createtime? createtime : gnupg_get_time ());
   sprintf (numbuf, "%u", created_at);
   send_status_info (ctrl, "KEY-CREATED-AT",
                     numbuf, (size_t)strlen(numbuf), NULL, 0);
 
   err = read_public_key (app, ctrl, created_at, keyno, buffer, buflen);
  leave:
   xfree (buffer);
   return err;
 }
 
 
 static unsigned long
 convert_sig_counter_value (const unsigned char *value, size_t valuelen)
 {
   unsigned long ul;
 
   if (valuelen == 3 )
     ul = (value[0] << 16) | (value[1] << 8) | value[2];
   else
     {
       log_error (_("invalid structure of OpenPGP card (DO 0x93)\n"));
       ul = 0;
     }
   return ul;
 }
 
 static unsigned long
 get_sig_counter (app_t app)
 {
   void *relptr;
   unsigned char *value;
   size_t valuelen;
   unsigned long ul;
 
   relptr = get_one_do (app, 0x0093, &value, &valuelen, NULL);
   if (!relptr)
     return 0;
   ul = convert_sig_counter_value (value, valuelen);
   xfree (relptr);
   return ul;
 }
 
 static gpg_error_t
 compare_fingerprint (app_t app, int keyno, unsigned char *sha1fpr)
 {
   const unsigned char *fpr;
   unsigned char *buffer;
   size_t buflen, n;
   int rc, i;
 
   assert (keyno >= 0 && keyno <= 2);
 
   rc = get_cached_data (app, 0x006E, &buffer, &buflen, 0, 0);
   if (rc)
     {
       log_error (_("error reading application data\n"));
       return gpg_error (GPG_ERR_GENERAL);
     }
   fpr = find_tlv (buffer, buflen, 0x00C5, &n);
   if (!fpr || n < 60)
     {
       xfree (buffer);
       log_error (_("error reading fingerprint DO\n"));
       return gpg_error (GPG_ERR_GENERAL);
     }
   fpr += keyno*20;
   for (i=0; i < 20; i++)
     if (sha1fpr[i] != fpr[i])
       {
         xfree (buffer);
         log_info (_("fingerprint on card does not match requested one\n"));
         return gpg_error (GPG_ERR_WRONG_SECKEY);
       }
   xfree (buffer);
   return 0;
 }
 
 
 /* If a fingerprint has been specified check it against the one on the
    card.  This allows for a meaningful error message in case the key
    on the card has been replaced but the shadow information known to
    gpg has not been updated.  If there is no fingerprint we assume
    that this is okay. */
 static gpg_error_t
 check_against_given_fingerprint (app_t app, const char *fpr, int key)
 {
   unsigned char tmp[20];
   const char *s;
   int n;
 
   for (s=fpr, n=0; hexdigitp (s); s++, n++)
     ;
   if (n != 40)
     return gpg_error (GPG_ERR_INV_ID);
   else if (!*s)
     ; /* okay */
   else
     return gpg_error (GPG_ERR_INV_ID);
 
   for (s=fpr, n=0; n < 20; s += 2, n++)
         tmp[n] = xtoi_2 (s);
   return compare_fingerprint (app, key-1, tmp);
 }
 
 
 /* Check KEYIDSTR, if it's valid.
    When KEYNO is 0, it means it's for PIN check.
    Otherwise, KEYNO corresponds to the slot (signing, decipher and auth).
    KEYIDSTR is either:
     (1) Serial number
     (2) Serial number "/" fingerprint
     (3) Serial number "[CHV3]"
     (4) keygrip
 
    When KEYNO is 0 and KEYIDSTR is for a keygrip, the keygrip should
    be to be compared is the first one (keygrip for signing).
    When KEYNO is 1, KEYIDSTR is for a keygrip, and R_USE_AUTH is not
    NULL, OpenPGP.1 is first tested and then OpenPGP.3.  In the latter
    case 1 is stored at R_USE_AUTH
  */
 static int
 check_keyidstr (app_t app, const char *keyidstr, int keyno, int *r_use_auth)
 {
   int rc;
   const char *s;
   int n;
   const char *fpr = NULL;
   unsigned char tmp_sn[20]; /* Actually 16 bytes but also for the fpr. */
 
   if (r_use_auth)
     *r_use_auth = 0;
 
   if (strlen (keyidstr) < 32)
     return gpg_error (GPG_ERR_INV_ID);
   else
     {
       for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
         ;
 
       /* Check if it's a keygrip */
       if (n == 40)
         {
           const unsigned char *keygrip_str;
 
           keygrip_str = app->app_local->pk[keyno?keyno-1:0].keygrip_str;
           if (!strncmp (keygrip_str, keyidstr, 40))
             return 0;
           else if (keyno == 1 && r_use_auth
                    && !strncmp (app->app_local->pk[2].keygrip_str,
                                 keyidstr, 40))
             {
               *r_use_auth = 1;
               return 0;
             }
           else
             return gpg_error (GPG_ERR_INV_ID);
         }
 
       if (n != 32 || strncmp (keyidstr, "D27600012401", 12))
         return gpg_error (GPG_ERR_INV_ID);
       else if (!*s)
         ; /* no fingerprint given: we allow this for now. */
       else if (*s == '/')
         fpr = s + 1;
 
       for (s=keyidstr, n=0; n < 16; s += 2, n++)
         tmp_sn[n] = xtoi_2 (s);
 
       if (app->card->serialnolen != 16)
         return gpg_error (GPG_ERR_INV_CARD);
       if (memcmp (app->card->serialno, tmp_sn, 16))
         return gpg_error (GPG_ERR_WRONG_CARD);
     }
 
   /* If a fingerprint has been specified check it against the one on
      the card.  This is allows for a meaningful error message in case
      the key on the card has been replaced but the shadow information
      known to gpg was not updated.  If there is no fingerprint, gpg
      will detect a bogus signature anyway due to the
      verify-after-signing feature. */
   rc = (fpr&&keyno)? check_against_given_fingerprint (app, fpr, keyno) : 0;
 
   return rc;
 }
 
 
 /* Compute a digital signature on INDATA which is expected to be the
    raw message digest. For this application the KEYIDSTR consists of
    the serialnumber and the fingerprint delimited by a slash.
 
    Note that this function may return the error code
    GPG_ERR_WRONG_CARD to indicate that the card currently present does
    not match the one required for the requested action (e.g. the
    serial number does not match).
 
    As a special feature a KEYIDSTR of "OPENPGP.3" redirects the
    operation to the auth command.
 */
 static gpg_error_t
 do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
          gpg_error_t (*pincb)(void*, const char *, char **),
          void *pincb_arg,
          const void *indata, size_t indatalen,
          unsigned char **outdata, size_t *outdatalen )
 {
   static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
     { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
       0x02, 0x01, 0x05, 0x00, 0x04, 0x14  };
   static unsigned char sha1_prefix[15] =   /* (1.3.14.3.2.26) */
     { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
       0x02, 0x1a, 0x05, 0x00, 0x04, 0x14  };
   static unsigned char sha224_prefix[19] = /* (2.16.840.1.101.3.4.2.4) */
     { 0x30, 0x2D, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
       0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
       0x1C  };
   static unsigned char sha256_prefix[19] = /* (2.16.840.1.101.3.4.2.1) */
     { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
       0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
       0x00, 0x04, 0x20  };
   static unsigned char sha384_prefix[19] = /* (2.16.840.1.101.3.4.2.2) */
     { 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
       0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05,
       0x00, 0x04, 0x30  };
   static unsigned char sha512_prefix[19] = /* (2.16.840.1.101.3.4.2.3) */
     { 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
       0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05,
       0x00, 0x04, 0x40  };
   int rc;
   unsigned char data[19+64];
   size_t datalen;
   unsigned long sigcount;
   int use_auth = 0;
   int exmode, le_value;
 
   if (!keyidstr || !*keyidstr)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   /* Strip off known prefixes.  */
 #define X(a,b,c,d) \
   if (hashalgo == GCRY_MD_ ## a                               \
       && (d)                                                  \
       && indatalen == sizeof b ## _prefix + (c)               \
       && !memcmp (indata, b ## _prefix, sizeof b ## _prefix)) \
     {                                                         \
       indata = (const char*)indata + sizeof b ## _prefix;     \
       indatalen -= sizeof b ## _prefix;                       \
     }
 
   if (indatalen == 20)
     ;  /* Assume a plain SHA-1 or RMD160 digest has been given.  */
   else X(SHA1,   sha1,   20, 1)
   else X(RMD160, rmd160, 20, 1)
   else X(SHA224, sha224, 28, app->app_local->extcap.is_v2)
   else X(SHA256, sha256, 32, app->app_local->extcap.is_v2)
   else X(SHA384, sha384, 48, app->app_local->extcap.is_v2)
   else X(SHA512, sha512, 64, app->app_local->extcap.is_v2)
   else if ((indatalen == 28 || indatalen == 32
             || indatalen == 48 || indatalen ==64)
            && app->app_local->extcap.is_v2)
     ;  /* Assume a plain SHA-3 digest has been given.  */
   else
     {
       log_error (_("card does not support digest algorithm %s\n"),
                  gcry_md_algo_name (hashalgo));
       /* Or the supplied digest length does not match an algorithm.  */
       return gpg_error (GPG_ERR_INV_VALUE);
     }
 #undef X
 
   /* Check whether an OpenPGP card of any version has been requested. */
   if (!ascii_strcasecmp (keyidstr, "OPENPGP.1"))
     ;
   else if (!ascii_strcasecmp (keyidstr, "OPENPGP.3"))
     use_auth = 1;
   else
     {
       rc = check_keyidstr (app, keyidstr, 1, &use_auth);
       if (rc)
         return rc;
     }
 
   /* Concatenate prefix and digest.  */
 #define X(a,b,d) \
   if (hashalgo == GCRY_MD_ ## a && (d) )                      \
     {                                                         \
       datalen = sizeof b ## _prefix + indatalen;              \
       assert (datalen <= sizeof data);                        \
       memcpy (data, b ## _prefix, sizeof b ## _prefix);       \
       memcpy (data + sizeof b ## _prefix, indata, indatalen); \
     }
 
   if (use_auth
       || app->app_local->keyattr[use_auth? 2: 0].key_type == KEY_TYPE_RSA)
     {
       X(SHA1,   sha1,   1)
       else X(RMD160, rmd160, 1)
       else X(SHA224, sha224, app->app_local->extcap.is_v2)
       else X(SHA256, sha256, app->app_local->extcap.is_v2)
       else X(SHA384, sha384, app->app_local->extcap.is_v2)
       else X(SHA512, sha512, app->app_local->extcap.is_v2)
       else
         return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
     }
   else
     {
       datalen = indatalen;
       memcpy (data, indata, indatalen);
     }
 #undef X
 
   /* Redirect to the AUTH command if asked to. */
   if (use_auth)
     {
       return do_auth (app, ctrl, "OPENPGP.3", pincb, pincb_arg,
                       data, datalen,
                       outdata, outdatalen);
     }
 
   /* Show the number of signature done using this key.  */
   sigcount = get_sig_counter (app);
   log_info (_("signatures created so far: %lu\n"), sigcount);
 
   /* Check CHV if needed.  */
   if (!app->did_chv1 || app->force_chv1)
     {
       char *pinvalue;
       size_t pinlen;
 
       rc = verify_a_chv (app, ctrl, pincb, pincb_arg, 1, sigcount,
                          &pinvalue, &pinlen);
       if (rc)
         return rc;
 
       app->did_chv1 = 1;
 
       /* For cards with versions < 2 we want to keep CHV1 and CHV2 in
          sync, thus we verify CHV2 here using the given PIN.  Cards
          with version2 to not have the need for a separate CHV2 and
          internally use just one.  Obviously we can't do that if the
          pinpad has been used. */
       if (!app->did_chv2 && pinvalue && !app->app_local->extcap.is_v2)
         {
           rc = iso7816_verify (app_get_slot (app), 0x82, pinvalue, pinlen);
           if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
             rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
           if (rc)
             {
               log_error (_("verify CHV%d failed: %s\n"), 2, gpg_strerror (rc));
               wipe_and_free (pinvalue, pinlen);
               flush_cache_after_error (app);
               return rc;
             }
           app->did_chv2 = 1;
           cache_pin (app, ctrl, 2, pinvalue);
         }
       wipe_and_free (pinvalue, pinlen);
     }
 
 
   if (app->app_local->cardcap.ext_lc_le
       && app->app_local->keyattr[0].key_type == KEY_TYPE_RSA
       && app->app_local->keyattr[0].rsa.n_bits > RSA_SMALL_SIZE_OP)
     {
       exmode = 1;    /* Use extended length.  */
       le_value = app->app_local->keyattr[0].rsa.n_bits / 8;
     }
   else
     {
       exmode = 0;
       le_value = 0;
     }
   rc = iso7816_compute_ds (app_get_slot (app), exmode, data, datalen, le_value,
                            outdata, outdatalen);
   if (gpg_err_code (rc) == GPG_ERR_TIMEOUT)
     clear_chv_status (app, ctrl, 1);
   else if (!rc && app->force_chv1)
     {
       app->did_chv1 = 0;
       cache_pin (app, ctrl, 1, NULL);
     }
 
   return rc;
 }
 
 /* Compute a digital signature using the INTERNAL AUTHENTICATE command
    on INDATA which is expected to be the raw message digest. For this
    application the KEYIDSTR consists of the serialnumber and the
    fingerprint delimited by a slash.  Optionally the id OPENPGP.3 may
    be given.
 
    Note that this function may return the error code
    GPG_ERR_WRONG_CARD to indicate that the card currently present does
    not match the one required for the requested action (e.g. the
    serial number does not match). */
 static gpg_error_t
 do_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
          gpg_error_t (*pincb)(void*, const char *, char **),
          void *pincb_arg,
          const void *indata, size_t indatalen,
          unsigned char **outdata, size_t *outdatalen )
 {
   int rc;
 
   if (!keyidstr || !*keyidstr)
     return gpg_error (GPG_ERR_INV_VALUE);
   if (app->app_local->keyattr[2].key_type == KEY_TYPE_RSA
       && indatalen > 101) /* For a 2048 bit key. */
     return gpg_error (GPG_ERR_INV_VALUE);
 
   if (app->app_local->keyattr[2].key_type == KEY_TYPE_ECC)
     {
       if (!(app->app_local->keyattr[2].ecc.flags & ECC_FLAG_DJB_TWEAK)
           && (indatalen == 51 || indatalen == 67 || indatalen == 83))
         {
           const char *p = (const char *)indata + 19;
           indata = p;
           indatalen -= 19;
         }
       else
         {
           const char *p = (const char *)indata + 15;
           indata = p;
           indatalen -= 15;
         }
     }
 
   /* Check whether an OpenPGP card of any version has been requested. */
   if (!ascii_strcasecmp (keyidstr, "OPENPGP.3"))
     ;
   else
     {
       rc = check_keyidstr (app, keyidstr, 3, NULL);
       if (rc)
         return rc;
     }
 
   rc = verify_chv2 (app, ctrl, pincb, pincb_arg);
   if (!rc)
     {
       int exmode, le_value;
 
       if (app->app_local->cardcap.ext_lc_le
           && app->app_local->keyattr[2].key_type == KEY_TYPE_RSA
           && app->app_local->keyattr[2].rsa.n_bits > RSA_SMALL_SIZE_OP)
         {
           exmode = 1;    /* Use extended length.  */
           le_value = app->app_local->keyattr[2].rsa.n_bits / 8;
         }
       else
         {
           exmode = 0;
           le_value = 0;
         }
       rc = iso7816_internal_authenticate (app_get_slot (app), exmode,
                                           indata, indatalen, le_value,
                                           outdata, outdatalen);
       if (gpg_err_code (rc) == GPG_ERR_TIMEOUT)
         clear_chv_status (app, ctrl, 1);
     }
   return rc;
 }
 
 
 static gpg_error_t
 do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const void *indata, size_t indatalen,
              unsigned char **outdata, size_t *outdatalen,
              unsigned int *r_info)
 {
   int n;
   int rc;
   int exmode, le_value;
   unsigned char *fixbuf = NULL;
   int padind = 0;
   int fixuplen = 0;
 
   if (!keyidstr || !*keyidstr || !indatalen)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   /* Check whether an OpenPGP card of any version has been requested. */
   if (!ascii_strcasecmp (keyidstr, "OPENPGP.2"))
     ;
   else
     {
       rc = check_keyidstr (app, keyidstr, 2, NULL);
       if (rc)
         return rc;
     }
 
   rc = verify_chv2 (app, ctrl, pincb, pincb_arg);
   if (rc)
     return rc;
 
   if ((indatalen == 16 + 1 || indatalen == 32 + 1)
       && ((char *)indata)[0] == 0x02)
     {
       /* PSO:DECIPHER with symmetric key.  */
       padind = -1;
     }
   else if (app->app_local->keyattr[1].key_type == KEY_TYPE_RSA)
     {
       /* We might encounter a couple of leading zeroes in the
          cryptogram.  Due to internal use of MPIs these leading zeroes
          are stripped.  However the OpenPGP card expects exactly 128
          bytes for the cryptogram (for a 1k key).  Thus we need to fix
          it up.  We do this for up to 16 leading zero bytes; a
          cryptogram with more than this is with a very high
          probability anyway broken.  If a signed conversion was used
          we may also encounter one leading zero followed by the correct
          length.  We fix that as well.  */
       if (indatalen >= (128-16) && indatalen < 128)      /* 1024 bit key.  */
         fixuplen = 128 - indatalen;
       else if (indatalen >= (192-16) && indatalen < 192) /* 1536 bit key.  */
         fixuplen = 192 - indatalen;
       else if (indatalen >= (256-16) && indatalen < 256) /* 2048 bit key.  */
         fixuplen = 256 - indatalen;
       else if (indatalen >= (384-16) && indatalen < 384) /* 3072 bit key.  */
         fixuplen = 384 - indatalen;
       else if (indatalen >= (512-16) && indatalen < 512) /* 4096 bit key.  */
         fixuplen = 512 - indatalen;
       else if (!*(const char *)indata && (indatalen == 129
                                           || indatalen == 193
                                           || indatalen == 257
                                           || indatalen == 385
                                           || indatalen == 513))
         fixuplen = -1;
       else
         fixuplen = 0;
 
       if (fixuplen > 0)
         {
           /* While we have to prepend stuff anyway, we can also
              include the padding byte here so that iso1816_decipher
              does not need to do another data mangling.  */
           fixuplen++;
 
           fixbuf = xtrymalloc (fixuplen + indatalen);
           if (!fixbuf)
             return gpg_error_from_syserror ();
 
           memset (fixbuf, 0, fixuplen);
           memcpy (fixbuf+fixuplen, indata, indatalen);
           indata = fixbuf;
           indatalen = fixuplen + indatalen;
           padind = -1; /* Already padded.  */
         }
       else if (fixuplen < 0)
         {
           /* We use the extra leading zero as the padding byte.  */
           padind = -1;
         }
     }
   else if (app->app_local->keyattr[1].key_type == KEY_TYPE_ECC)
     {
       int old_format_len = 0;
 
       if ((app->app_local->keyattr[1].ecc.flags & ECC_FLAG_DJB_TWEAK))
         {
           if (indatalen > 32 && (indatalen % 2))
             { /*
                * Skip the prefix.  It may be 0x40 (in new format), or MPI
                * head of 0x00 (in old format).
                */
               indata = (const char *)indata + 1;
               indatalen--;
             }
           else if (indatalen < 32)
             { /*
                * Old format trancated by MPI handling.
                */
               old_format_len = indatalen;
               indatalen = 32;
             }
         }
 
       n = 0;
       if (indatalen < 128)
         fixuplen = 7;
       else
         fixuplen = 10;
 
       fixbuf = xtrymalloc (fixuplen + indatalen);
       if (!fixbuf)
         return gpg_error_from_syserror ();
 
       /* Build 'Cipher DO' */
       fixbuf[n++] = '\xa6';
       if (indatalen < 128)
         fixbuf[n++] = (char)(indatalen+5);
       else
         {
           fixbuf[n++] = 0x81;
           fixbuf[n++] = (char)(indatalen+7);
         }
       fixbuf[n++] = '\x7f';
       fixbuf[n++] = '\x49';
       if (indatalen < 128)
         fixbuf[n++] = (char)(indatalen+2);
       else
         {
           fixbuf[n++] = 0x81;
           fixbuf[n++] = (char)(indatalen+3);
         }
       fixbuf[n++] = '\x86';
       if (indatalen < 128)
         fixbuf[n++] = (char)indatalen;
       else
         {
           fixbuf[n++] = 0x81;
           fixbuf[n++] = (char)indatalen;
         }
 
       if (old_format_len)
         {
           memset (fixbuf+fixuplen, 0, 32 - old_format_len);
           memcpy (fixbuf+fixuplen + 32 - old_format_len,
                   indata, old_format_len);
         }
       else
         {
           memcpy (fixbuf+fixuplen, indata, indatalen);
         }
       indata = fixbuf;
       indatalen = fixuplen + indatalen;
 
       padind = -1;
     }
   else
     return gpg_error (GPG_ERR_INV_VALUE);
 
   if (app->app_local->cardcap.ext_lc_le
       && (indatalen > 254
           || (app->app_local->keyattr[1].key_type == KEY_TYPE_RSA
               && app->app_local->keyattr[1].rsa.n_bits > RSA_SMALL_SIZE_OP)))
     {
       exmode = 1;    /* Extended length w/o a limit.  */
       le_value = app->app_local->keyattr[1].rsa.n_bits / 8;
     }
   else if (app->app_local->cardcap.cmd_chaining && indatalen > 254)
     {
       exmode = -254; /* Command chaining with max. 254 bytes.  */
       le_value = 0;
     }
   else
     exmode = le_value = 0;
 
   rc = iso7816_decipher (app_get_slot (app), exmode,
                          indata, indatalen, le_value, padind,
                          outdata, outdatalen);
   xfree (fixbuf);
   if (!rc && app->app_local->keyattr[1].key_type == KEY_TYPE_ECC)
     {
       unsigned char prefix = 0;
 
       if (app->app_local->keyattr[1].ecc.flags & ECC_FLAG_DJB_TWEAK)
         prefix = 0x40;
       else if ((*outdatalen % 2) == 0) /* No 0x04 -> x-coordinate only */
         prefix = 0x41;
 
       if (prefix)
         { /* Add the prefix */
           fixbuf = xtrymalloc (*outdatalen + 1);
           if (!fixbuf)
             {
               xfree (*outdata);
               return gpg_error_from_syserror ();
             }
           fixbuf[0] = prefix;
           memcpy (fixbuf+1, *outdata, *outdatalen);
           xfree (*outdata);
           *outdata = fixbuf;
           *outdatalen = *outdatalen + 1;
         }
     }
   if (gpg_err_code (rc) == GPG_ERR_TIMEOUT)
     clear_chv_status (app, ctrl, 1);
 
   if (gpg_err_code (rc) == GPG_ERR_CARD /* actual SW is 0x640a */
       && app->app_local->manufacturer == 5
       && app->appversion == 0x0200)
     log_info ("NOTE: Cards with manufacturer id 5 and s/n <= 346 (0x15a)"
               " do not work with encryption keys > 2048 bits\n");
 
   *r_info |= APP_DECIPHER_INFO_NOPAD;
 
   return rc;
 }
 
 
 /* Perform a simple verify operation for CHV1 and CHV2, so that
    further operations won't ask for CHV2 and it is possible to do a
    cheap check on the PIN: If there is something wrong with the PIN
    entry system, only the regular CHV will get blocked and not the
    dangerous CHV3.  KEYIDSTR is the usual card's serial number; an
    optional fingerprint part will be ignored.
 
    There is a special mode if the keyidstr is "<serialno>[CHV3]" with
    the "[CHV3]" being a literal string:  The Admin Pin is checked if
    and only if the retry counter is still at 3. */
 static gpg_error_t
 do_check_pin (app_t app, ctrl_t ctrl, const char *keyidstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg)
 {
   int admin_pin = 0;
   int rc;
 
   if (!keyidstr || !*keyidstr)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   rc = check_keyidstr (app, keyidstr, 0, NULL);
   if (rc)
     return rc;
 
   if ((strlen (keyidstr) >= 32+6 && !strcmp (keyidstr+32, "[CHV3]"))
       || (strlen (keyidstr) >= 40+6 && !strcmp (keyidstr+40, "[CHV3]")))
     admin_pin = 1;
 
   /* Yes, there is a race conditions: The user might pull the card
      right here and we won't notice that.  However this is not a
      problem and the check above is merely for a graceful failure
      between operations. */
 
   if (admin_pin)
     {
       void *relptr;
       unsigned char *value;
       size_t valuelen;
       int count;
 
       relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
       if (!relptr || valuelen < 7)
         {
           log_error (_("error retrieving CHV status from card\n"));
           xfree (relptr);
           return gpg_error (GPG_ERR_CARD);
         }
       count = value[6];
       xfree (relptr);
 
       if (!count)
         {
           log_info (_("card is permanently locked!\n"));
           return gpg_error (GPG_ERR_BAD_PIN);
         }
       else if (count < 3)
         {
           log_info (_("verification of Admin PIN is currently prohibited "
                       "through this command\n"));
           return gpg_error (GPG_ERR_GENERAL);
         }
 
       app->did_chv3 = 0; /* Force verification.  */
       return verify_chv3 (app, ctrl, pincb, pincb_arg);
     }
   else
     return verify_chv2 (app, ctrl, pincb, pincb_arg);
 }
 
 
 static void
 send_keyinfo_if_available (app_t app, ctrl_t ctrl, char *serial,
                            int data, int i)
 {
   char idbuf[50];
 
   if (app->app_local->pk[i].read_done)
     {
       sprintf (idbuf, "OPENPGP.%d", i+1);
       send_keyinfo (ctrl, data,
                     app->app_local->pk[i].keygrip_str, serial, idbuf);
     }
 }
 
 static gpg_error_t
 do_with_keygrip (app_t app, ctrl_t ctrl, int action, const char *keygrip_str,
                  int capability)
 {
   int i;
 
   /* Make sure we have load the public keys.  */
   for (i = 0; i < 3; i++)
     get_public_key (app, i);
 
   if (action == KEYGRIP_ACTION_LOOKUP)
     {
       if (keygrip_str == NULL)
         return gpg_error (GPG_ERR_NOT_FOUND);
 
       for (i = 0; i < 3; i++)
         if (app->app_local->pk[i].read_done
             && !strcmp (keygrip_str, app->app_local->pk[i].keygrip_str))
           return 0; /* Found */
     }
   else
     {
       char buf[65];
       int data = (action == KEYGRIP_ACTION_SEND_DATA);
 
       if (DIM (buf) < 2 * app->card->serialnolen + 1)
         return gpg_error (GPG_ERR_BUFFER_TOO_SHORT);
 
       bin2hex (app->card->serialno, app->card->serialnolen, buf);
 
       if (keygrip_str == NULL)
         {
           if (capability == 0)
             {
               for (i = 0; i < 3; i++)
                 send_keyinfo_if_available (app, ctrl, buf, data, i);
             }
           else
             {
               if (capability == GCRY_PK_USAGE_SIGN)
                 i = 0;
               else if (capability == GCRY_PK_USAGE_ENCR)
                 i = 1;
               else if (capability == GCRY_PK_USAGE_AUTH)
                 i = 2;
               else
                 i = -1;
               if (i >= 0)
                 send_keyinfo_if_available (app, ctrl, buf, data, i);
             }
 
           /* Return an error so that the dispatcher keeps on looping
            * over the other applications.  Only for clarity we use a
            * different error code than for the not_found case.  */
           return gpg_error (GPG_ERR_TRUE);
         }
       else
         {
           for (i = 0; i < 3; i++)
             if (!strcmp (keygrip_str, app->app_local->pk[i].keygrip_str))
               {
                 send_keyinfo_if_available (app, ctrl, buf, data, i);
                 return 0;
               }
         }
     }
 
   return gpg_error (GPG_ERR_NOT_FOUND);
 }
 
 
 /* Show information about card capabilities.  */
 static void
 show_caps (struct app_local_s *s)
 {
   log_info ("Version-2+ .....: %s\n", s->extcap.is_v2? "yes":"no");
   log_info ("Extcap-v3 ......: %s\n", s->extcap.extcap_v3? "yes":"no");
   log_info ("Button .........: %s\n", s->extcap.has_button? "yes":"no");
 
   log_info ("SM-Support .....: %s", s->extcap.sm_supported? "yes":"no");
   if (s->extcap.sm_supported)
     log_printf (" (%s)", s->extcap.sm_algo==2? "3DES":
                 (s->extcap.sm_algo==2? "AES-128" : "AES-256"));
   log_info ("Get-Challenge ..: %s", s->extcap.get_challenge? "yes":"no");
   if (s->extcap.get_challenge)
     log_printf (" (%u bytes max)", s->extcap.max_get_challenge);
   log_info ("Key-Import .....: %s\n", s->extcap.key_import? "yes":"no");
   log_info ("Change-Force-PW1: %s\n", s->extcap.change_force_chv? "yes":"no");
   log_info ("Private-DOs ....: %s\n", s->extcap.private_dos? "yes":"no");
   log_info ("Algo-Attr-Change: %s\n", s->extcap.algo_attr_change? "yes":"no");
   log_info ("Symmetric Crypto: %s\n", s->extcap.has_decrypt? "yes":"no");
   log_info ("KDF-Support ....: %s\n", s->extcap.kdf_do? "yes":"no");
   log_info ("Max-Cert3-Len ..: %u\n", s->extcap.max_certlen_3);
   if (s->extcap.extcap_v3)
     {
       log_info ("PIN-Block-2 ....: %s\n", s->extcap.pin_blk2? "yes":"no");
       log_info ("MSE-Support ....: %s\n", s->extcap.mse? "yes":"no");
       log_info ("Max-Special-DOs : %u\n", s->extcap.max_special_do);
     }
   log_info ("Cmd-Chaining ...: %s\n", s->cardcap.cmd_chaining?"yes":"no");
   log_info ("Ext-Lc-Le ......: %s\n", s->cardcap.ext_lc_le?"yes":"no");
   log_info ("Status-Indicator: %02X\n", s->status_indicator);
 
   log_info ("GnuPG-No-Sync ..: %s\n",  s->flags.no_sync? "yes":"no");
   log_info ("GnuPG-Def-PW2 ..: %s\n",  s->flags.def_chv2? "yes":"no");
 }
 
 
 /* Parse the historical bytes in BUFFER of BUFLEN and store them in
    APPLOC.  */
 static void
 parse_historical (struct app_local_s *apploc,
                   const unsigned char * buffer, size_t buflen)
 {
   /* Example buffer: 00 31 C5 73 C0 01 80 00 90 00  */
   if (buflen < 4)
     {
       log_error ("warning: historical bytes are too short\n");
       return; /* Too short.  */
     }
   if (*buffer)
     {
       log_error ("warning: bad category indicator in historical bytes\n");
       return;
     }
 
   /* Skip category indicator.  */
   buffer++;
   buflen--;
 
   /* Get the status indicator.  */
   apploc->status_indicator = buffer[buflen-3];
   buflen -= 3;
 
   /* Parse the compact TLV.  */
   while (buflen)
     {
       unsigned int tag = (*buffer & 0xf0) >> 4;
       unsigned int len = (*buffer & 0x0f);
       if (len+1 > buflen)
         {
           log_error ("warning: bad Compact-TLV in historical bytes\n");
           return; /* Error.  */
         }
       buffer++;
       buflen--;
       if (tag == 7 && len == 3)
         {
           /* Card capabilities.  */
           apploc->cardcap.cmd_chaining = !!(buffer[2] & 0x80);
           apploc->cardcap.ext_lc_le    = !!(buffer[2] & 0x40);
         }
       buffer += len;
       buflen -= len;
     }
 }
 
 
 /*
  * Check if the OID in an DER encoding is available by GnuPG/libgcrypt,
  * and return the canonical curve name.  Return NULL if not available.
  * The constant string is not allocated dynamically, never free it.
  */
 static const char *
 ecc_curve (const unsigned char *buf, size_t buflen)
 {
   gcry_mpi_t oid;
   char *oidstr;
   const char *result;
   unsigned char *oidbuf;
 
   oidbuf = xtrymalloc (buflen + 1);
   if (!oidbuf)
     return NULL;
 
   memcpy (oidbuf+1, buf, buflen);
   oidbuf[0] = buflen;
   oid = gcry_mpi_set_opaque (NULL, oidbuf, (buflen+1) * 8);
   if (!oid)
     {
       xfree (oidbuf);
       return NULL;
     }
 
   oidstr = openpgp_oid_to_str (oid);
   gcry_mpi_release (oid);
   if (!oidstr)
     return NULL;
 
   result = openpgp_oid_to_curve (oidstr, 1);
   xfree (oidstr);
   return result;
 }
 
 
 static const char *
 get_algorithm_attribute_string (const unsigned char *buffer,
                                 size_t buflen)
 {
   enum gcry_pk_algos galgo;
   const char *curve;
   unsigned int nbits = 0;
 
   galgo = map_openpgp_pk_to_gcry (*buffer);
   nbits = 0;
   curve = NULL;
 
   if (*buffer == PUBKEY_ALGO_RSA && (buflen == 5 || buflen == 6))
     nbits = (buffer[1]<<8 | buffer[2]);
   else if (*buffer == PUBKEY_ALGO_ECDH || *buffer == PUBKEY_ALGO_ECDSA
            || *buffer == PUBKEY_ALGO_EDDSA)
     {
       int oidlen = buflen - 1;
 
       if (buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
         { /* Found "pubkey required"-byte for private key template.  */
           oidlen--;
         }
 
       curve = ecc_curve (buffer + 1, oidlen);
     }
   else if (opt.verbose)
     log_printhex (buffer, buflen, "");
 
   return get_keyalgo_string (galgo, nbits, curve);
 }
 
 
 /* Parse and optionally show the algorithm attributes for KEYNO.
    KEYNO must be in the range 0..2.  */
 static void
 parse_algorithm_attribute (app_t app, int keyno)
 {
   unsigned char *buffer;
   size_t buflen;
   void *relptr;
   const char desc[3][5] = {"sign", "encr", "auth"};
   enum gcry_pk_algos galgo;
   unsigned int nbits;
   const char *curve;
 
   log_assert (keyno >=0 && keyno <= 2);
 
   app->app_local->keyattr[keyno].key_type = KEY_TYPE_RSA;
   app->app_local->keyattr[keyno].rsa.n_bits = 0;
 
   relptr = get_one_do (app, 0xC1+keyno, &buffer, &buflen, NULL);
   if (!relptr)
     {
       log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
       return;
     }
   if (buflen < 1)
     {
       log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
       xfree (relptr);
       return;
     }
 
   if (opt.verbose)
     log_info ("Key-Attr-%s ..: ", desc[keyno]);
 
   galgo = map_openpgp_pk_to_gcry (*buffer);
   nbits = 0;
   curve = NULL;
 
   if (*buffer == PUBKEY_ALGO_RSA && (buflen == 5 || buflen == 6))
     {
       app->app_local->keyattr[keyno].rsa.n_bits = (buffer[1]<<8 | buffer[2]);
       app->app_local->keyattr[keyno].rsa.e_bits = (buffer[3]<<8 | buffer[4]);
       app->app_local->keyattr[keyno].rsa.format = 0;
       if (buflen < 6)
         app->app_local->keyattr[keyno].rsa.format = RSA_STD;
       else
         app->app_local->keyattr[keyno].rsa.format = (buffer[5] == 0? RSA_STD   :
                                                      buffer[5] == 1? RSA_STD_N :
                                                      buffer[5] == 2? RSA_CRT   :
                                                      buffer[5] == 3? RSA_CRT_N :
                                                      RSA_UNKNOWN_FMT);
 
       nbits = app->app_local->keyattr[keyno].rsa.n_bits;
       if (opt.verbose)
         log_printf
           ("RSA, n=%u, e=%u, fmt=%s\n",
            app->app_local->keyattr[keyno].rsa.n_bits,
            app->app_local->keyattr[keyno].rsa.e_bits,
            app->app_local->keyattr[keyno].rsa.format == RSA_STD?  "std"  :
            app->app_local->keyattr[keyno].rsa.format == RSA_STD_N?"std+n":
            app->app_local->keyattr[keyno].rsa.format == RSA_CRT?  "crt"  :
            app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N?"crt+n":"?");
     }
   else if (*buffer == PUBKEY_ALGO_ECDH || *buffer == PUBKEY_ALGO_ECDSA
            || *buffer == PUBKEY_ALGO_EDDSA)
     {
       int oidlen = buflen - 1;
 
       app->app_local->keyattr[keyno].ecc.flags = 0;
 
       if (buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
         { /* Found "pubkey required"-byte for private key template.  */
           oidlen--;
           if (buffer[buflen-1] == 0xff)
             app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
         }
 
       curve = ecc_curve (buffer + 1, oidlen);
 
       if (!curve)
         log_printhex (buffer+1, buflen-1, "Curve with OID not supported: ");
       else
         {
           app->app_local->keyattr[keyno].key_type = KEY_TYPE_ECC;
           app->app_local->keyattr[keyno].ecc.curve = curve;
           if (*buffer == PUBKEY_ALGO_EDDSA
               || (*buffer == PUBKEY_ALGO_ECDH
                   && !strcmp (app->app_local->keyattr[keyno].ecc.curve,
                               "Curve25519")))
             app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_DJB_TWEAK;
           if (opt.verbose)
             log_printf
               ("ECC, curve=%s%s\n", app->app_local->keyattr[keyno].ecc.curve,
                !(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)?
                "": keyno==1? " (djb-tweak)": " (eddsa)");
         }
     }
   else if (opt.verbose)
     log_printhex (buffer, buflen, "");
 
   app->app_local->keyattr[keyno].keyalgo
     = get_keyalgo_string (galgo, nbits, curve);
 
   if (opt.verbose)
     log_info ("Key-Algo-%s ..: %s\n",
               desc[keyno], app->app_local->keyattr[keyno].keyalgo);
 
   xfree (relptr);
 }
 
 
 /* Prepare a reselect of another application.  This is used by cards
  * which support on-the-fly switching between applications.  The
  * function is called to give us a chance to save state for a future
  * reselect of us again.  */
 static gpg_error_t
 do_prep_reselect (app_t app, ctrl_t ctrl)
 {
   gpg_error_t err;
 
   (void)app;
   (void)ctrl;
 
   err = 0;
   return err;
 }
 
 
 /* Reselect the application.  This is used by cards which support
  * on-the-fly switching between applications.  */
 static gpg_error_t
 do_reselect (app_t app, ctrl_t ctrl)
 {
   gpg_error_t err;
 
   (void)ctrl;
 
   /* An extra check which should not be necessary because the caller
    * should have made sure that a re-select is only called for
    * appropriate cards.  */
   if (app->card->cardtype != CARDTYPE_YUBIKEY)
     return gpg_error (GPG_ERR_NOT_SUPPORTED);
 
   /* Note that the card can't cope with P2=0xCO, thus we need to pass
    * a special flag value. */
   err = iso7816_select_application (app_get_slot (app),
                                     openpgp_aid, sizeof openpgp_aid, 0x0001);
   if (!err)
     {
       app->did_chv1 = 0;
       app->did_chv2 = 0;
       app->did_chv3 = 0;
     }
   return err;
 }
 
 
 /* Select the OpenPGP application on the card in SLOT.  This function
    must be used before any other OpenPGP application functions. */
 gpg_error_t
 app_select_openpgp (app_t app)
 {
   int slot = app_get_slot (app);
   int rc;
   unsigned char *buffer;
   size_t buflen;
   void *relptr;
 
   /* Note that the card can't cope with P2=0xCO, thus we need to pass a
      special flag value. */
   rc = iso7816_select_application (slot,
                                    openpgp_aid, sizeof openpgp_aid, 0x0001);
   if (!rc)
     {
       unsigned int manufacturer;
 
       app->apptype = APPTYPE_OPENPGP;
 
       app->did_chv1 = 0;
       app->did_chv2 = 0;
       app->did_chv3 = 0;
       app->app_local = NULL;
 
       /* The OpenPGP card returns the serial number as part of the
          AID; because we prefer to use OpenPGP serial numbers, we
          replace a possibly already set one from a EF.GDO with this
          one.  Note, that for current OpenPGP cards, no EF.GDO exists
          and thus it won't matter at all. */
       rc = iso7816_get_data (slot, 0, 0x004F, &buffer, &buflen);
       if (rc)
         goto leave;
       if (opt.verbose)
         {
           log_info ("AID: ");
           log_printhex (buffer, buflen, "");
         }
 
       app->appversion = buffer[6] << 8;
       app->appversion |= buffer[7];
       manufacturer = (buffer[8]<<8 | buffer[9]);
 
       xfree (app->card->serialno);
       app->card->serialno = buffer;
       app->card->serialnolen = buflen;
       buffer = NULL;
       app->app_local = xtrycalloc (1, sizeof *app->app_local);
       if (!app->app_local)
         {
           rc = gpg_error (gpg_err_code_from_errno (errno));
           goto leave;
         }
 
       app->app_local->manufacturer = manufacturer;
 
       if (app->appversion >= 0x0200)
         app->app_local->extcap.is_v2 = 1;
 
       if (app->appversion >= 0x0300)
         app->app_local->extcap.extcap_v3 = 1;
 
       /* Read the historical bytes.  */
       relptr = get_one_do (app, 0x5f52, &buffer, &buflen, NULL);
       if (relptr)
         {
           if (opt.verbose)
             {
               log_info ("Historical Bytes: ");
               log_printhex (buffer, buflen, "");
             }
           parse_historical (app->app_local, buffer, buflen);
           xfree (relptr);
         }
 
       /* Read the force-chv1 flag.  */
       relptr = get_one_do (app, 0x00C4, &buffer, &buflen, NULL);
       if (!relptr)
         {
           log_error (_("can't access %s - invalid OpenPGP card?\n"),
                      "CHV Status Bytes");
           goto leave;
         }
       app->force_chv1 = (buflen && *buffer == 0);
       xfree (relptr);
 
       /* Read the extended capabilities.  */
       relptr = get_one_do (app, 0x00C0, &buffer, &buflen, NULL);
       if (!relptr)
         {
           log_error (_("can't access %s - invalid OpenPGP card?\n"),
                      "Extended Capability Flags" );
           goto leave;
         }
       if (buflen)
         {
           app->app_local->extcap.sm_supported     = !!(*buffer & 0x80);
           app->app_local->extcap.get_challenge    = !!(*buffer & 0x40);
           app->app_local->extcap.key_import       = !!(*buffer & 0x20);
           app->app_local->extcap.change_force_chv = !!(*buffer & 0x10);
           app->app_local->extcap.private_dos      = !!(*buffer & 0x08);
           app->app_local->extcap.algo_attr_change = !!(*buffer & 0x04);
           app->app_local->extcap.has_decrypt      = !!(*buffer & 0x02);
           app->app_local->extcap.kdf_do           = !!(*buffer & 0x01);
         }
       if (buflen >= 10)
         {
           /* Available with cards of v2 or later.  */
           app->app_local->extcap.sm_algo = buffer[1];
           app->app_local->extcap.max_get_challenge
                                                = (buffer[2] << 8 | buffer[3]);
           app->app_local->extcap.max_certlen_3 = (buffer[4] << 8 | buffer[5]);
 
           /* Interpretation is different between v2 and v3, unfortunately.  */
           if (app->app_local->extcap.extcap_v3)
             {
               app->app_local->extcap.max_special_do
                 = (buffer[6] << 8 | buffer[7]);
               app->app_local->extcap.pin_blk2 = !!(buffer[8] & 0x01);
               app->app_local->extcap.mse= !!(buffer[9] & 0x01);
             }
         }
       xfree (relptr);
 
       /* Some of the first cards accidentally don't set the
          CHANGE_FORCE_CHV bit but allow it anyway. */
       if (app->appversion <= 0x0100 && manufacturer == 1)
         app->app_local->extcap.change_force_chv = 1;
 
       /* Check optional DO of "General Feature Management" for button.  */
       relptr = get_one_do (app, 0x7f74, &buffer, &buflen, NULL);
       if (relptr)
         /* It must be: 03 81 01 20 */
         app->app_local->extcap.has_button = 1;
 
       parse_login_data (app);
 
       if (opt.verbose)
         show_caps (app->app_local);
 
       parse_algorithm_attribute (app, 0);
       parse_algorithm_attribute (app, 1);
       parse_algorithm_attribute (app, 2);
 
       if (opt.verbose > 1)
         dump_all_do (slot);
 
       app->fnc.deinit = do_deinit;
       app->fnc.prep_reselect = do_prep_reselect;
       app->fnc.reselect = do_reselect;
       app->fnc.learn_status = do_learn_status;
       app->fnc.readcert = do_readcert;
       app->fnc.readkey = do_readkey;
       app->fnc.getattr = do_getattr;
       app->fnc.setattr = do_setattr;
       app->fnc.writecert = do_writecert;
       app->fnc.writekey = do_writekey;
       app->fnc.genkey = do_genkey;
       app->fnc.sign = do_sign;
       app->fnc.auth = do_auth;
       app->fnc.decipher = do_decipher;
       app->fnc.change_pin = do_change_pin;
       app->fnc.check_pin = do_check_pin;
       app->fnc.with_keygrip = do_with_keygrip;
    }
 
 leave:
   if (rc)
     do_deinit (app);
   return rc;
 }
diff --git a/scd/app-piv.c b/scd/app-piv.c
index 816c909cf..8ab778532 100644
--- a/scd/app-piv.c
+++ b/scd/app-piv.c
@@ -1,3741 +1,3746 @@
 /* app-piv.c - The OpenPGP card application.
  * Copyright (C) 2019, 2020 g10 Code GmbH
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 /* Some notes:
  * - Specs for PIV are at http://dx.doi.org/10.6028/NIST.SP.800-73-4
  * - https://developers.yubico.com/PIV/Introduction/PIV_attestation.html
  *
  * - Access control matrix:
  *   | Action       | 9B  | PIN | PUK |                              |
  *   |--------------+-----+-----+-----+------------------------------|
  *   | Generate key | yes |     |     |                              |
  *   | Change 9B    | yes |     |     |                              |
  *   | Change retry | yes | yes |     | Yubikey only                 |
  *   | Import key   | yes |     |     |                              |
  *   | Import cert  | yes |     |     |                              |
  *   | Change CHUID | yes |     |     |                              |
  *   | Reset card   |     |     |     | PIN and PUK in blocked state |
  *   | Verify PIN   |     | yes |     |                              |
  *   | Sign data    |     | yes |     |                              |
  *   | Decrypt data |     | yes |     |                              |
  *   | Change PIN   |     | yes |     |                              |
  *   | Change PUK   |     |     | yes |                              |
  *   | Unblock PIN  |     |     | yes | New PIN required             |
  *   |---------------------------------------------------------------|
  *   (9B indicates the 24 byte PIV Card Application Administration Key)
  *
  * - When generating a key we store the created public key in the
  *   corresponding data object, so that gpg and gpgsm are able to get
  *   the public key, create a certificate and store that then in that
  *   data object.  That is not standard compliant but due to the use
  *   of other tags, it should not harm.  See do_genkey for the actual
  *   used tag structure.
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
 #include <string.h>
 #include <time.h>
 
 #include "scdaemon.h"
 
 #include "../common/util.h"
 #include "../common/i18n.h"
 #include "iso7816.h"
 #include "../common/tlv.h"
 #include "../common/host2net.h"
 #include "apdu.h" /* We use apdu_send_direct.  */
 
 #define PIV_ALGORITHM_3DES_ECB_0 0x00
 #define PIV_ALGORITHM_2DES_ECB   0x01
 #define PIV_ALGORITHM_2DES_CBC   0x02
 #define PIV_ALGORITHM_3DES_ECB   0x03
 #define PIV_ALGORITHM_3DES_CBC   0x04
 #define PIV_ALGORITHM_RSA        0x07
 #define PIV_ALGORITHM_AES128_ECB 0x08
 #define PIV_ALGORITHM_AES128_CBC 0x09
 #define PIV_ALGORITHM_AES192_ECB 0x0A
 #define PIV_ALGORITHM_AES192_CBC 0x0B
 #define PIV_ALGORITHM_AES256_ECB 0x0C
 #define PIV_ALGORITHM_AES256_CBC 0x0D
 #define PIV_ALGORITHM_ECC_P256   0x11
 #define PIV_ALGORITHM_ECC_P384   0x14
 
 
 /* The AID for PIV.  */
 static char const piv_aid[] = { 0xA0, 0x00, 0x00, 0x03, 0x08, /* RID=NIST */
                                 0x00, 0x00, 0x10, 0x00        /* PIX=PIV  */ };
 
 
 /* A table describing the DOs of a PIV card.  */
 struct data_object_s
 {
   unsigned int tag;
   unsigned int mandatory:1;
   unsigned int acr_contact:2;     /* 0=always, 1=VCI, 2=PIN, 3=PINorOCC */
   unsigned int acr_contactless:2; /* 0=always, 1=VCI, 2=VCIandPIN,
                                                       3=VCIand(PINorOCC) */
   unsigned int dont_cache:1;      /* Data item will not be cached.  */
   unsigned int flush_on_error:1;  /* Flush cached item on error.  */
   unsigned int keypair:1;         /* Has a public key for a keypair.  */
   const char keyref[3];           /* The key reference.  */
   const char *oidsuffix;          /* Suffix of the OID. */
   const char *usage;              /* Usage string for a keypair or NULL.  */
   const char *desc;               /* Description of the DO.  */
 };
 typedef struct data_object_s *data_object_t;
 static struct data_object_s data_objects[] = {
   { 0x5FC107, 1, 0,1, 0,0, 0, "",   "1.219.0", NULL,
     "Card Capability Container"},
   { 0x5FC102, 1, 0,0, 0,0, 0, "",   "2.48.0",  NULL,
     "Cardholder Unique Id" },
   { 0x5FC105, 1, 0,1, 0,0, 1, "9A", "2.1.1",   "a",
     "Cert PIV Authentication" },
   { 0x5FC103, 1, 2,2, 0,0, 0, "",   "2.96.16", NULL,
     "Cardholder Fingerprints" },
   { 0x5FC106, 1, 0,1, 0,0, 0, "",   "2.144.0", NULL,
     "Security Object" },
   { 0x5FC108, 1, 2,2, 0,0, 0, "",   "2.96.48", NULL,
     "Cardholder Facial Image" },
   { 0x5FC101, 1, 0,0, 0,0, 1, "9E", "2.5.0",   "a",
     "Cert Card Authentication"},
   { 0x5FC10A, 0, 0,1, 0,0, 1, "9C", "2.1.0",   "sc",
     "Cert Digital Signature" },
   { 0x5FC10B, 0, 0,1, 0,0, 1, "9D", "2.1.2",   "e",
     "Cert Key Management" },
   { 0x5FC109, 0, 3,3, 0,0, 0, "",   "2.48.1",  NULL,
     "Printed Information" },
   { 0x7E,     0, 0,0, 0,0, 0, "",   "2.96.80", NULL,
     "Discovery Object" },
   { 0x5FC10C, 0, 0,1, 0,0, 0, "",   "2.96.96", NULL,
     "Key History Object" },
   { 0x5FC10D, 0, 0,1, 0,0, 0, "82", "2.16.1",  "e",
     "Retired Cert Key Mgm 1" },
   { 0x5FC10E, 0, 0,1, 0,0, 0, "83", "2.16.2",  "e",
     "Retired Cert Key Mgm 2" },
   { 0x5FC10F, 0, 0,1, 0,0, 0, "84", "2.16.3",  "e",
     "Retired Cert Key Mgm 3" },
   { 0x5FC110, 0, 0,1, 0,0, 0, "85", "2.16.4",  "e",
     "Retired Cert Key Mgm 4" },
   { 0x5FC111, 0, 0,1, 0,0, 0, "86", "2.16.5",  "e",
     "Retired Cert Key Mgm 5" },
   { 0x5FC112, 0, 0,1, 0,0, 0, "87", "2.16.6",  "e",
     "Retired Cert Key Mgm 6" },
   { 0x5FC113, 0, 0,1, 0,0, 0, "88", "2.16.7",  "e",
     "Retired Cert Key Mgm 7" },
   { 0x5FC114, 0, 0,1, 0,0, 0, "89", "2.16.8",  "e",
     "Retired Cert Key Mgm 8" },
   { 0x5FC115, 0, 0,1, 0,0, 0, "8A", "2.16.9",  "e",
     "Retired Cert Key Mgm 9" },
   { 0x5FC116, 0, 0,1, 0,0, 0, "8B", "2.16.10", "e",
     "Retired Cert Key Mgm 10" },
   { 0x5FC117, 0, 0,1, 0,0, 0, "8C", "2.16.11", "e",
     "Retired Cert Key Mgm 11" },
   { 0x5FC118, 0, 0,1, 0,0, 0, "8D", "2.16.12", "e",
     "Retired Cert Key Mgm 12" },
   { 0x5FC119, 0, 0,1, 0,0, 0, "8E", "2.16.13", "e",
     "Retired Cert Key Mgm 13" },
   { 0x5FC11A, 0, 0,1, 0,0, 0, "8F", "2.16.14", "e",
     "Retired Cert Key Mgm 14" },
   { 0x5FC11B, 0, 0,1, 0,0, 0, "90", "2.16.15", "e",
     "Retired Cert Key Mgm 15" },
   { 0x5FC11C, 0, 0,1, 0,0, 0, "91", "2.16.16", "e",
     "Retired Cert Key Mgm 16" },
   { 0x5FC11D, 0, 0,1, 0,0, 0, "92", "2.16.17", "e",
     "Retired Cert Key Mgm 17" },
   { 0x5FC11E, 0, 0,1, 0,0, 0, "93", "2.16.18", "e",
     "Retired Cert Key Mgm 18" },
   { 0x5FC11F, 0, 0,1, 0,0, 0, "94", "2.16.19", "e",
     "Retired Cert Key Mgm 19" },
   { 0x5FC120, 0, 0,1, 0,0, 0, "95", "2.16.20", "e",
     "Retired Cert Key Mgm 20" },
   { 0x5FC121, 0, 2,2, 0,0, 0, "",   "2.16.21", NULL,
     "Cardholder Iris Images" },
   { 0x7F61,   0, 0,0, 0,0, 0, "",   "2.16.22", NULL,
     "BIT Group Template" },
   { 0x5FC122, 0, 0,0, 0,0, 0, "",   "2.16.23", NULL,
     "SM Cert Signer" },
   { 0x5FC123, 0, 3,3, 0,0, 0, "",   "2.16.24", NULL,
     "Pairing Code Ref Data" },
   { 0 }
   /* Other key reference values without a data object:
    * "00" Global PIN (not cleared by application switching)
    * "04" PIV Secure Messaging Key
    * "80" PIV Application PIN
    * "81" PIN Unblocking Key
    * "96" Primary Finger OCC
    * "97" Secondary Finger OCC
    * "98" Pairing Code
    * "9B" PIV Card Application Administration Key
    *
    * Yubikey specific data objects:
    * "F9" Attestation key (preloaded can be replaced)
    */
 };
 
 
 /* One cache item for DOs.  */
 struct cache_s {
   struct cache_s *next;
   int tag;
   size_t length;
   unsigned char data[1];
 };
 
 
 /* Object with application specific data.  */
 struct app_local_s {
   /* A linked list with cached DOs.  */
   struct cache_s *cache;
 
   /* Various flags.  */
   struct
   {
     unsigned int yubikey:1;  /* This is on a Yubikey.  */
   } flags;
 
   /* Keep track on whether we cache a certain PIN so that we get it
    * from the cache only if we know we cached it.  This inhibits the
    * use of the same cache entry for a card plugged in and out without
    * gpg-agent having noticed that due to a bug.  */
   struct
   {
     unsigned int maybe_00:1;
     unsigned int maybe_80:1;
     unsigned int maybe_81:1;
     unsigned int maybe_96:1;
     unsigned int maybe_97:1;
     unsigned int maybe_98:1;
     unsigned int maybe_9B:1;
   } pincache;
 
 };
 
 
 /***** Local prototypes  *****/
 static gpg_error_t get_keygrip_by_tag (app_t app, unsigned int tag,
                                        char **r_keygripstr, int *got_cert);
 static gpg_error_t genkey_parse_rsa (const unsigned char *data, size_t datalen,
                                      gcry_sexp_t *r_sexp);
 static gpg_error_t genkey_parse_ecc (const unsigned char *data, size_t datalen,
                                      int mechanism, gcry_sexp_t *r_sexp);
 
 
 
 
 
 /* Deconstructor. */
 static void
 do_deinit (app_t app)
 {
   if (app && app->app_local)
     {
       struct cache_s *c, *c2;
 
       for (c = app->app_local->cache; c; c = c2)
         {
           c2 = c->next;
           xfree (c);
         }
 
       xfree (app->app_local);
       app->app_local = NULL;
     }
 }
 
 
 /* Wrapper around iso7816_get_data which first tries to get the data
  * from the cache.  With GET_IMMEDIATE passed as true, the cache is
  * bypassed.  The tag-53 container is also removed.  */
 static gpg_error_t
 get_cached_data (app_t app, int tag,
                  unsigned char **result, size_t *resultlen,
                  int get_immediate)
 {
   gpg_error_t err;
   int i;
   unsigned char *p;
   const unsigned char *s;
   size_t len, n;
   struct cache_s *c;
 
   *result = NULL;
   *resultlen = 0;
 
   if (!get_immediate)
     {
       for (c=app->app_local->cache; c; c = c->next)
         if (c->tag == tag)
           {
             if(c->length)
               {
                 p = xtrymalloc (c->length);
                 if (!p)
                   return gpg_error_from_syserror ();
                 memcpy (p, c->data, c->length);
                 *result = p;
               }
 
             *resultlen = c->length;
 
             return 0;
           }
     }
 
   err = iso7816_get_data_odd (app_get_slot (app), 0, tag, &p, &len);
   if (err)
     return err;
 
   /* Unless the Discovery Object or the BIT Group Template is
    * requested, remove the outer container.
    * (SP800-73.4 Part 2, section 3.1.2)   */
   if (tag == 0x7E || tag == 0x7F61)
     ;
   else if (len && *p == 0x53 && (s = find_tlv (p, len, 0x53, &n)))
     {
       memmove (p, s, n);
       len = n;
     }
 
   if (len)
     *result = p;
   *resultlen = len;
 
   /* Check whether we should cache this object. */
   if (get_immediate)
     return 0;
 
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].tag == tag)
       {
         if (data_objects[i].dont_cache)
           return 0;
         break;
       }
 
   /* Okay, cache it. */
   for (c=app->app_local->cache; c; c = c->next)
     log_assert (c->tag != tag);
 
   c = xtrymalloc (sizeof *c + len);
   if (c)
     {
       if (len)
         memcpy (c->data, p, len);
       else
         xfree (p);
       c->length = len;
       c->tag = tag;
       c->next = app->app_local->cache;
       app->app_local->cache = c;
     }
 
   return 0;
 }
 
 
 /* Remove data object described by TAG from the cache.  If TAG is 0
  * all cache iterms are flushed.  */
 static void
 flush_cached_data (app_t app, int tag)
 {
   struct cache_s *c, *cprev;
 
   for (c=app->app_local->cache, cprev=NULL; c; cprev=c, c = c->next)
     if (c->tag == tag || !tag)
       {
         if (cprev)
           cprev->next = c->next;
         else
           app->app_local->cache = c->next;
         xfree (c);
 
         for (c=app->app_local->cache; c ; c = c->next)
           {
             log_assert (c->tag != tag); /* Oops: duplicated entry. */
           }
         return;
       }
 }
 
 
 /* Get the DO identified by TAG from the card in SLOT and return a
  * buffer with its content in RESULT and NBYTES.  The return value is
  * NULL if not found or a pointer which must be used to release the
  * buffer holding value.  */
 static void *
 get_one_do (app_t app, int tag, unsigned char **result, size_t *nbytes,
             int *r_err)
 {
   gpg_error_t err;
   int i;
   unsigned char *buffer;
   size_t buflen;
   unsigned char *value;
   size_t valuelen;
   gpg_error_t dummyerr;
 
   if (!r_err)
     r_err = &dummyerr;
 
   *result = NULL;
   *nbytes = 0;
   *r_err = 0;
   for (i=0; data_objects[i].tag && data_objects[i].tag != tag; i++)
     ;
 
   value = NULL;
   err = gpg_error (GPG_ERR_ENOENT);
 
   if (!value) /* Not in a constructed DO, try simple. */
     {
       err = get_cached_data (app, tag, &buffer, &buflen,
                              data_objects[i].dont_cache);
       if (!err)
         {
           value = buffer;
           valuelen = buflen;
         }
     }
 
   if (!err)
     {
       *nbytes = valuelen;
       *result = value;
       return buffer;
     }
 
   *r_err = err;
   return NULL;
 }
 
 
 static void
 dump_all_do (int slot)
 {
   gpg_error_t err;
   int i;
   unsigned char *buffer;
   size_t buflen;
 
   for (i=0; data_objects[i].tag; i++)
     {
       /* We don't try extended length APDU because such large DO would
          be pretty useless in a log file.  */
       err = iso7816_get_data_odd (slot, 0, data_objects[i].tag,
                                  &buffer, &buflen);
       if (err)
         {
           if (gpg_err_code (err) == GPG_ERR_ENOENT
               && !data_objects[i].mandatory)
             ;
           else
             log_info ("DO '%s' not available: %s\n",
                       data_objects[i].desc, gpg_strerror (err));
         }
       else
         {
           if (data_objects[i].tag == 0x5FC109)
             log_info ("DO '%s': '%.*s'\n", data_objects[i].desc,
                       (int)buflen, buffer);
           else
             {
               log_info ("DO '%s': ", data_objects[i].desc);
               if (buflen > 16 && opt.verbose < 2)
                 {
                   log_printhex (buffer, 16, NULL);
                   log_printf ("[...]\n");
                 }
               else
                 log_printhex (buffer, buflen, "");
             }
 
         }
       xfree (buffer); buffer = NULL;
     }
 }
 
 
 /* Create a TLV tag and value and store it at BUFFER.  Return the
  * length of tag and length.  A LENGTH greater than 65535 is
  * truncated.  TAG must be less or equal to 2^16.  If BUFFER is NULL,
  * only the required length is computed.  */
 static size_t
 add_tlv (unsigned char *buffer, unsigned int tag, size_t length)
 {
   if (length > 0xffff)
     length = 0xffff;
 
   if (buffer)
     {
       unsigned char *p = buffer;
 
       if (tag > 0xff)
         *p++ = tag >> 8;
       *p++ = tag;
       if (length < 128)
         *p++ = length;
       else if (length < 256)
         {
           *p++ = 0x81;
           *p++ = length;
         }
       else
         {
           *p++ = 0x82;
           *p++ = length >> 8;
           *p++ = length;
         }
 
       return p - buffer;
     }
   else
     {
       size_t n = 0;
 
       if (tag > 0xff)
         n++;
       n++;
       if (length < 128)
         n++;
       else if (length < 256)
         n += 2;
       else
         n += 3;
       return n;
     }
 }
 
 
 /* Function to build a list of TLV and return the result in a malloced
  * buffer.  The varargs are tuples of (int,size_t,void) each with the
  * tag, the length and the actual data.  A (0,0,NULL) tuple terminates
  * the list.  Up to 10 tuples are supported.  If SECMEM is true the
  * returned buffer is allocated in secure memory.  */
 static gpg_error_t
 concat_tlv_list (int secure, unsigned char **r_result, size_t *r_resultlen, ...)
 {
   gpg_error_t err;
   va_list arg_ptr;
   struct {
     int tag;
     unsigned int len;
     unsigned int contlen;
     const void *data;
   } argv[10];
   int i, j, argc;
   unsigned char *data = NULL;
   size_t datalen;
   unsigned char *p;
   size_t n;
 
   *r_result = NULL;
   *r_resultlen = 0;
 
   /* Collect all args.  Check that length is <= 2^16 to match the
    * behaviour of add_tlv.  */
   va_start (arg_ptr, r_resultlen);
   argc = 0;
   while (((argv[argc].tag = va_arg (arg_ptr, int))))
     {
       argv[argc].len = va_arg (arg_ptr, size_t);
       argv[argc].contlen = 0;
       argv[argc].data = va_arg (arg_ptr, const void *);
       if (argc >= DIM (argv)-1 || argv[argc].len > 0xffff)
         {
           va_end (arg_ptr);
           err = gpg_error (GPG_ERR_EINVAL);
           goto leave;
         }
       argc++;
     }
   va_end (arg_ptr);
 
   /* Compute the required buffer length and allocate the buffer.  */
   datalen = 0;
   for (i=0; i < argc; i++)
     {
       if (!argv[i].len && !argv[i].data)
         {
           /* Constructed tag.  Compute its length.  Note that we
            * currently allow only one constructed tag in the list.  */
           for (n=0, j = i + 1; j < argc; j++)
             {
               log_assert (!(!argv[j].len && !argv[j].data));
               n += add_tlv (NULL, argv[j].tag, argv[j].len);
               n += argv[j].len;
             }
           argv[i].contlen = n;
           datalen += add_tlv (NULL, argv[i].tag, n);
         }
       else
         {
           datalen += add_tlv (NULL, argv[i].tag, argv[i].len);
           datalen += argv[i].len;
         }
     }
   data = secure? xtrymalloc_secure (datalen) : xtrymalloc (datalen);
   if (!data)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Copy that data to the buffer.  */
   p = data;
   for (i=0; i < argc; i++)
     {
       if (!argv[i].len && !argv[i].data)
         {
           /* Constructed tag.  */
           p += add_tlv (p, argv[i].tag, argv[i].contlen);
         }
       else
         {
           p += add_tlv (p, argv[i].tag, argv[i].len);
           memcpy (p, argv[i].data, argv[i].len);
           p += argv[i].len;
         }
     }
   log_assert ( data + datalen == p );
   *r_result = data;
   data = NULL;
   *r_resultlen = datalen;
   err = 0;
 
  leave:
   xfree (data);
   return err;
 }
 
 
 /* Wrapper around iso7816_put_data_odd which also sets the tag into
  * the '5C' data object.  The varargs are tuples of (int,size_t,void)
  * with the tag, the length and the actual data.  A (0,0,NULL) tuple
  * terminates the list.  Up to 10 tuples are supported.  */
 static gpg_error_t
 put_data (int slot, unsigned int tag, ...)
 {
   gpg_error_t err;
   va_list arg_ptr;
   struct {
     int tag;
     size_t len;
     const void *data;
   } argv[10];
   int i, argc;
   unsigned char data5c[5];
   size_t data5clen;
   unsigned char *data = NULL;
   size_t datalen;
   unsigned char *p;
   size_t n;
 
   /* Collect all args.  Check that length is <= 2^16 to match the
    * behaviour of add_tlv.  */
   va_start (arg_ptr, tag);
   argc = 0;
   while (((argv[argc].tag = va_arg (arg_ptr, int))))
     {
       argv[argc].len = va_arg (arg_ptr, size_t);
       argv[argc].data = va_arg (arg_ptr, const void *);
       if (argc >= DIM (argv)-1 || argv[argc].len > 0xffff)
         {
           va_end (arg_ptr);
           return GPG_ERR_EINVAL;
         }
       argc++;
     }
   va_end (arg_ptr);
 
   /* Build the TLV with the tag to be updated.  */
   data5c[0] = 0x5c; /* Tag list */
   if (tag <= 0xff)
     {
       data5c[1] = 1;
       data5c[2] = tag;
       data5clen = 3;
     }
   else if (tag <= 0xffff)
     {
       data5c[1] = 2;
       data5c[2] = (tag >> 8);
       data5c[3] = tag;
       data5clen = 4;
     }
   else
     {
       data5c[1] = 3;
       data5c[2] = (tag >> 16);
       data5c[3] = (tag >> 8);
       data5c[4] = tag;
       data5clen = 5;
     }
 
   /* Compute the required buffer length and allocate the buffer.  */
   n = 0;
   for (i=0; i < argc; i++)
     {
       n += add_tlv (NULL, argv[i].tag, argv[i].len);
       n += argv[i].len;
     }
   datalen = data5clen + add_tlv (NULL, 0x53, n) + n;
   data = xtrymalloc (datalen);
   if (!data)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Copy that data to the buffer.  */
   p = data;
   memcpy (p, data5c, data5clen);
   p += data5clen;
   p += add_tlv (p, 0x53, n);
   for (i=0; i < argc; i++)
     {
       p += add_tlv (p, argv[i].tag, argv[i].len);
       memcpy (p, argv[i].data, argv[i].len);
       p += argv[i].len;
     }
   log_assert ( data + datalen == p );
   err = iso7816_put_data_odd (slot, -1 /* use command chaining */,
                               0x3fff, data, datalen);
 
  leave:
   xfree (data);
   return err;
 }
 
 
 /* Parse the key reference KEYREFSTR which is expected to hold a key
  * reference for a CHV object.  Return the one octet keyref or -1 for
  * an invalid reference.  */
 static int
 parse_chv_keyref (const char *keyrefstr)
 {
   if (!keyrefstr)
     return -1;
   else if (!ascii_strcasecmp (keyrefstr, "PIV.00"))
     return 0x00;
   else if (!ascii_strcasecmp (keyrefstr, "PIV.80"))
     return 0x80;
   else if (!ascii_strcasecmp (keyrefstr, "PIV.81"))
     return 0x81;
   else
     return -1;
 }
 
 
 /* Return an allocated string with the serial number in a format to be
  * show to the user.  With FAILMODE is true return NULL if such an
  * abbreviated S/N is not available, else return the full serial
  * number as a hex string.  May return NULL on malloc problem.  */
 static char *
 get_dispserialno (app_t app, int failmode)
 {
   char *result;
 
   if (app->card && app->card->serialno && app->card->serialnolen == 3+1+4
       && !memcmp (app->card->serialno, "\xff\x02\x00", 3))
     {
       /* This is a 4 byte S/N of a Yubikey which seems to be printed
        * on the token in decimal.  Maybe they will print larger S/N
        * also in decimal but we can't be sure, thus do it only for
        * these 32 bit numbers.  */
       unsigned long sn;
       sn  = app->card->serialno[4] * 16777216;
       sn += app->card->serialno[5] * 65536;
       sn += app->card->serialno[6] * 256;
       sn += app->card->serialno[7];
       result = xtryasprintf ("yk-%lu", sn);
     }
   else if (failmode)
     result = NULL;  /* No Abbreviated S/N.  */
   else
     result = app_get_serialno (app);
 
   return result;
 }
 
 
 /* The verify command can be used to retrieve the security status of
  * the card.  Given the PIN name (e.g. "PIV.80" for the application
  * pin, a ISO7817_VERIFY_* code is returned or a non-negative number
  * of verification attempts left.  */
 static int
 get_chv_status (app_t app, const char *keyrefstr)
 {
   int keyref;
 
   keyref = parse_chv_keyref (keyrefstr);
   if (!keyrefstr)
     return ISO7816_VERIFY_ERROR;
   return iso7816_verify_status (app_get_slot (app), keyref);
 }
 
 
 /* Implementation of the GETATTR command.  This is similar to the
  * LEARN command but returns only one value via status lines.  */
 static gpg_error_t
 do_getattr (app_t app, ctrl_t ctrl, const char *name)
 {
   static struct {
     const char *name;
     int tag;
     int special;
   } table[] = {
     { "SERIALNO",     0x0000, -1 },
     { "$AUTHKEYID",   0x0000, -2 }, /* Default ssh key.  */
     { "$ENCRKEYID",   0x0000, -6 }, /* Default encryption key.  */
     { "$SIGNKEYID",   0x0000, -7 }, /* Default signing key.  */
     { "$DISPSERIALNO",0x0000, -3 },
     { "CHV-STATUS",   0x0000, -4 },
     { "CHV-USAGE",    0x007E, -5 }
   };
   gpg_error_t err = 0;
   int idx;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
   const unsigned char *s;
   size_t n;
 
   for (idx=0; (idx < DIM (table)
                && ascii_strcasecmp (table[idx].name, name)); idx++)
     ;
   if (!(idx < DIM (table)))
     err = gpg_error (GPG_ERR_INV_NAME);
   else if (table[idx].special == -1)
     {
       char *serial = app_get_serialno (app);
 
       if (serial)
         {
           send_status_direct (ctrl, "SERIALNO", serial);
           xfree (serial);
         }
     }
   else if (table[idx].special == -2)
     {
       char const tmp[] = "PIV.9A"; /* Cert PIV Authenticate.  */
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
     }
   else if (table[idx].special == -3)
     {
       char *tmp = get_dispserialno (app, 1);
 
       if (tmp)
         {
           send_status_info (ctrl, table[idx].name,
                             tmp, strlen (tmp),
                             NULL, (size_t)0);
           xfree (tmp);
         }
       else
         err = gpg_error (GPG_ERR_INV_NAME);  /* No Abbreviated S/N.  */
     }
   else if (table[idx].special == -4) /* CHV-STATUS */
     {
       int tmp[4];
 
       tmp[0] = get_chv_status (app, "PIV.00");
       tmp[1] = get_chv_status (app, "PIV.80");
       tmp[2] = get_chv_status (app, "PIV.81");
       err = send_status_printf (ctrl, table[idx].name, "%d %d %d",
                                 tmp[0], tmp[1], tmp[2]);
     }
   else if (table[idx].special == -5) /* CHV-USAGE (aka PIN Usage Policy) */
     {
       /* We return 2 hex bytes or nothing in case the discovery object
        * is not supported.  */
       relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
       if (relptr)
         {
           s = find_tlv (value, valuelen, 0x7E, &n);
           if (s && n && (s = find_tlv (s, n, 0x5F2F, &n)) && n >=2 )
             err = send_status_printf (ctrl, table[idx].name, "%02X %02X",
                                       s[0], s[1]);
           xfree (relptr);
         }
     }
   else if (table[idx].special == -6)
     {
       char const tmp[] = "PIV.9D"; /* Key Management.  */
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
     }
   else if (table[idx].special == -7)
     {
       char const tmp[] = "PIV.9C"; /* Digital Signature.  */
       send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
     }
   else
     {
       relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
       if (relptr)
         {
           send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);
           xfree (relptr);
         }
     }
 
   return err;
 }
 
 
 /* Authenticate the card using the Card Application Administration
  * Key.  (VALUE,VALUELEN) has that 24 byte key.  */
 static gpg_error_t
 auth_adm_key (app_t app, const unsigned char *value, size_t valuelen)
 {
   gpg_error_t err;
   unsigned char tmpl[4+24];
   size_t tmpllen;
   unsigned char *outdata = NULL;
   size_t outdatalen;
   const unsigned char *s;
   char witness[8];
   size_t n;
   gcry_cipher_hd_t cipher = NULL;
 
   /* Prepare decryption.  */
   err = gcry_cipher_open (&cipher, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_ECB, 0);
   if (err)
     goto leave;
   err = gcry_cipher_setkey (cipher, value, valuelen);
   if (err)
     goto leave;
 
   /* Request a witness.  */
   tmpl[0] = 0x7c;
   tmpl[1] = 0x02;
   tmpl[2] = 0x80;
   tmpl[3] = 0;    /* (Empty witness requests a witness.)  */
   tmpllen = 4;
   err = iso7816_general_authenticate (app_get_slot (app), 0,
                                       PIV_ALGORITHM_3DES_ECB_0, 0x9B,
                                       tmpl, tmpllen, 0,
                                       &outdata, &outdatalen);
   if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
     err = gpg_error (GPG_ERR_BAD_AUTH);
   if (err)
     goto leave;
   if (!(outdatalen && *outdata == 0x7c
         && (s = find_tlv (outdata, outdatalen, 0x80, &n))
         && n == 8))
     {
       err = gpg_error (GPG_ERR_CARD);
       log_error ("piv: improper witness received\n");
       goto leave;
     }
   err = gcry_cipher_decrypt (cipher, witness, 8, s, 8);
   if (err)
     goto leave;
 
   /* Return decrypted witness and send our challenge.  */
   tmpl[0] = 0x7c;
   tmpl[1] = 22;
   tmpl[2] = 0x80;
   tmpl[3] = 8;
   memcpy (tmpl+4, witness, 8);
   tmpl[12] = 0x81;
   tmpl[13] = 8;
   gcry_create_nonce (tmpl+14, 8);
   tmpl[22] = 0x80;
   tmpl[23] = 0;
   tmpllen = 24;
   xfree (outdata);
   err = iso7816_general_authenticate (app_get_slot (app), 0,
                                       PIV_ALGORITHM_3DES_ECB_0, 0x9B,
                                       tmpl, tmpllen, 0,
                                       &outdata, &outdatalen);
   if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
     err = gpg_error (GPG_ERR_BAD_AUTH);
   if (err)
     goto leave;
   if (!(outdatalen && *outdata == 0x7c
         && (s = find_tlv (outdata, outdatalen, 0x82, &n))
         && n == 8))
     {
       err = gpg_error (GPG_ERR_CARD);
       log_error ("piv: improper challenge received\n");
       goto leave;
     }
   /* (We reuse the witness buffer.) */
   err = gcry_cipher_decrypt (cipher, witness, 8, s, 8);
   if (err)
     goto leave;
   if (memcmp (witness, tmpl+14, 8))
     {
       err = gpg_error (GPG_ERR_BAD_AUTH);
       goto leave;
     }
 
  leave:
    xfree (outdata);
    gcry_cipher_close (cipher);
    return err;
 }
 
 
 /* Set a new admin key.  */
 static gpg_error_t
 set_adm_key (app_t app, const unsigned char *value, size_t valuelen)
 {
   gpg_error_t err;
   unsigned char apdu[8+24];
   unsigned int sw;
 
   /* Check whether it is a weak key and that it is of proper length.  */
   {
     gcry_cipher_hd_t cipher;
 
     err = gcry_cipher_open (&cipher, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_ECB, 0);
     if (!err)
       {
         err = gcry_cipher_setkey (cipher, value, valuelen);
         gcry_cipher_close (cipher);
       }
     if (err)
       goto leave;
   }
 
   if (app->app_local->flags.yubikey)
     {
       /* This is a Yubikey.  */
       if (valuelen != 24)
         {
           err = gpg_error (GPG_ERR_INV_LENGTH);
           goto leave;
         }
 
       /* We use a proprietary Yubikey command.  */
       apdu[0] = 0;
       apdu[1] = 0xff;
       apdu[2] = 0xff;
       apdu[3] = 0xff;  /* touch policy: 0xff=never, 0xfe = always.  */
       apdu[4] = 3 + 24;
       apdu[5] = PIV_ALGORITHM_3DES_ECB;
       apdu[6] = 0x9b;
       apdu[7] = 24;
       memcpy (apdu+8, value, 24);
       err = iso7816_apdu_direct (app_get_slot (app), apdu, 8+24, 0,
                                  &sw, NULL, NULL);
       wipememory (apdu+8, 24);
       if (err)
         log_error ("piv: setting admin key failed; sw=%04x\n", sw);
       /* A PIN is not required, thus use a better error code.  */
       if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
         err = gpg_error (GPG_ERR_NO_AUTH);
     }
   else
     err = gpg_error (GPG_ERR_NOT_SUPPORTED);
 
 
  leave:
    return err;
 }
 
 /* Handle the SETATTR operation. All arguments are already basically
  * checked. */
 static gpg_error_t
 do_setattr (app_t app, ctrl_t ctrl, const char *name,
             gpg_error_t (*pincb)(void*, const char *, char **),
             void *pincb_arg,
             const unsigned char *value, size_t valuelen)
 {
   gpg_error_t err;
   static struct {
     const char *name;
     unsigned short tag;
     unsigned short flush_tag;  /* The tag which needs to be flushed or 0. */
     int special;               /* Special mode to use for thus NAME.  */
   } table[] = {
     /* Authenticate using the PIV Card Application Administration Key
      * (0x0B).  Note that Yubico calls this key the "management key"
      * which we don't do because that term is too similar to "Cert
      * Management Key" (0x9D).  */
     { "AUTH-ADM-KEY", 0x0000, 0x0000, 1 },
     { "SET-ADM-KEY",  0x0000, 0x0000, 2 }
   };
   int idx;
 
   (void)ctrl;
   (void)pincb;
   (void)pincb_arg;
 
   for (idx=0; (idx < DIM (table)
                && ascii_strcasecmp (table[idx].name, name)); idx++)
     ;
   if (!(idx < DIM (table)))
     return gpg_error (GPG_ERR_INV_NAME);
 
   /* Flush the cache before writing it, so that the next get operation
    * will reread the data from the card and thus get synced in case of
    * errors (e.g. data truncated by the card). */
   if (table[idx].tag)
     flush_cached_data (app, table[idx].flush_tag? table[idx].flush_tag
                        /* */                    : table[idx].tag);
 
   switch (table[idx].special)
     {
     case 1:
       err = auth_adm_key (app, value, valuelen);
       break;
 
     case 2:
       err = set_adm_key (app, value, valuelen);
       break;
 
     default:
       err = gpg_error (GPG_ERR_BUG);
       break;
     }
 
   return err;
 }
 
 
 /* Send the KEYPAIRINFO back.  DOBJ describes the data object carrying
  * the key.  This is used by the LEARN command. */
 static gpg_error_t
 send_keypair_and_cert_info (app_t app, ctrl_t ctrl, data_object_t dobj,
                             int only_keypair)
 {
   gpg_error_t err = 0;
   char *keygripstr = NULL;
   int got_cert;
   char idbuf[50];
   const char *usage;
 
   err = get_keygrip_by_tag (app, dobj->tag, &keygripstr, &got_cert);
   if (err)
     goto leave;
 
   usage = dobj->usage? dobj->usage : "";
 
   snprintf (idbuf, sizeof idbuf, "PIV.%s", dobj->keyref);
   send_status_info (ctrl, "KEYPAIRINFO",
                     keygripstr, strlen (keygripstr),
                     idbuf, strlen (idbuf),
                     usage, strlen (usage),
                     NULL, (size_t)0);
   if (!only_keypair && got_cert)
     {
       /* All certificates are of type 100 (Regular X.509 Cert).  */
       send_status_info (ctrl, "CERTINFO",
                         "100", 3,
                         idbuf, strlen (idbuf),
                         NULL, (size_t)0);
     }
 
  leave:
   xfree (keygripstr);
   return err;
 }
 
 
 /* Handle the LEARN command.  */
 static gpg_error_t
 do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 {
   int i;
 
   (void)flags;
 
   do_getattr (app, ctrl, "CHV-USAGE");
   do_getattr (app, ctrl, "CHV-STATUS");
 
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].keypair)
       send_keypair_and_cert_info (app, ctrl, data_objects + i,
                                   !!(flags & APP_LEARN_FLAG_KEYPAIRINFO));
 
 
   return 0;
 }
 
 
 /* Core of do_readcert which fetches the certificate based on the
  * given tag and returns it in a freshly allocated buffer stored at
  * R_CERT and the length of the certificate stored at R_CERTLEN.  If
  * on success a non-zero value is stored at R_MECHANISM, the returned
  * data is not a certificate but a public key (in the format used by the
  * container '7f49').  */
 static gpg_error_t
 readcert_by_tag (app_t app, unsigned int tag,
                  unsigned char **r_cert, size_t *r_certlen, int *r_mechanism)
 {
   gpg_error_t err;
   unsigned char *buffer;
   size_t buflen;
   void *relptr;
   const unsigned char *s, *s2;
   size_t n, n2;
 
   *r_cert = NULL;
   *r_certlen = 0;
   *r_mechanism = 0;
 
   relptr = get_one_do (app, tag, &buffer, &buflen, NULL);
   if (!relptr || !buflen)
    {
       err = gpg_error (GPG_ERR_NOT_FOUND);
       goto leave;
     }
 
   s = find_tlv (buffer, buflen, 0x71, &n);
   if (!s)
     {
       /* No certificate; check whether a public key has been stored
        * using our own scheme.  */
       s = find_tlv (buffer, buflen, 0x7f49, &n);
       if (!s || !n)
         {
           log_error ("piv: No public key in 0x%X\n", tag);
           err = gpg_error (GPG_ERR_NO_PUBKEY);
           goto leave;
         }
       s2 = find_tlv (buffer, buflen, 0x80, &n2);
       if (!s2 || n2 != 1 || !*s2)
         {
           log_error ("piv: No mechanism for public key in 0x%X\n", tag);
           err = gpg_error (GPG_ERR_NO_PUBKEY);
           goto leave;
         }
       *r_mechanism = *s2;
     }
   else
     {
       if (n != 1)
         {
           log_error ("piv: invalid CertInfo in 0x%X\n", tag);
           err = gpg_error (GPG_ERR_INV_CERT_OBJ);
           goto leave;
         }
       if (*s == 0x01)
         {
           log_error ("piv: gzip compression not yet supported (tag 0x%X)\n",
                      tag);
           err = gpg_error (GPG_ERR_UNSUPPORTED_ENCODING);
           goto leave;
         }
       if (*s)
         {
           log_error ("piv: invalid CertInfo 0x%02x in 0x%X\n", *s, tag);
           err = gpg_error (GPG_ERR_INV_CERT_OBJ);
           goto leave;
         }
 
       /* Note: We don't check that the LRC octet has a length of zero
        * as required by the specs.  */
 
       /* Get the cert from the container.  */
       s = find_tlv (buffer, buflen, 0x70, &n);
       if (!s || !n)
         {
           err = gpg_error (GPG_ERR_NOT_FOUND);
           goto leave;
         }
     }
 
   /* The next is common for certificate and public key.  */
   if (!(*r_cert = xtrymalloc (n)))
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   memcpy (*r_cert, s, n);
   *r_certlen = n;
   err = 0;
 
  leave:
   xfree (relptr);
   return err;
 }
 
 
 /* Get the keygrip in hex format of a key from the certificate stored
  * at TAG.  Caller must free the string at R_KEYGRIPSTR. */
 static gpg_error_t
 get_keygrip_by_tag (app_t app, unsigned int tag,
                     char **r_keygripstr, int *r_got_cert)
 {
   gpg_error_t err;
   unsigned char *certbuf = NULL;
   size_t certbuflen;
   int mechanism;
   gcry_sexp_t s_pkey = NULL;
   ksba_cert_t cert = NULL;
   unsigned char grip[KEYGRIP_LEN];
 
   *r_got_cert = 0;
   *r_keygripstr = xtrymalloc (2*KEYGRIP_LEN+1);
   if (!r_keygripstr)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* We need to get the public key from the certificate.  */
   err = readcert_by_tag (app, tag, &certbuf, &certbuflen, &mechanism);
   if (err)
     goto leave;
   if (mechanism) /* Compute keygrip from public key.  */
     {
       if (mechanism == PIV_ALGORITHM_RSA)
         err = genkey_parse_rsa (certbuf, certbuflen, &s_pkey);
       else if (mechanism == PIV_ALGORITHM_ECC_P256
                || mechanism == PIV_ALGORITHM_ECC_P384)
         err = genkey_parse_ecc (certbuf, certbuflen, mechanism, &s_pkey);
       else
         err = gpg_error (GPG_ERR_PUBKEY_ALGO);
       if (err)
         goto leave;
 
       if (!gcry_pk_get_keygrip (s_pkey, grip))
         {
           log_error ("piv: error computing keygrip\n");
           err = gpg_error (GPG_ERR_GENERAL);
           goto leave;
         }
 
       bin2hex (grip, sizeof grip, *r_keygripstr);
     }
   else /* Compute keygrip from certificate.  */
     {
       *r_got_cert = 0;
       err = ksba_cert_new (&cert);
       if (err)
         goto leave;
       err = ksba_cert_init_from_mem (cert, certbuf, certbuflen);
       if (err)
         goto leave;
       err = app_help_get_keygrip_string (cert, *r_keygripstr, NULL, NULL);
     }
 
  leave:
   gcry_sexp_release (s_pkey);
   ksba_cert_release (cert);
   xfree (certbuf);
   if (err)
     {
       xfree (*r_keygripstr);
       *r_keygripstr = NULL;
     }
   return err;
 }
 
 
 /* Locate the data object from the given KEYREF.  The KEYREF may also
  * be the corresponding OID of the key object.  Returns the data
  * object or NULL if not found.  */
 static data_object_t
 find_dobj_by_keyref (app_t app, const char *keyref)
 {
   int i;
 
   (void)app;
 
   if (!ascii_strncasecmp (keyref, "PIV.", 4))  /* Standard keyref */
     {
       keyref += 4;
       for (i=0; data_objects[i].tag; i++)
         if (*data_objects[i].keyref
             && !ascii_strcasecmp (keyref, data_objects[i].keyref))
           {
             return data_objects + i;
           }
     }
   else if (!strncmp (keyref, "2.16.840.1.101.3.7.", 19))  /* OID */
     {
       keyref += 19;
       for (i=0; data_objects[i].tag; i++)
         if (*data_objects[i].keyref
             && !strcmp (keyref, data_objects[i].oidsuffix))
           {
             return data_objects + i;
           }
     }
   else if (strlen (keyref) == 40)  /* A keygrip */
     {
       char *keygripstr = NULL;
       int tag, dummy_got_cert;
 
       for (i=0; (tag=data_objects[i].tag); i++)
         {
           if (!data_objects[i].keypair)
             continue;
           xfree (keygripstr);
           if (get_keygrip_by_tag (app, tag, &keygripstr, &dummy_got_cert))
             continue;
           if (!strcmp (keygripstr, keyref))
             {
               xfree (keygripstr);
               return data_objects + i;
             }
         }
       xfree (keygripstr);
     }
 
   return NULL;
 }
 
 
 /* Return the keyref from DOBJ as an integer.  If it does not exist,
  * return -1.  */
 static int
 keyref_from_dobj (data_object_t dobj)
 {
   if (!dobj || !hexdigitp (dobj->keyref) || !hexdigitp (dobj->keyref+1))
     return -1;
   return xtoi_2 (dobj->keyref);
 }
 
 
 /* Read a certificate from the card and returned in a freshly
  * allocated buffer stored at R_CERT and the length of the certificate
  * stored at R_CERTLEN.  CERTID is either the OID of the cert's
  * container or of the form "PIV.<two_hexdigit_keyref>"  */
 static gpg_error_t
 do_readcert (app_t app, const char *certid,
              unsigned char **r_cert, size_t *r_certlen)
 {
   gpg_error_t err;
   data_object_t dobj;
   int mechanism;
 
   *r_cert = NULL;
   *r_certlen = 0;
 
   /* Hack to read a Yubikey attestation certificate.  */
   if (app->app_local->flags.yubikey
       && strlen (certid) == 11
       && !ascii_strncasecmp (certid, "PIV.ATST.", 9)
       && hexdigitp (certid+9) && hexdigitp (certid+10))
     {
       unsigned char apdu[4];
       unsigned char *result;
       size_t resultlen;
 
       apdu[0] = 0;
       apdu[1] = 0xf9;  /* Yubikey: Get attestation cert.  */
       apdu[2] = xtoi_2 (certid+9);
       apdu[3] = 0;
       err = iso7816_apdu_direct (app_get_slot (app), apdu, 4, 1,
                                  NULL, &result, &resultlen);
       if (!err)
         {
           *r_cert = result;
           *r_certlen = resultlen;
         }
       return err;
     }
 
   dobj = find_dobj_by_keyref (app, certid);
   if (!dobj)
     return gpg_error (GPG_ERR_INV_ID);
 
   err = readcert_by_tag (app, dobj->tag, r_cert, r_certlen, &mechanism);
   if (!err && mechanism)
     {
       /* Well, no certificate but a public key - we don't want it.  */
       xfree (*r_cert);
       *r_cert = NULL;
       *r_certlen = 0;
       err = gpg_error (GPG_ERR_NOT_FOUND);
     }
   return err;
 }
 
 
 /* Return a public key in a freshly allocated buffer.  This will only
  * work for a freshly generated key as long as no reset of the
  * application has been performed.  This is because we return a cached
  * result from key generation.  If no cached result is available, the
  * error GPG_ERR_UNSUPPORTED_OPERATION is returned so that the higher
  * layer can then get the key by reading the matching certificate.
  * On success a canonical encoded s-expression with the public key is
  * stored at (R_PK,R_PKLEN); the caller must release that buffer.  On
  * error R_PK and R_PKLEN are not changed and an error code is
  * returned.
  */
 static gpg_error_t
 do_readkey (app_t app, ctrl_t ctrl, const char *keyrefstr, unsigned int flags,
             unsigned char **r_pk, size_t *r_pklen)
 {
   gpg_error_t err;
   data_object_t dobj;
   int keyref;
   unsigned char *cert = NULL;
   size_t certlen;
   int mechanism;
   gcry_sexp_t s_pkey = NULL;
   unsigned char *pk = NULL;
   size_t pklen;
 
   dobj = find_dobj_by_keyref (app, keyrefstr);
   if ((keyref = keyref_from_dobj (dobj)) == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
 
   err = readcert_by_tag (app, dobj->tag, &cert, &certlen, &mechanism);
   if (err)
     goto leave;
   if (!mechanism)
     {
       /* We got a certificate.  Extract the pubkey from it.  */
       err = app_help_pubkey_from_cert (cert, certlen, &pk, &pklen);
       if (err)
         {
           log_error ("failed to parse the certificate: %s\n",
                      gpg_strerror (err));
           goto leave;
         }
     }
   else
     {
       /* Convert the public key into the expected s-expression.  */
       if (mechanism == PIV_ALGORITHM_RSA)
         err = genkey_parse_rsa (cert, certlen, &s_pkey);
       else if (mechanism == PIV_ALGORITHM_ECC_P256
                || mechanism == PIV_ALGORITHM_ECC_P384)
         err = genkey_parse_ecc (cert, certlen, mechanism, &s_pkey);
       else
         err = gpg_error (GPG_ERR_PUBKEY_ALGO);
       if (err)
         goto leave;
 
       err = make_canon_sexp (s_pkey, &pk, &pklen);
       if (err)
         goto leave;
     }
 
   if ((flags & APP_READKEY_FLAG_INFO))
     {
       char keygripstr[KEYGRIP_LEN*2+1];
       char idbuf[50];
       const char *usage;
+      char *algostr;
 
-      err = app_help_get_keygrip_string_pk (pk, pklen, keygripstr, NULL, NULL);
+      err = app_help_get_keygrip_string_pk (pk, pklen, keygripstr,
+                                            NULL, NULL, &algostr);
       if (err)
         {
           log_error ("app_help_get_keygrip_string_pk failed: %s\n",
                      gpg_strerror (err));
           goto leave;
         }
       usage = dobj->usage? dobj->usage : "";
 
       snprintf (idbuf, sizeof idbuf, "PIV.%s", dobj->keyref);
       send_status_info (ctrl, "KEYPAIRINFO",
                         keygripstr, strlen (keygripstr),
                         idbuf, strlen (idbuf),
                         usage, strlen (usage),
+                        "-", (size_t)1,
+                        algostr, strlen (algostr),
                         NULL, (size_t)0);
+      xfree (algostr);
     }
 
   if (r_pk && r_pklen)
     {
       *r_pk = pk;
       pk = NULL;
       *r_pklen = pklen;
     }
 
  leave:
   gcry_sexp_release (s_pkey);
   xfree (pk);
   xfree (cert);
   return err;
 }
 
 
 /* Given a data object DOBJ return the corresponding PIV algorithm and
  * store it at R_ALGO.  The algorithm is taken from the corresponding
  * certificate or from a cache.  */
 static gpg_error_t
 get_key_algorithm_by_dobj (app_t app, data_object_t dobj, int *r_mechanism)
 {
   gpg_error_t err;
   unsigned char *certbuf = NULL;
   size_t certbuflen;
   int mechanism;
   ksba_cert_t cert = NULL;
   ksba_sexp_t k_pkey = NULL;
   gcry_sexp_t s_pkey = NULL;
   gcry_sexp_t l1 = NULL;
   char *algoname = NULL;
   int algo;
   size_t n;
   const char *curve_name;
 
   *r_mechanism = 0;
 
   err = readcert_by_tag (app, dobj->tag, &certbuf, &certbuflen, &mechanism);
   if (err)
     goto leave;
   if (mechanism)
     {
       /* A public key was found.  That makes it easy.  */
       switch (mechanism)
         {
         case PIV_ALGORITHM_RSA:
         case PIV_ALGORITHM_ECC_P256:
         case PIV_ALGORITHM_ECC_P384:
           *r_mechanism = mechanism;
           break;
 
         default:
           err = gpg_error (GPG_ERR_PUBKEY_ALGO);
           log_error ("piv: unknown mechanism %d in public key at %s\n",
                      mechanism, dobj->keyref);
           break;
         }
       goto leave;
     }
 
   err = ksba_cert_new (&cert);
   if (err)
     goto leave;
 
   err = ksba_cert_init_from_mem (cert, certbuf, certbuflen);
   if (err)
     {
       log_error ("piv: failed to parse the certificate %s: %s\n",
                  dobj->keyref, gpg_strerror (err));
       goto leave;
     }
   xfree (certbuf);
   certbuf = NULL;
 
   k_pkey = ksba_cert_get_public_key (cert);
   if (!k_pkey)
     {
       err = gpg_error (GPG_ERR_NO_PUBKEY);
       goto leave;
     }
   n = gcry_sexp_canon_len (k_pkey, 0, NULL, NULL);
   err = gcry_sexp_new (&s_pkey, k_pkey, n, 0);
   if (err)
     goto leave;
 
   l1 = gcry_sexp_find_token (s_pkey, "public-key", 0);
   if (!l1)
     {
       err = gpg_error (GPG_ERR_NO_PUBKEY);
       goto leave;
     }
 
   {
     gcry_sexp_t l_tmp = gcry_sexp_cadr (l1);
     gcry_sexp_release (l1);
     l1 = l_tmp;
   }
   algoname = gcry_sexp_nth_string (l1, 0);
   if (!algoname)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   algo = gcry_pk_map_name (algoname);
   switch (algo)
     {
     case GCRY_PK_RSA:
       algo = PIV_ALGORITHM_RSA;
       break;
 
     case GCRY_PK_ECC:
     case GCRY_PK_ECDSA:
     case GCRY_PK_ECDH:
       curve_name = gcry_pk_get_curve (s_pkey, 0, NULL);
       if (curve_name && !strcmp (curve_name, "NIST P-256"))
         algo = PIV_ALGORITHM_ECC_P256;
       else if (curve_name && !strcmp (curve_name, "NIST P-384"))
         algo = PIV_ALGORITHM_ECC_P384;
       else
         {
           err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
           log_error ("piv: certificate %s, curve '%s': %s\n",
                      dobj->keyref, curve_name, gpg_strerror (err));
           goto leave;
         }
       break;
 
     default:
       err = gpg_error (GPG_ERR_PUBKEY_ALGO);
       log_error ("piv: certificate %s, pubkey algo '%s': %s\n",
                  dobj->keyref, algoname, gpg_strerror (err));
       goto leave;
     }
   *r_mechanism = algo;
 
  leave:
   gcry_free (algoname);
   gcry_sexp_release (l1);
   gcry_sexp_release (s_pkey);
   ksba_free (k_pkey);
   xfree (certbuf);
   return err;
 }
 
 
 /* Helper to cache the pin PINNO.  If PIN is NULL the cache is cleared. */
 static void
 cache_pin (app_t app, ctrl_t ctrl, int pinno,
            const char *pin, unsigned int pinlen)
 {
   char pinref[20];
 
   if (pinno < 0)
     return;
   switch (app->card->cardtype)
     {
     case CARDTYPE_YUBIKEY: break;
     default: return;
     }
 
 
 
   snprintf (pinref, sizeof pinref, "%02x", pinno);
   pincache_put (ctrl, app_get_slot (app), "piv", pinref, pin, pinlen);
 
   switch (pinno)
     {
     case 0x00: app->app_local->pincache.maybe_00 = !!pin; break;
     case 0x80: app->app_local->pincache.maybe_80 = !!pin; break;
     case 0x81: app->app_local->pincache.maybe_81 = !!pin; break;
     case 0x96: app->app_local->pincache.maybe_96 = !!pin; break;
     case 0x97: app->app_local->pincache.maybe_97 = !!pin; break;
     case 0x98: app->app_local->pincache.maybe_98 = !!pin; break;
     case 0x9B: app->app_local->pincache.maybe_9B = !!pin; break;
     }
 
 }
 
 
 /* If the PIN cache is available and really has a valid PIN return
  * that pin at R_PIN.  Returns true if that is the case; otherwise
  * false.  */
 static int
 pin_from_cache (app_t app, ctrl_t ctrl, int pinno, char **r_pin)
 {
   char pinref[20];
   int maybe_cached;
 
   *r_pin = NULL;
 
   if (pinno < 0)
     return 0;
   switch (app->card->cardtype)
     {
     case CARDTYPE_YUBIKEY: break;
     default: return 0;
     }
 
   switch (pinno)
     {
     case 0x00: maybe_cached = app->app_local->pincache.maybe_00; break;
     case 0x80: maybe_cached = app->app_local->pincache.maybe_80; break;
     case 0x81: maybe_cached = app->app_local->pincache.maybe_81; break;
     case 0x96: maybe_cached = app->app_local->pincache.maybe_96; break;
     case 0x97: maybe_cached = app->app_local->pincache.maybe_97; break;
     case 0x98: maybe_cached = app->app_local->pincache.maybe_98; break;
     case 0x9B: maybe_cached = app->app_local->pincache.maybe_9B; break;
     default:   maybe_cached = 0;
     }
 
   if (!maybe_cached)
     return 0;
 
   snprintf (pinref, sizeof pinref, "%02x", pinno);
   if (pincache_get (ctrl, app_get_slot (app), "piv", pinref, r_pin))
     return 0;
 
   return 1;
 }
 
 
 /* Return an allocated string to be used as prompt.  Returns NULL on
  * malloc error.  */
 static char *
 make_prompt (app_t app, int remaining, const char *firstline)
 {
   char *serial, *tmpbuf, *result;
 
   serial = get_dispserialno (app, 0);
   if (!serial)
     return NULL;
 
   /* TRANSLATORS: Put a \x1f right before a colon.  This can be
    * used by pinentry to nicely align the names and values.  Keep
    * the %s at the start and end of the string.  */
   result = xtryasprintf (_("%s"
                            "Number\x1f: %s%%0A"
                            "Holder\x1f: %s"
                            "%s"),
                          "\x1e",
                          serial,
                          "Unknown", /* Fixme */
                          "");
   xfree (serial);
 
   /* Append a "remaining attempts" info if needed.  */
   if (remaining != -1 && remaining < 3)
     {
       char *rembuf;
 
       /* TRANSLATORS: This is the number of remaining attempts to
        * enter a PIN.  Use %%0A (double-percent,0A) for a linefeed. */
       rembuf = xtryasprintf (_("Remaining attempts: %d"), remaining);
       if (rembuf)
         {
           tmpbuf = strconcat (firstline, "%0A%0A", result,
                               "%0A%0A", rembuf, NULL);
           xfree (rembuf);
         }
       else
         tmpbuf = NULL;
       xfree (result);
       result = tmpbuf;
     }
   else
     {
       tmpbuf = strconcat (firstline, "%0A%0A", result, NULL);
       xfree (result);
       result = tmpbuf;
     }
 
   return result;
 }
 
 
 /* Helper for verify_chv to ask for the PIN and to prepare/pad it.  On
  * success the result is stored at (R_PIN,R_PINLEN).  */
 static gpg_error_t
 ask_and_prepare_chv (app_t app, ctrl_t ctrl,
                      int keyref, int ask_new, int remaining, int no_cache,
                      gpg_error_t (*pincb)(void*,const char *,char **),
                      void *pincb_arg, char **r_pin, unsigned int *r_pinlen,
                      unsigned int *r_unpaddedpinlen)
 {
   gpg_error_t err;
   const char *label;
   char *prompt;
   char *pinvalue = NULL;
   unsigned int pinlen;
   char *pinbuffer = NULL;
   int minlen, maxlen, padding, onlydigits;
 
   *r_pin = NULL;
   *r_pinlen = 0;
   if (r_unpaddedpinlen)
     *r_unpaddedpinlen = 0;
 
   if (ask_new)
     remaining = -1;
 
   if (remaining != -1)
     log_debug ("piv: CHV %02X has %d attempts left\n", keyref, remaining);
 
   switch (keyref)
     {
     case 0x00:
       minlen = 6;
       maxlen = 8;
       padding = 1;
       onlydigits = 1;
       label = (ask_new? _("|N|Please enter the new Global-PIN")
                /**/   : _("||Please enter the Global-PIN of your PIV card"));
       break;
     case 0x80:
       minlen = 6;
       maxlen = 8;
       padding = 1;
       onlydigits = 1;
       label = (ask_new? _("|N|Please enter the new PIN")
                /**/   : _("||Please enter the PIN of your PIV card"));
       break;
     case 0x81:
       minlen = 8;
       maxlen = 8;
       padding = 0;
       onlydigits = 0;
       label = (ask_new? _("|N|Please enter the new Unblocking Key")
                /**/   :_("||Please enter the Unblocking Key of your PIV card"));
       break;
 
     case 0x96:
     case 0x97:
     case 0x98:
     case 0x9B:
       return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
 
     default:
       return gpg_error (GPG_ERR_INV_ID);
     }
 
   /* Ask for the PIN.  */
   if (!no_cache && remaining >= 3
       && pin_from_cache (app, ctrl, keyref, &pinvalue))
     err = 0;
   else
     {
       prompt = make_prompt (app, remaining, label);
       err = pincb (pincb_arg, prompt, &pinvalue);
       xfree (prompt);
       prompt = NULL;
     }
   if (err)
     {
       log_info (_("PIN callback returned error: %s\n"), gpg_strerror (err));
       return err;
     }
 
   pinlen = pinvalue? strlen (pinvalue) : 0;
   if (pinlen < minlen)
     {
       log_error (_("PIN for is too short; minimum length is %d\n"), minlen);
       if (pinvalue)
         wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
   if (pinlen > maxlen)
     {
       log_error (_("PIN for is too long; maximum length is %d\n"), maxlen);
       wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
   if (onlydigits && strspn (pinvalue, "0123456789") != pinlen)
     {
       log_error (_("PIN has invalid characters; only digits are allowed\n"));
       wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
 
   pinbuffer = xtrymalloc_secure (maxlen);
   if (!pinbuffer)
     {
       err = gpg_error_from_syserror ();
       wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return err;
     }
 
   memcpy (pinbuffer, pinvalue, pinlen);
   wipememory (pinvalue, pinlen);
   xfree (pinvalue);
 
   if (r_unpaddedpinlen)
     *r_unpaddedpinlen = pinlen;
 
   if (padding)
     {
       memset (pinbuffer + pinlen, 0xff, maxlen - pinlen);
       pinlen = maxlen;
     }
 
   *r_pin = pinbuffer;
   *r_pinlen = pinlen;
 
   return 0;
 }
 
 
 /* Verify the card holder verification identified by KEYREF.  This is
  * either the Application PIN or the Global PIN.  If FORCE is true a
  * verification is always done.  */
 static gpg_error_t
 verify_chv (app_t app, ctrl_t ctrl, int keyref, int force,
             gpg_error_t (*pincb)(void*,const char *,char **), void *pincb_arg)
 {
   gpg_error_t err;
   int remaining;
   char *pin = NULL;
   unsigned int pinlen, unpaddedpinlen;
 
   /* First check whether a verify is at all needed.  */
   remaining = iso7816_verify_status (app_get_slot (app), keyref);
   if (remaining == ISO7816_VERIFY_NOT_NEEDED)
     {
       if (!force) /* No need to verification.  */
         return 0;  /* All fine.  */
       remaining = -1;
     }
   else if (remaining < 0)  /* We don't care about other errors. */
     remaining = -1;
 
 
   err = ask_and_prepare_chv (app, ctrl, keyref, 0, remaining, force,
                              pincb, pincb_arg,
                              &pin, &pinlen, &unpaddedpinlen);
   if (err)
     return err;
 
   err = iso7816_verify (app_get_slot (app), keyref, pin, pinlen);
   if (err)
     {
       log_error ("CHV %02X verification failed: %s\n",
                  keyref, gpg_strerror (err));
       cache_pin (app, ctrl, keyref, NULL, 0);
     }
   else
     cache_pin (app, ctrl, keyref, pin, unpaddedpinlen);
 
   wipememory (pin, pinlen);
   xfree (pin);
 
   return err;
 }
 
 
 /* Handle the PASSWD command.  Valid values for PWIDSTR are
  * key references related to PINs; in particular:
  *   PIV.00 - The Global PIN
  *   PIV.80 - The Application PIN
  *   PIV.81 - The PIN Unblocking key
  * The supported flags are:
  *   APP_CHANGE_FLAG_CLEAR   Clear the PIN verification state.
  *   APP_CHANGE_FLAG_RESET   Reset a PIN using the PUK.  Only
  *                           allowed with PIV.80.
  */
 static gpg_error_t
 do_change_chv (app_t app, ctrl_t ctrl, const char *pwidstr,
                unsigned int flags,
                gpg_error_t (*pincb)(void*, const char *, char **),
                void *pincb_arg)
 {
   gpg_error_t err;
   int keyref, targetkeyref;
   unsigned char apdu[4];
   unsigned int sw;
   int remaining;
   char *oldpin = NULL;
   unsigned int oldpinlen;
   char *newpin = NULL;
   unsigned int newpinlen;
 
   (void)ctrl;
 
   /* Check for unknown flags.  */
   if ((flags & ~(APP_CHANGE_FLAG_CLEAR|APP_CHANGE_FLAG_RESET)))
     {
       err = gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
       goto leave;
     }
 
   /* Parse the keyref.  */
   targetkeyref = keyref = parse_chv_keyref (pwidstr);
   if (keyref == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
 
   cache_pin (app, ctrl, keyref, NULL, 0);
 
   /* First see whether the special --clear mode has been requested.  */
   if ((flags & APP_CHANGE_FLAG_CLEAR))
     {
       apdu[0] = 0x00;
       apdu[1] = ISO7816_VERIFY;
       apdu[2] = 0xff;
       apdu[3] = keyref;
       err = iso7816_apdu_direct (app_get_slot (app), apdu, 4, 0,
                                  NULL, NULL, NULL);
       goto leave;
     }
 
   /* Prepare reset mode.  */
   if ((flags & APP_CHANGE_FLAG_RESET))
     {
       if (keyref == 0x81)
         {
           err = gpg_error (GPG_ERR_INV_ID); /* Can't reset the PUK.  */
           goto leave;
         }
       /* Set the keyref to the PUK and keep the TARGETKEYREF.  */
       keyref = 0x81;
     }
 
   /* Get the remaining tries count.  This is done by using the check
    * for verified state feature.  */
   apdu[0] = 0x00;
   apdu[1] = ISO7816_VERIFY;
   apdu[2] = 0x00;
   apdu[3] = keyref;
   if (!iso7816_apdu_direct (app_get_slot (app), apdu, 4, 0, &sw, NULL, NULL))
     remaining = -1; /* Already verified, thus full number of tries.  */
   else if ((sw & 0xfff0) == 0x63C0)
     remaining = (sw & 0x000f); /* PIN has REMAINING tries left.  */
   else
     remaining = -1;
 
   /* Ask for the old pin or puk.  */
   err = ask_and_prepare_chv (app, ctrl, keyref, 0, remaining, 0,
                              pincb, pincb_arg,
                              &oldpin, &oldpinlen, NULL);
   if (err)
     return err;
 
   /* Verify the old pin so that we don't prompt for the new pin if the
    * old is wrong.  This is not possible for the PUK, though. */
   if (keyref != 0x81)
     {
       err = iso7816_verify (app_get_slot (app), keyref, oldpin, oldpinlen);
       if (err)
         {
           log_error ("CHV %02X verification failed: %s\n",
                      keyref, gpg_strerror (err));
           goto leave;
         }
     }
 
   /* Ask for the new pin.  */
   err = ask_and_prepare_chv (app, ctrl, targetkeyref, 1, -1, 0,
                              pincb, pincb_arg,
                              &newpin, &newpinlen, NULL);
   if (err)
     return err;
 
   if ((flags & APP_CHANGE_FLAG_RESET))
     {
       char *buf = xtrymalloc_secure (oldpinlen + newpinlen);
       if (!buf)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       memcpy (buf, oldpin, oldpinlen);
       memcpy (buf+oldpinlen, newpin, newpinlen);
       err = iso7816_reset_retry_counter_with_rc (app_get_slot (app),
                                                  targetkeyref,
                                                  buf, oldpinlen+newpinlen);
       xfree (buf);
       if (err)
         log_error ("resetting CHV %02X using CHV %02X failed: %s\n",
                    targetkeyref, keyref, gpg_strerror (err));
     }
   else
     {
       err = iso7816_change_reference_data (app_get_slot (app), keyref,
                                            oldpin, oldpinlen,
                                            newpin, newpinlen);
       if (err)
         log_error ("CHV %02X changing PIN failed: %s\n",
                    keyref, gpg_strerror (err));
     }
 
  leave:
   xfree (oldpin);
   xfree (newpin);
   return err;
 }
 
 
 /* Perform a simple verify operation for the PIN specified by PWIDSTR.
  * For valid values see do_change_chv.  */
 static gpg_error_t
 do_check_chv (app_t app, ctrl_t ctrl, const char *pwidstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg)
 {
   int keyref;
 
   (void)ctrl;
 
   keyref = parse_chv_keyref (pwidstr);
   if (keyref == -1)
     return gpg_error (GPG_ERR_INV_ID);
 
   return verify_chv (app, ctrl, keyref, 0, pincb, pincb_arg);
 }
 
 
 /* Compute a digital signature using the GENERAL AUTHENTICATE command
  * on INDATA which is expected to be the raw message digest.  The
  * KEYIDSTR has the key reference or its OID (e.g. "PIV.9A").  The
  * result is stored at (R_OUTDATA,R_OUTDATALEN); on error (NULL,0) is
  * stored there and an error code returned.  For ECDSA the result is
  * the simple concatenation of R and S without any DER encoding.  R
  * and S are left extended with zeroes to make sure they have an equal
  * length.  If HASHALGO is not zero, the function prepends the hash's
  * OID to the indata or checks that it is consistent.
  */
 static gpg_error_t
 do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
          gpg_error_t (*pincb)(void*, const char *, char **),
          void *pincb_arg,
          const void *indata_arg, size_t indatalen,
          unsigned char **r_outdata, size_t *r_outdatalen)
 {
   const unsigned char *indata = indata_arg;
   gpg_error_t err;
   data_object_t dobj;
   unsigned char oidbuf[64];
   size_t oidbuflen;
   unsigned char *outdata = NULL;
   size_t outdatalen;
   const unsigned char *s;
   size_t n;
   int keyref, mechanism;
   unsigned char *indata_buffer = NULL; /* Malloced helper.  */
   unsigned char *apdudata = NULL;
   size_t apdudatalen;
   int force_verify;
 
   (void)ctrl;
 
   if (!keyidstr || !*keyidstr)
     {
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
 
   dobj = find_dobj_by_keyref (app, keyidstr);
   if ((keyref = keyref_from_dobj (dobj)) == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
 
   /* According to table 4b of SP800-73-4 the signing key always
    * requires a verify.  */
   switch (keyref)
     {
     case 0x9c: force_verify = 1; break;
     default: force_verify = 0; break;
     }
 
 
   err = get_key_algorithm_by_dobj (app, dobj, &mechanism);
   if (err)
     goto leave;
 
    /* For ECC we need to remove the ASN.1 prefix from INDATA.  For RSA
     * we need to add the padding and possible also the ASN.1 prefix.  */
   if (mechanism == PIV_ALGORITHM_ECC_P256
       || mechanism == PIV_ALGORITHM_ECC_P384)
     {
       int need_algo, need_digestlen;
 
       if (mechanism == PIV_ALGORITHM_ECC_P256)
         {
           need_algo = GCRY_MD_SHA256;
           need_digestlen = 32;
         }
       else
         {
           need_algo = GCRY_MD_SHA384;
           need_digestlen = 48;
         }
 
       if (hashalgo && hashalgo != need_algo)
         {
           err = gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
           log_error ("piv: hash algo %d does not match mechanism %d\n",
                      need_algo, mechanism);
           goto leave;
         }
 
       if (indatalen > need_digestlen)
         {
           oidbuflen = sizeof oidbuf;
           err = gcry_md_get_asnoid (need_algo, &oidbuf, &oidbuflen);
           if (err)
             {
               err = gpg_error (GPG_ERR_INTERNAL);
               log_debug ("piv: no OID for hash algo %d\n", need_algo);
               goto leave;
             }
           if (indatalen != oidbuflen + need_digestlen
               || memcmp (indata, oidbuf, oidbuflen))
             {
               err = gpg_error (GPG_ERR_INV_VALUE);
               log_error ("piv: bad input for signing with mechanism %d\n",
                          mechanism);
               goto leave;
             }
           indata += oidbuflen;
           indatalen -= oidbuflen;
         }
     }
   else if (mechanism == PIV_ALGORITHM_RSA
            && indatalen == 2048/8 && indata[indatalen-1] == 0xBC)
     {
       /* If the provided data length matches the supported RSA
        * framelen and the last octet of the data is 0xBC, we assume
        * this is PSS formatted data and we use it verbatim; PIV cards
        * accept PSS as well as PKCS#1.  */
     }
   else if (mechanism == PIV_ALGORITHM_RSA)
     {
       /* PIV requires 2048 bit RSA.  */
       unsigned int framelen = 2048 / 8;
       unsigned char *frame;
       int i;
 
       oidbuflen = sizeof oidbuf;
       if (!hashalgo)
         {
           /* We assume that indata already has the required
            * digestinfo; thus merely prepend the padding below.  */
         }
       else if ((err = gcry_md_get_asnoid (hashalgo, &oidbuf, &oidbuflen)))
         {
           log_debug ("piv: no OID for hash algo %d\n", hashalgo);
           goto leave;
         }
       else
         {
           unsigned int digestlen = gcry_md_get_algo_dlen (hashalgo);
 
           if (indatalen == digestlen)
             {
               /* Plain hash in INDATA; prepend the digestinfo.  */
               indata_buffer = xtrymalloc (oidbuflen + indatalen);
               if (!indata_buffer)
                 {
                   err = gpg_error_from_syserror ();
                   goto leave;
                 }
               memcpy (indata_buffer, oidbuf, oidbuflen);
               memcpy (indata_buffer+oidbuflen, indata, indatalen);
               indata = indata_buffer;
               indatalen = oidbuflen + indatalen;
             }
           else if (indatalen == oidbuflen + digestlen
                    && !memcmp (indata, oidbuf, oidbuflen))
             ; /* Correct prefix.  */
           else
             {
               err = gpg_error (GPG_ERR_INV_VALUE);
               log_error ("piv: bad input for signing with RSA and hash %d\n",
                          hashalgo);
               goto leave;
             }
         }
       /* Now prepend the pkcs#v1.5 padding.  We require at least 8
        * byte of padding and 3 extra bytes for the prefix and the
        * delimiting nul.  */
       if (!indatalen || indatalen + 8 + 4 > framelen)
         {
           err = gpg_error (GPG_ERR_INV_VALUE);
           log_error ("piv: input does not fit into a %u bit PKCS#v1.5 frame\n",
                      8*framelen);
           goto leave;
         }
       frame = xtrymalloc (framelen);
       if (!frame)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       n = 0;
       frame[n++] = 0;
       frame[n++] = 1; /* Block type. */
       i = framelen - indatalen - 3 ;
       memset (frame+n, 0xff, i);
       n += i;
       frame[n++] = 0; /* Delimiter.  */
       memcpy (frame+n, indata, indatalen);
       n += indatalen;
       log_assert (n == framelen);
       /* And now put it into the indata_buffer.  */
       xfree (indata_buffer);
       indata_buffer = frame;
       indata = indata_buffer;
       indatalen = framelen;
     }
   else
     {
       err = gpg_error (GPG_ERR_INTERNAL);
       log_debug ("piv: unknown PIV mechanism %d while signing\n", mechanism);
       goto leave;
     }
 
   /* Now verify the Application PIN.  */
   err = verify_chv (app, ctrl, 0x80, force_verify, pincb, pincb_arg);
   if (err)
     return err;
 
   /* Build the Dynamic Authentication Template.  */
   err = concat_tlv_list (0, &apdudata, &apdudatalen,
                          (int)0x7c, (size_t)0, NULL, /* Constructed. */
                          (int)0x82, (size_t)0, "",
                          (int)0x81, (size_t)indatalen, indata,
                          (int)0, (size_t)0, NULL);
   if (err)
     goto leave;
 
   /* Note: the -1 requests command chaining.  */
   err = iso7816_general_authenticate (app_get_slot (app), -1,
                                       mechanism, keyref,
                                       apdudata, (int)apdudatalen, 0,
                                       &outdata, &outdatalen);
   if (err)
     goto leave;
 
   /* Parse the response.  */
   if (outdatalen && *outdata == 0x7c
       && (s = find_tlv (outdata, outdatalen, 0x82, &n)))
     {
       if (mechanism == PIV_ALGORITHM_RSA)
         {
           memmove (outdata, outdata + (s - outdata), n);
           outdatalen = n;
         }
       else /* ECC */
         {
           const unsigned char *rval, *sval;
           size_t rlen, rlenx, slen, slenx, resultlen;
           char *result;
           /* The result of an ECDSA signature is
            *   SEQUENCE { r INTEGER, s INTEGER }
            * We re-pack that by concatenating R and S and making sure
            * that both have the same length.  We simplify parsing by
            * using find_tlv and not a proper DER parser.  */
           s = find_tlv (s, n, 0x30, &n);
           if (!s)
             goto bad_der;
           rval = find_tlv (s, n, 0x02, &rlen);
           if (!rval)
             goto bad_der;
           log_assert (n >= (rval-s)+rlen);
           sval = find_tlv (rval+rlen, n-((rval-s)+rlen), 0x02, &slen);
           if (!rval)
             goto bad_der;
           rlenx = slenx = 0;
           if (rlen > slen)
             slenx = rlen - slen;
           else if (slen > rlen)
             rlenx = slen - rlen;
 
           resultlen = rlen + rlenx + slen + slenx;
           result = xtrycalloc (1, resultlen);
           if (!result)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           memcpy (result + rlenx, rval, rlen);
           memcpy (result + rlenx + rlen + slenx, sval, slen);
           xfree (outdata);
           outdata = result;
           outdatalen = resultlen;
         }
     }
   else
     {
     bad_der:
       err = gpg_error (GPG_ERR_CARD);
       log_error ("piv: response does not contain a proper result\n");
       goto leave;
     }
 
  leave:
   if (err)
     {
       xfree (outdata);
       *r_outdata = NULL;
       *r_outdatalen = 0;
     }
   else
     {
       *r_outdata = outdata;
       *r_outdatalen = outdatalen;
     }
   xfree (apdudata);
   xfree (indata_buffer);
   return err;
 }
 
 
 /* AUTH for PIV cards is actually the same as SIGN.  The difference
  * between AUTH and SIGN is that AUTH expects that pkcs#1.5 padding
  * for RSA has already been done (digestInfo part w/o the padding)
  * whereas SIGN may accept a plain digest and does the padding if
  * needed.  This is also the reason why SIGN takes a hashalgo.  For
  * both it is also acceptable to receive fully prepared PSS data.  */
 static gpg_error_t
 do_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
          gpg_error_t (*pincb)(void*, const char *, char **),
          void *pincb_arg,
          const void *indata, size_t indatalen,
          unsigned char **r_outdata, size_t *r_outdatalen)
 {
   return do_sign (app, ctrl, keyidstr, 0, pincb, pincb_arg, indata, indatalen,
                   r_outdata, r_outdatalen);
 }
 
 
 /* Decrypt the data in (INDATA,INDATALEN) and on success store the
  * mallocated result at (R_OUTDATA,R_OUTDATALEN).  */
 static gpg_error_t
 do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const void *indata_arg, size_t indatalen,
              unsigned char **r_outdata, size_t *r_outdatalen,
              unsigned int *r_info)
 {
   const unsigned char *indata = indata_arg;
   gpg_error_t err;
   data_object_t dobj;
   unsigned char *outdata = NULL;
   size_t outdatalen;
   const unsigned char *s;
   size_t n;
   int keyref, mechanism;
   unsigned int framelen;
   unsigned char *indata_buffer = NULL; /* Malloced helper.  */
   unsigned char *apdudata = NULL;
   size_t apdudatalen;
 
   (void)ctrl;
 
   if (!keyidstr || !*keyidstr)
     {
       err = gpg_error (GPG_ERR_INV_VALUE);
       goto leave;
     }
 
   dobj = find_dobj_by_keyref (app, keyidstr);
   if ((keyref = keyref_from_dobj (dobj)) == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
   if (keyref == 0x9A || keyref == 0x9C || keyref == 0x9E)
     {
       /* Signing only reference.  We only allow '9D' and the retired
        * cert key management DOs.  */
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
 
   err = get_key_algorithm_by_dobj (app, dobj, &mechanism);
   if (err)
     goto leave;
 
   switch (mechanism)
     {
     case PIV_ALGORITHM_ECC_P256:
       framelen = 1+32+32;
       break;
     case PIV_ALGORITHM_ECC_P384:
       framelen = 1+48+48;
       break;
     case PIV_ALGORITHM_RSA:
       framelen = 2048 / 8;
       break;
     default:
       err = gpg_error (GPG_ERR_INTERNAL);
       log_debug ("piv: unknown PIV mechanism %d while decrypting\n", mechanism);
       goto leave;
     }
 
   /* Check that the ciphertext has the right length; due to internal
    * convey mechanism using MPIs leading zero bytes might have been
    * lost.  Adjust for this.  Unfortunately the ciphertext might have
    * also been prefixed with a leading zero to make it a positive
    * number; that may be a too long frame and we need to adjust for
    * this too.  Note that for ECC those fixes are not reqquired
    * because the first octet is always '04' to indicate an
    * uncompressed point.  */
   if (indatalen > framelen)
     {
       if (mechanism == PIV_ALGORITHM_RSA
           && indatalen == framelen + 1 && !*indata)
         {
           indata_buffer = xtrycalloc (1, framelen);
           if (!indata_buffer)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           memcpy (indata_buffer, indata+1, framelen);
           indata = indata_buffer;
           indatalen = framelen;
         }
       else
         {
           err = gpg_error (GPG_ERR_INV_VALUE);
           log_error ("piv: input of %zu octets too large for mechanism %d\n",
                      indatalen, mechanism);
           goto leave;
         }
     }
   if (indatalen < framelen)
     {
       indata_buffer = xtrycalloc (1, framelen);
       if (!indata_buffer)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       memcpy (indata_buffer+(framelen-indatalen), indata, indatalen);
       indata = indata_buffer;
       indatalen = framelen;
     }
 
   /* Now verify the Application PIN.  */
   err = verify_chv (app, ctrl, 0x80, 0, pincb, pincb_arg);
   if (err)
     return err;
 
   /* Build the Dynamic Authentication Template.  */
   err = concat_tlv_list (0, &apdudata, &apdudatalen,
                          (int)0x7c, (size_t)0, NULL, /* Constructed. */
                          (int)0x82, (size_t)0, "",
                          mechanism == PIV_ALGORITHM_RSA?
                          (int)0x81 : (int)0x85, (size_t)indatalen, indata,
                          (int)0, (size_t)0, NULL);
   if (err)
     goto leave;
 
   /* Note: the -1 requests command chaining.  */
   err = iso7816_general_authenticate (app_get_slot (app), -1,
                                       mechanism, keyref,
                                       apdudata, (int)apdudatalen, 0,
                                       &outdata, &outdatalen);
   if (err)
     goto leave;
 
   /* Parse the response.  */
   if (outdatalen && *outdata == 0x7c
       && (s = find_tlv (outdata, outdatalen, 0x82, &n)))
     {
       memmove (outdata, outdata + (s - outdata), n);
       outdatalen = n;
     }
   else
     {
       err = gpg_error (GPG_ERR_CARD);
       log_error ("piv: response does not contain a proper result\n");
       goto leave;
     }
 
  leave:
   if (err)
     {
       xfree (outdata);
       *r_outdata = NULL;
       *r_outdatalen = 0;
     }
   else
     {
       *r_outdata = outdata;
       *r_outdatalen = outdatalen;
     }
   *r_info = 0;
   xfree (apdudata);
   xfree (indata_buffer);
   return err;
 }
 
 
 /* Check whether a key for DOBJ already exists.  We detect this by
  * reading the certificate described by DOBJ.  If FORCE is TRUE a
  * diagnositic will be printed but no error returned if the key
  * already exists.  The flag GENERATING is used to select a
  * diagnositic. */
 static gpg_error_t
 does_key_exist (app_t app, data_object_t dobj, int generating, int force)
 {
   void *relptr;
   unsigned char *buffer;
   size_t buflen;
   int found;
 
   relptr = get_one_do (app, dobj->tag, &buffer, &buflen, NULL);
   found = (relptr && buflen);
   xfree (relptr);
 
   if (found && !force)
     {
       log_error (_("key already exists\n"));
       return gpg_error (GPG_ERR_EEXIST);
     }
 
   if (found)
     log_info (_("existing key will be replaced\n"));
   else if (generating)
     log_info (_("generating new key\n"));
   else
     log_info (_("writing new key\n"));
   return 0;
 }
 
 
 /* Helper for do_writekey; here the RSA part.  BUF, BUFLEN, and DEPTH
  * are the current parser state of the S-expression with the key. */
 static gpg_error_t
 writekey_rsa (app_t app, data_object_t dobj, int keyref,
               const unsigned char *buf, size_t buflen, int depth)
 {
   gpg_error_t err;
   const unsigned char *tok;
   size_t toklen;
   int last_depth1, last_depth2;
   const unsigned char *rsa_n = NULL;
   const unsigned char *rsa_e = NULL;
   const unsigned char *rsa_p = NULL;
   const unsigned char *rsa_q = NULL;
   unsigned char *rsa_dpm1 = NULL;
   unsigned char *rsa_dqm1 = NULL;
   unsigned char *rsa_qinv = NULL;
   size_t rsa_n_len, rsa_e_len, rsa_p_len, rsa_q_len;
   size_t rsa_dpm1_len, rsa_dqm1_len, rsa_qinv_len;
   unsigned char *apdudata = NULL;
   size_t apdudatalen;
   unsigned char tmpl[1];
 
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
 
       if (tok && toklen == 1)
         {
           const unsigned char **mpi;
           size_t *mpi_len;
 
           switch (*tok)
             {
             case 'n': mpi = &rsa_n; mpi_len = &rsa_n_len; break;
             case 'e': mpi = &rsa_e; mpi_len = &rsa_e_len; break;
             case 'p': mpi = &rsa_p; mpi_len = &rsa_p_len; break;
             case 'q': mpi = &rsa_q; mpi_len = &rsa_q_len; break;
             default: mpi = NULL;  mpi_len = NULL; break;
             }
           if (mpi && *mpi)
             {
               err = gpg_error (GPG_ERR_DUP_VALUE);
               goto leave;
             }
 
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
           if (tok && mpi)
             {
               /* Strip off leading zero bytes and save. */
               for (;toklen && !*tok; toklen--, tok++)
                 ;
               *mpi = tok;
               *mpi_len = toklen;
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
 
   /* Check that we have all parameters.  */
   if (!rsa_n || !rsa_e || !rsa_p || !rsa_q)
     {
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
   /* Fixme: Shall we check whether  n == pq ? */
 
   if (opt.verbose)
     log_info ("RSA private key size is %u bytes\n", (unsigned int)rsa_n_len);
 
   /* Compute the dp, dq and u components.  */
   {
     gcry_mpi_t mpi_e, mpi_p, mpi_q;
     gcry_mpi_t mpi_dpm1 = gcry_mpi_snew (0);
     gcry_mpi_t mpi_dqm1 = gcry_mpi_snew (0);
     gcry_mpi_t mpi_qinv = gcry_mpi_snew (0);
     gcry_mpi_t mpi_tmp  = gcry_mpi_snew (0);
 
     gcry_mpi_scan (&mpi_e, GCRYMPI_FMT_USG, rsa_e, rsa_e_len, NULL);
     gcry_mpi_scan (&mpi_p, GCRYMPI_FMT_USG, rsa_p, rsa_p_len, NULL);
     gcry_mpi_scan (&mpi_q, GCRYMPI_FMT_USG, rsa_q, rsa_q_len, NULL);
 
     gcry_mpi_sub_ui (mpi_tmp, mpi_p, 1);
     gcry_mpi_invm (mpi_dpm1, mpi_e, mpi_tmp);
 
     gcry_mpi_sub_ui (mpi_tmp, mpi_q, 1);
     gcry_mpi_invm (mpi_dqm1, mpi_e, mpi_tmp);
 
     gcry_mpi_invm (mpi_qinv, mpi_q, mpi_p);
 
     gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dpm1, &rsa_dpm1_len, mpi_dpm1);
     gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dqm1, &rsa_dqm1_len, mpi_dqm1);
     gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_qinv, &rsa_qinv_len, mpi_qinv);
 
     gcry_mpi_release (mpi_e);
     gcry_mpi_release (mpi_p);
     gcry_mpi_release (mpi_q);
     gcry_mpi_release (mpi_dpm1);
     gcry_mpi_release (mpi_dqm1);
     gcry_mpi_release (mpi_qinv);
     gcry_mpi_release (mpi_tmp);
   }
 
   err = concat_tlv_list (1, &apdudata, &apdudatalen,
                          (int)0x01, (size_t)rsa_p_len, rsa_p,
                          (int)0x02, (size_t)rsa_q_len, rsa_q,
                          (int)0x03, (size_t)rsa_dpm1_len, rsa_dpm1,
                          (int)0x04, (size_t)rsa_dqm1_len, rsa_dqm1,
                          (int)0x05, (size_t)rsa_qinv_len, rsa_qinv,
                          (int)0, (size_t)0, NULL);
   if (err)
     goto leave;
 
   err = iso7816_send_apdu (app_get_slot (app),
                            -1,         /* Use command chaining.  */
                            0,          /* Class */
                            0xfe,       /* Ins: Yubikey Import Asym. Key.  */
                            PIV_ALGORITHM_RSA, /* P1 */
                            keyref,     /* P2 */
                            apdudatalen,/* Lc */
                            apdudata,   /* data */
                            NULL, NULL, NULL);
   if (err)
     goto leave;
 
   /* Write the public key to the cert object.  */
   xfree (apdudata);
   err = concat_tlv_list (0, &apdudata, &apdudatalen,
                          (int)0x81, (size_t)rsa_n_len, rsa_n,
                          (int)0x82, (size_t)rsa_e_len, rsa_e,
                          (int)0, (size_t)0, NULL);
 
   if (err)
     goto leave;
   tmpl[0] = PIV_ALGORITHM_RSA;
   err = put_data (app_get_slot (app), dobj->tag,
                   (int)0x80,   (size_t)1, tmpl,
                   (int)0x7f49, (size_t)apdudatalen, apdudata,
                   (int)0,      (size_t)0, NULL);
 
  leave:
   xfree (rsa_dpm1);
   xfree (rsa_dqm1);
   xfree (rsa_qinv);
   xfree (apdudata);
   return err;
 }
 
 
 /* Helper for do_writekey; here the ECC part.  BUF, BUFLEN, and DEPTH
  * are the current parser state of the S-expression with the key. */
 static gpg_error_t
 writekey_ecc (app_t app, data_object_t dobj, int keyref,
               const unsigned char *buf, size_t buflen, int depth)
 {
   gpg_error_t err;
   const unsigned char *tok;
   size_t toklen;
   int last_depth1, last_depth2;
   int mechanism = 0;
   const unsigned char *ecc_q = NULL;
   const unsigned char *ecc_d = NULL;
   size_t ecc_q_len, ecc_d_len;
   unsigned char *apdudata = NULL;
   size_t apdudatalen;
   unsigned char tmpl[1];
 
   last_depth1 = depth;
   while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
          && depth && depth >= last_depth1)
     {
       if (tok)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
           goto leave;
         }
       if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
         goto leave;
 
       if (tok && toklen == 5 && !memcmp (tok, "curve", 5))
         {
           char *name;
           const char *xname;
 
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
 
           name = xtrymalloc (toklen+1);
           if (!name)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           memcpy (name, tok, toklen);
           name[toklen] = 0;
           /* Canonicalize the curve name.  We use the openpgp
            * functions here because Libgcrypt has no generic curve
            * alias lookup feature and the PIV supported curves are
            * also supported by OpenPGP.  */
           xname = openpgp_oid_to_curve (openpgp_curve_to_oid (name, NULL, NULL),
                                         0);
           xfree (name);
 
           if (xname && !strcmp (xname, "nistp256"))
             mechanism = PIV_ALGORITHM_ECC_P256;
           else if (xname && !strcmp (xname, "nistp384"))
             mechanism = PIV_ALGORITHM_ECC_P384;
           else
             {
               err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
               goto leave;
             }
         }
       else if (tok && toklen == 1)
         {
           const unsigned char **mpi;
           size_t *mpi_len;
 
           switch (*tok)
             {
             case 'q': mpi = &ecc_q; mpi_len = &ecc_q_len; break;
             case 'd': mpi = &ecc_d; mpi_len = &ecc_d_len; break;
             default:  mpi = NULL;  mpi_len = NULL; break;
             }
           if (mpi && *mpi)
             {
               err = gpg_error (GPG_ERR_DUP_VALUE);
               goto leave;
             }
 
           if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
             goto leave;
           if (tok && mpi)
             {
               /* Strip off leading zero bytes and save. */
               for (;toklen && !*tok; toklen--, tok++)
                 ;
               *mpi = tok;
               *mpi_len = toklen;
             }
         }
       /* Skip until end of list. */
       last_depth2 = depth;
       while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
              && depth && depth >= last_depth2)
         ;
       if (err)
         goto leave;
     }
 
   /* Check that we have all parameters.  */
   if (!mechanism || !ecc_q || !ecc_d)
     {
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
 
   if (opt.verbose)
     log_info ("ECC private key size is %u bytes\n", (unsigned int)ecc_d_len);
 
   err = concat_tlv_list (1, &apdudata, &apdudatalen,
                          (int)0x06, (size_t)ecc_d_len, ecc_d,
                          (int)0, (size_t)0, NULL);
   if (err)
     goto leave;
 
   err = iso7816_send_apdu (app_get_slot (app),
                            -1,         /* Use command chaining.  */
                            0,          /* Class */
                            0xfe,       /* Ins: Yubikey Import Asym. Key.  */
                            mechanism,  /* P1 */
                            keyref,     /* P2 */
                            apdudatalen,/* Lc */
                            apdudata,   /* data */
                            NULL, NULL, NULL);
   if (err)
     goto leave;
 
   /* Write the public key to the cert object.  */
   xfree (apdudata);
   err = concat_tlv_list (0, &apdudata, &apdudatalen,
                          (int)0x86, (size_t)ecc_q_len, ecc_q,
                          (int)0, (size_t)0, NULL);
 
   if (err)
     goto leave;
   tmpl[0] = mechanism;
   err = put_data (app_get_slot (app), dobj->tag,
                   (int)0x80,   (size_t)1, tmpl,
                   (int)0x7f49, (size_t)apdudatalen, apdudata,
                   (int)0,      (size_t)0, NULL);
 
 
  leave:
   xfree (apdudata);
   return err;
 }
 
 
 /* Write a key to a slot.  This command requires proprietary
  * extensions of the PIV specification and is thus only implemnted for
  * supported card types.  The input is a canonical encoded
  * S-expression with the secret key in KEYDATA and its length (for
  * assertion) in KEYDATALEN.  KEYREFSTR needs to be the usual 2
  * hexdigit slot number prefixed with "PIV."  PINCB and PINCB_ARG are
  * not used for PIV cards.
  *
  * Supported FLAGS are:
  *   APP_WRITEKEY_FLAG_FORCE   Overwrite existing key.
  */
 static gpg_error_t
 do_writekey (app_t app, ctrl_t ctrl,
              const char *keyrefstr, unsigned int flags,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const unsigned char *keydata, size_t keydatalen)
 {
   gpg_error_t err;
   int force = !!(flags & APP_WRITEKEY_FLAG_FORCE);
   data_object_t dobj;
   int keyref;
   const unsigned char *buf, *tok;
   size_t buflen, toklen;
   int depth;
 
   (void)ctrl;
   (void)pincb;
   (void)pincb_arg;
 
   if (!app->app_local->flags.yubikey)
     {
       err = gpg_error (GPG_ERR_NOT_SUPPORTED);
       goto leave;
     }
 
   /* Check keyref and test whether a key already exists.  */
   dobj = find_dobj_by_keyref (app, keyrefstr);
   if ((keyref = keyref_from_dobj (dobj)) == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
   err = does_key_exist (app, dobj, 0, force);
   if (err)
     goto leave;
 
   /* Parse the S-expression with the key. */
   buf = keydata;
   buflen = keydatalen;
   depth = 0;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if (!tok || toklen != 11 || memcmp ("private-key", tok, toklen))
     {
       if (!tok)
         ;
       else if (toklen == 21 && !memcmp ("protected-private-key", tok, toklen))
         log_info ("protected-private-key passed to writekey\n");
       else if (toklen == 20 && !memcmp ("shadowed-private-key", tok, toklen))
         log_info ("shadowed-private-key passed to writekey\n");
       err = gpg_error (GPG_ERR_BAD_SECKEY);
       goto leave;
     }
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
   if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
     goto leave;
 
   /* First clear an existing key.  We do this by writing an empty 7f49
    * tag.  This will return GPG_ERR_NO_PUBKEY on a later read.  */
   flush_cached_data (app, dobj->tag);
   err = put_data (app_get_slot (app), dobj->tag,
                   (int)0x7f49, (size_t)0, "",
                   (int)0,      (size_t)0, NULL);
   if (err)
     {
       log_error ("piv: failed to clear the cert DO %s: %s\n",
                  dobj->keyref, gpg_strerror (err));
       goto leave;
     }
 
   /* Divert to the algo specific implementation.  */
   if (tok && toklen == 3 && memcmp ("rsa", tok, toklen) == 0)
     err = writekey_rsa (app, dobj, keyref, buf, buflen, depth);
   else if (tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0)
     err = writekey_ecc (app, dobj, keyref, buf, buflen, depth);
   else
     err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
 
   if (err)
     {
       /* A PIN is not required, thus use a better error code.  */
       if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
         err = gpg_error (GPG_ERR_NO_AUTH);
       log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
     }
 
  leave:
   return err;
 }
 
 
 /* Parse an RSA response object, consisting of the content of tag
  * 0x7f49, into a gcrypt s-expression object and store that R_SEXP.
  * On error NULL is stored at R_SEXP. */
 static gpg_error_t
 genkey_parse_rsa (const unsigned char *data, size_t datalen,
                   gcry_sexp_t *r_sexp)
 {
   gpg_error_t err;
   const unsigned char *m, *e;
   unsigned char *mbuf = NULL;
   unsigned char *ebuf = NULL;
   size_t mlen, elen;
 
   *r_sexp = NULL;
 
   m = find_tlv (data, datalen, 0x0081, &mlen);
   if (!m)
     {
       log_error (_("response does not contain the RSA modulus\n"));
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
 
   e = find_tlv (data, datalen, 0x0082, &elen);
   if (!e)
     {
       log_error (_("response does not contain the RSA public exponent\n"));
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
 
   for (; mlen && !*m; mlen--, m++) /* Strip leading zeroes */
     ;
   for (; elen && !*e; elen--, e++) /* Strip leading zeroes */
     ;
 
   mbuf = xtrymalloc (mlen + 1);
   if (!mbuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   /* Prepend numbers with a 0 if needed.  */
   if (mlen && (*m & 0x80))
     {
       *mbuf = 0;
       memcpy (mbuf+1, m, mlen);
       mlen++;
     }
   else
     memcpy (mbuf, m, mlen);
 
   ebuf = xtrymalloc (elen + 1);
   if (!ebuf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   /* Prepend numbers with a 0 if needed.  */
   if (elen && (*e & 0x80))
     {
       *ebuf = 0;
       memcpy (ebuf+1, e, elen);
       elen++;
     }
   else
     memcpy (ebuf, e, elen);
 
   err = gcry_sexp_build (r_sexp, NULL, "(public-key(rsa(n%b)(e%b)))",
                          (int)mlen, mbuf, (int)elen, ebuf);
 
  leave:
   xfree (mbuf);
   xfree (ebuf);
   return err;
 }
 
 
 /* Parse an ECC response object, consisting of the content of tag
  * 0x7f49, into a gcrypt s-expression object and store that R_SEXP.
  * On error NULL is stored at R_SEXP.  MECHANISM specifies the
  * curve.  */
 static gpg_error_t
 genkey_parse_ecc (const unsigned char *data, size_t datalen, int mechanism,
                   gcry_sexp_t *r_sexp)
 {
   gpg_error_t err;
   const unsigned char *ecc_q;
   size_t ecc_qlen;
   const char *curve;
 
   *r_sexp = NULL;
 
   ecc_q = find_tlv (data, datalen, 0x0086, &ecc_qlen);
   if (!ecc_q)
     {
       log_error (_("response does not contain the EC public key\n"));
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
 
   if (mechanism == PIV_ALGORITHM_ECC_P256)
     curve = "nistp256";
   else if (mechanism == PIV_ALGORITHM_ECC_P384)
     curve = "nistp384";
   else
     {
       err = gpg_error (GPG_ERR_BUG); /* Call with wrong parameters.  */
       goto leave;
     }
 
 
   err = gcry_sexp_build (r_sexp, NULL, "(public-key(ecc(curve%s)(q%b)))",
                          curve, (int)ecc_qlen, ecc_q);
 
  leave:
   return err;
 }
 
 
 /* Create a new keypair for KEYREF.  If KEYTYPE is NULL a default
  * keytype is selected, else it may be one of the strings:
  *  "rsa2048", "nistp256, or "nistp384".
  *
  * Supported FLAGS are:
  *   APP_GENKEY_FLAG_FORCE   Overwrite existing key.
  *
  * Note that CREATETIME is not used for PIV cards.
  *
  * Because there seems to be no way to read the public key we need to
  * retrieve it from a certificate.  The GnuPG system however requires
  * the use of app_readkey to fetch the public key from the card to
  * create the certificate; to support this we temporary store the
  * generated public key in the local context for use by app_readkey.
  */
 static gpg_error_t
 do_genkey (app_t app, ctrl_t ctrl, const char *keyrefstr, const char *keytype,
            unsigned int flags, time_t createtime,
            gpg_error_t (*pincb)(void*, const char *, char **),
            void *pincb_arg)
 {
   gpg_error_t err;
   data_object_t dobj;
   unsigned char *buffer = NULL;
   size_t buflen;
   int force = !!(flags & APP_GENKEY_FLAG_FORCE);
   int mechanism;
   time_t start_at;
   int keyref;
   unsigned char tmpl[5];
   size_t tmpllen;
   const unsigned char *keydata;
   size_t keydatalen;
 
   (void)ctrl;
   (void)createtime;
   (void)pincb;
   (void)pincb_arg;
 
   if (!keytype)
     keytype = "rsa2048";
 
   if (!strcmp (keytype, "rsa2048"))
     mechanism = PIV_ALGORITHM_RSA;
   else if (!strcmp (keytype, "nistp256"))
     mechanism = PIV_ALGORITHM_ECC_P256;
   else if (!strcmp (keytype, "nistp384"))
     mechanism = PIV_ALGORITHM_ECC_P384;
   else
     return gpg_error (GPG_ERR_UNKNOWN_CURVE);
 
   /* We flush the cache to increase the I/O traffic before a key
    * generation.  This _might_ help the card to gather more entropy
    * and is anyway a prerequisite for does_key_exist. */
   flush_cached_data (app, 0);
 
   /* Check whether a key already exists.  */
   dobj = find_dobj_by_keyref (app, keyrefstr);
   if ((keyref = keyref_from_dobj (dobj)) == -1)
     {
       err = gpg_error (GPG_ERR_INV_ID);
       goto leave;
     }
   err = does_key_exist (app, dobj, 1, force);
   if (err)
     goto leave;
 
 
   /* Create the key. */
   log_info (_("please wait while key is being generated ...\n"));
   start_at = time (NULL);
   tmpl[0] = 0xac;
   tmpl[1] = 3;
   tmpl[2] = 0x80;
   tmpl[3] = 1;
   tmpl[4] = mechanism;
   tmpllen = 5;
   err = iso7816_generate_keypair (app_get_slot (app), 0, 0, keyref,
                                   tmpl, tmpllen, 0, &buffer, &buflen);
   if (err)
     {
       /* A PIN is not required, thus use a better error code.  */
       if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
         err = gpg_error (GPG_ERR_NO_AUTH);
       log_error (_("generating key failed\n"));
       return err;
     }
 
   {
     int nsecs = (int)(time (NULL) - start_at);
     log_info (ngettext("key generation completed (%d second)\n",
                        "key generation completed (%d seconds)\n",
                        nsecs), nsecs);
   }
 
   /* Parse the result and store it as an s-expression in a dedicated
    * cache for later retrieval by app_readkey.  */
   keydata = find_tlv (buffer, buflen, 0x7F49, &keydatalen);
   if (!keydata || !keydatalen)
     {
       err = gpg_error (GPG_ERR_CARD);
       log_error (_("response does not contain the public key data\n"));
       goto leave;
     }
 
   tmpl[0] = mechanism;
   flush_cached_data (app, dobj->tag);
   err = put_data (app_get_slot (app), dobj->tag,
                   (int)0x80,   (size_t)1,          tmpl,
                   (int)0x7f49, (size_t)keydatalen, keydata,
                   (int)0,      (size_t)0,          NULL);
   if (err)
     {
       log_error ("piv: failed to write key to the cert DO %s: %s\n",
                  dobj->keyref, gpg_strerror (err));
       goto leave;
     }
 
  leave:
   xfree (buffer);
   return err;
 }
 
 
 
 /* Map some names to an OID.  */
 static const unsigned char *
 map_curve_name_to_oid (const unsigned char *name, size_t *namelenp)
 {
   if (*namelenp == 8 && !memcmp (name, "nistp256", 8))
     {
       *namelenp = 19;
       return "1.2.840.10045.3.1.7";
     }
   if (*namelenp == 8 && !memcmp (name, "nistp384", 8))
     {
       *namelenp = 12;
       return "1.3.132.0.34";
     }
   if (*namelenp == 8 && !memcmp (name, "nistp521", 8))
     {
       *namelenp = 12;
       return "1.3.132.0.35";
     }
   return name;
 }
 
 
 /* Communication object for my_cmp_public_key. */
 struct my_cmp_public_key_parm_s {
   int curve_seen;
 };
 
 /* Compare function used with cmp_canon_sexp.  */
 static int
 my_cmp_public_key (void *opaque, int depth,
                    const unsigned char *aval, size_t alen,
                    const unsigned char *bval, size_t blen)
 {
   struct my_cmp_public_key_parm_s *parm = opaque;
 
   (void)depth;
 
   if (parm->curve_seen)
     {
       /* Last token was "curve" - canonicalize its argument.  */
       parm->curve_seen = 0;
       aval = map_curve_name_to_oid (aval, &alen);
       bval = map_curve_name_to_oid (bval, &blen);
     }
   else if (alen == 5 && !memcmp (aval, "curve", 5))
     parm->curve_seen = 1;
   else
     parm->curve_seen = 0;
 
   if (alen > blen)
     return 1;
   else if (alen < blen)
     return -1;
   else
     return memcmp (aval, bval, alen);
 }
 
 
 /* Write the certificate (CERT,CERTLEN) to the card at CERTREFSTR.
  * CERTREFSTR is either the OID of the certificate's container data
  * object or of the form "PIV.<two_hexdigit_keyref>". */
 static gpg_error_t
 do_writecert (app_t app, ctrl_t ctrl,
               const char *certrefstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg,
               const unsigned char *cert, size_t certlen)
 {
   gpg_error_t err;
   data_object_t dobj;
   unsigned char *pk = NULL;
   unsigned char *orig_pk = NULL;
   size_t pklen, orig_pklen;
   struct my_cmp_public_key_parm_s cmp_parm = { 0 };
 
   (void)ctrl;
   (void)pincb;     /* Not used; instead authentication is needed.  */
   (void)pincb_arg;
 
   if (!certlen)
     return gpg_error (GPG_ERR_INV_CERT_OBJ);
 
   dobj = find_dobj_by_keyref (app, certrefstr);
   if (!dobj || !*dobj->keyref)
     return gpg_error (GPG_ERR_INV_ID);
 
   flush_cached_data (app, dobj->tag);
 
   /* Check that the public key parameters from the certificate match
    * an already stored key.  Note that we do not allow writing a
    * certificate if no key has yet been created (GPG_ERR_NOT_FOUND) or
    * if there is a problem reading the public key from the certificate
    * GPG_ERR_NO_PUBKEY).  We enforce this because otherwise the only
    * way to detect whether a key exists is by trying to use that
    * key. */
   err = do_readkey (app, ctrl, certrefstr, 0, &orig_pk, &orig_pklen);
   if (err)
     {
       if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
         err = gpg_error (GPG_ERR_NO_SECKEY); /* Use a better error code.  */
       goto leave;
     }
 
   /* Compare pubkeys.  */
   err = app_help_pubkey_from_cert (cert, certlen, &pk, &pklen);
   if (err)
     goto leave;  /* No public key in new certificate. */
   if (cmp_canon_sexp (orig_pk, orig_pklen, pk, pklen,
                       my_cmp_public_key, &cmp_parm))
     {
       err = gpg_error (GPG_ERR_CONFLICT);
       goto leave;
     }
 
   err = put_data (app_get_slot (app), dobj->tag,
                   (int)0x70, (size_t)certlen, cert,/* Certificate */
                   (int)0x71, (size_t)1,       "",  /* No compress */
                   (int)0xfe, (size_t)0,       "",  /* Empty LRC. */
                   (int)0,    (size_t)0,       NULL);
   /* A PIN is not required, thus use a better error code.  */
   if (gpg_err_code (err) == GPG_ERR_BAD_PIN)
     err = gpg_error (GPG_ERR_NO_AUTH);
   if (err)
     log_error ("piv: failed to write cert to %s: %s\n",
                dobj->keyref, gpg_strerror (err));
 
  leave:
   xfree (pk);
   xfree (orig_pk);
   return err;
 }
 
 
 /* Process the various keygrip based info requests.  */
 static gpg_error_t
 do_with_keygrip (app_t app, ctrl_t ctrl, int action,
                  const char *want_keygripstr, int capability)
 {
   gpg_error_t err;
   char *keygripstr = NULL;
   char *serialno = NULL;
   char idbuf[20];
   int data = 0;
   int i, tag, dummy_got_cert;
 
   /* First a quick check for valid parameters.  */
   switch (action)
     {
     case KEYGRIP_ACTION_LOOKUP:
       if (!want_keygripstr)
         {
           err = gpg_error (GPG_ERR_NOT_FOUND);
           goto leave;
         }
       break;
     case KEYGRIP_ACTION_SEND_DATA:
       data = 1;
       break;
     case KEYGRIP_ACTION_WRITE_STATUS:
       break;
     default:
       err = gpg_error (GPG_ERR_INV_ARG);
       goto leave;
     }
 
   /* Allocate the s/n string if needed.  */
   if (action != KEYGRIP_ACTION_LOOKUP)
     {
       serialno = app_get_serialno (app);
       if (!serialno)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
     }
 
   for (i = 0; (tag = data_objects[i].tag); i++)
     {
       if (!data_objects[i].keypair)
         continue;
 
       xfree (keygripstr);
       if (get_keygrip_by_tag (app, tag, &keygripstr, &dummy_got_cert))
         continue;
 
       if (action == KEYGRIP_ACTION_LOOKUP)
         {
           if (!strcmp (keygripstr, want_keygripstr))
             {
               err = 0; /* Found */
               goto leave;
             }
         }
       else if (!want_keygripstr || !strcmp (keygripstr, want_keygripstr))
         {
           if (capability == GCRY_PK_USAGE_SIGN)
             {
               if (strcmp (data_objects[i].keyref, "9C"))
                 continue;
             }
           if (capability == GCRY_PK_USAGE_ENCR)
             {
               if (strcmp (data_objects[i].keyref, "9D"))
                 continue;
             }
           if (capability == GCRY_PK_USAGE_AUTH)
             {
               if (strcmp (data_objects[i].keyref, "9A"))
                 continue;
             }
 
           snprintf (idbuf, sizeof idbuf, "PIV.%s", data_objects[i].keyref);
           send_keyinfo (ctrl, data, keygripstr, serialno, idbuf);
           if (want_keygripstr)
             {
               err = 0; /* Found */
               goto leave;
             }
         }
     }
 
   /* Return an error so that the dispatcher keeps on looping over the
    * other applications.  For clarity we use a different error code
    * when listing all keys.  Note that in lookup mode WANT_KEYGRIPSTR
    * is not NULL.  */
   if (!want_keygripstr)
     err = gpg_error (GPG_ERR_TRUE);
   else
     err = gpg_error (GPG_ERR_NOT_FOUND);
 
  leave:
   xfree (keygripstr);
   xfree (serialno);
   return err;
 }
 
 
 /* Prepare a reselect of another application.  This is used by cards
  * which support on-the-fly switching between applications.  The
  * function is called to give us a chance to save state for a future
  * reselect of us again.  */
 static gpg_error_t
 do_prep_reselect (app_t app, ctrl_t ctrl)
 {
   gpg_error_t err;
 
   (void)app;
   (void)ctrl;
 
   err = 0;
   return err;
 }
 
 
 /* Reselect the application.  This is used by cards which support
  * on-the-fly switching between applications.  */
 static gpg_error_t
 do_reselect (app_t app, ctrl_t ctrl)
 {
   gpg_error_t err;
 
   (void)ctrl;
 
   /* An extra check which should not be necessary because the caller
    * should have made sure that a re-select is only called for
    * appropriate cards.  */
   if (!app->app_local->flags.yubikey)
     return gpg_error (GPG_ERR_NOT_SUPPORTED);
 
   err = iso7816_select_application (app_get_slot (app),
                                     piv_aid, sizeof piv_aid, 0x0001);
   return err;
 }
 
 
 /* Select the PIV application on the card in SLOT.  This function must
  * be used before any other PIV application functions. */
 gpg_error_t
 app_select_piv (app_t app)
 {
   int slot = app_get_slot (app);
   gpg_error_t err;
   unsigned char *apt = NULL;
   size_t aptlen;
   const unsigned char *s;
   size_t n;
 
   /* Note that we select using the AID without the 2 octet version
    * number.  This allows for better reporting of future specs.  We
    * need to use the use-zero-for-P2-flag.  */
   err = iso7816_select_application_ext (slot, piv_aid, sizeof piv_aid, 0x0001,
                                         &apt, &aptlen);
   if (err)
     goto leave;
 
   app->apptype = APPTYPE_PIV;
   app->did_chv1 = 0;
   app->did_chv2 = 0;
   app->did_chv3 = 0;
   app->app_local = NULL;
 
   /* Check the Application Property Template.  */
   if (opt.verbose)
     {
       /* We  use a separate log_info to avoid the "DBG:" prefix.  */
       log_info ("piv: APT=");
       log_printhex (apt, aptlen, "");
     }
 
   s = find_tlv (apt, aptlen, 0x4F, &n);
   if (!s || n != 6 || memcmp (s, piv_aid+5, 4))
     {
       /* The PIX does not match.  */
       log_error ("piv: missing or invalid DO 0x4F in APT\n");
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
   if (s[4] != 1 || s[5] != 0)
     {
       log_error ("piv: unknown PIV version %u.%u\n", s[4], s[5]);
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
   app->appversion = ((s[4] << 8) | s[5]);
 
   s = find_tlv (apt, aptlen, 0x79, &n);
   if (!s || n < 7)
     {
       log_error ("piv: missing or invalid DO 0x79 in APT\n");
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
   s = find_tlv (s, n, 0x4F, &n);
   if (!s || n != 5 || memcmp (s, piv_aid, 5))
     {
       /* The RID does not match.  */
       log_error ("piv: missing or invalid DO 0x79.4F in APT\n");
       err = gpg_error (GPG_ERR_CARD);
       goto leave;
     }
 
   app->app_local = xtrycalloc (1, sizeof *app->app_local);
   if (!app->app_local)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   if (app->card->cardtype == CARDTYPE_YUBIKEY)
     app->app_local->flags.yubikey = 1;
 
 
   /* FIXME: Parse the optional and conditional DOs in the APT.  */
 
   if (opt.verbose)
     dump_all_do (slot);
 
   app->fnc.deinit = do_deinit;
   app->fnc.prep_reselect = do_prep_reselect;
   app->fnc.reselect = do_reselect;
   app->fnc.learn_status = do_learn_status;
   app->fnc.readcert = do_readcert;
   app->fnc.readkey = do_readkey;
   app->fnc.getattr = do_getattr;
   app->fnc.setattr = do_setattr;
   app->fnc.writecert = do_writecert;
   app->fnc.writekey = do_writekey;
   app->fnc.genkey = do_genkey;
   app->fnc.sign = do_sign;
   app->fnc.auth = do_auth;
   app->fnc.decipher = do_decipher;
   app->fnc.change_pin = do_change_chv;
   app->fnc.check_pin = do_check_chv;
   app->fnc.with_keygrip = do_with_keygrip;
 
 
 leave:
   xfree (apt);
   if (err)
     do_deinit (app);
   return err;
 }
diff --git a/scd/command.c b/scd/command.c
index e2d366d47..56d422a4a 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -1,2847 +1,2853 @@
 /* command.c - SCdaemon command handler
  * Copyright (C) 2001, 2002, 2003, 2004, 2005,
  *               2007, 2008, 2009, 2011  Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
 #include <unistd.h>
 #include <signal.h>
 #ifdef USE_NPTH
 # include <npth.h>
 #endif
 
 #include "scdaemon.h"
 #include <assuan.h>
 #include <ksba.h>
 #include "iso7816.h"
 #include "apdu.h" /* Required for apdu_*_reader (). */
 #include "atr.h"
 #ifdef HAVE_LIBUSB
 #include "ccid-driver.h"
 #endif
 #include "../common/asshelp.h"
 #include "../common/server-help.h"
 
 /* Maximum length allowed as a PIN; used for INQUIRE NEEDPIN.  That
  * length needs to small compared to the maximum Assuan line length.  */
 #define MAXLEN_PIN 100
 
 /* Maximum allowed size of key data as used in inquiries. */
 #define MAXLEN_KEYDATA 4096
 
 /* Maximum allowed total data size for SETDATA.  */
 #define MAXLEN_SETDATA 4096
 
 /* Maximum allowed size of certificate data as used in inquiries. */
 #define MAXLEN_CERTDATA 16384
 
 /* Maximum allowed size for "SETATTR --inquire". */
 #define MAXLEN_SETATTRDATA 16384
 
 
 #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))
 
 #define IS_LOCKED(c) (locked_session && locked_session != (c)->server_local)
 
 
 /* Data used to associate an Assuan context with local server data.
    This object describes the local properties of one session.  */
 struct server_local_s
 {
   /* We keep a list of all active sessions with the anchor at
      SESSION_LIST (see below).  This field is used for linking. */
   struct server_local_s *next_session;
 
   /* This object is usually assigned to a CTRL object (which is
      globally visible).  While enumerating all sessions we sometimes
      need to access data of the CTRL object; thus we keep a
      backpointer here. */
   ctrl_t ctrl_backlink;
 
   /* The Assuan context used by this session/server. */
   assuan_context_t assuan_ctx;
 
 #ifdef HAVE_W32_SYSTEM
   void *event_signal;           /* Or NULL if not used. */
 #else
   int event_signal;             /* Or 0 if not used. */
 #endif
 
   /* True if the card has been removed and a reset is required to
      continue operation. */
   unsigned int card_removed:1;
 
   /* If set to true we will be terminate ourself at the end of the
      this session.  */
   unsigned int stopme:1;
 
   /* If set to true, status change will be reported. */
   unsigned int watching_status:1;
 };
 
 
 /* To keep track of all running sessions, we link all active server
    contexts and the anchor in this variable.  */
 static struct server_local_s *session_list;
 
 /* If a session has been locked we store a link to its server object
    in this variable. */
 static struct server_local_s *locked_session;
 
 
 
 /*  Local prototypes.  */
 static int command_has_option (const char *cmd, const char *cmdopt);
 
 
 
 /* Convert the STRING into a newly allocated buffer while translating
    the hex numbers.  Stops at the first invalid character.  Blanks and
    colons are allowed to separate the hex digits.  Returns NULL on
    error or a newly malloced buffer and its length in LENGTH.  */
 static unsigned char *
 hex_to_buffer (const char *string, size_t *r_length)
 {
   unsigned char *buffer;
   const char *s;
   size_t n;
 
   buffer = xtrymalloc (strlen (string)+1);
   if (!buffer)
     return NULL;
   for (s=string, n=0; *s; s++)
     {
       if (spacep (s) || *s == ':')
         continue;
       if (hexdigitp (s) && hexdigitp (s+1))
         {
           buffer[n++] = xtoi_2 (s);
           s++;
         }
       else
         break;
     }
   *r_length = n;
   return buffer;
 }
 
 
 
 /* Reset the card and free the application context.  With SEND_RESET
    set to true actually send a RESET to the reader; this is the normal
    way of calling the function.  */
 static void
 do_reset (ctrl_t ctrl, int send_reset)
 {
   card_t card = ctrl->card_ctx;
 
   if (card)
     card_reset (card, ctrl, IS_LOCKED (ctrl)? 0: send_reset);
 
   /* If we hold a lock, unlock now. */
   if (locked_session && ctrl->server_local == locked_session)
     {
       locked_session = NULL;
       log_info ("implicitly unlocking due to RESET\n");
     }
 }
 
 
 
 static gpg_error_t
 reset_notify (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   (void) line;
 
   do_reset (ctrl, 1);
   return 0;
 }
 
 
 static gpg_error_t
 option_handler (assuan_context_t ctx, const char *key, const char *value)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   if (!strcmp (key, "event-signal"))
     {
       /* A value of 0 is allowed to reset the event signal. */
 #ifdef HAVE_W32_SYSTEM
       if (!*value)
         return gpg_error (GPG_ERR_ASS_PARAMETER);
 #ifdef _WIN64
       ctrl->server_local->event_signal = (void *)strtoull (value, NULL, 16);
 #else
       ctrl->server_local->event_signal = (void *)strtoul (value, NULL, 16);
 #endif
 #else
       int i = *value? atoi (value) : -1;
       if (i < 0)
         return gpg_error (GPG_ERR_ASS_PARAMETER);
       ctrl->server_local->event_signal = i;
 #endif
     }
 
  return 0;
 }
 
 
 /* If the card has not yet been opened, do it.  */
 static gpg_error_t
 open_card (ctrl_t ctrl)
 {
   /* If we ever got a card not present error code, return that.  Only
      the SERIALNO command and a reset are able to clear from that
      state. */
   if (ctrl->server_local->card_removed)
     return gpg_error (GPG_ERR_CARD_REMOVED);
 
   if ( IS_LOCKED (ctrl) )
     return gpg_error (GPG_ERR_LOCKED);
 
   if (ctrl->card_ctx)
     return 0;
 
   return select_application (ctrl, NULL, &ctrl->card_ctx, 0, NULL, 0);
 }
 
 /* Explicitly open a card for a specific use of APPTYPE or SERIALNO.
  * If OPT_ALL is set also add all possible additional apps. */
 static gpg_error_t
 open_card_with_request (ctrl_t ctrl,
                         const char *apptypestr, const char *serialno,
                         int opt_all)
 {
   gpg_error_t err;
   unsigned char *serialno_bin = NULL;
   size_t serialno_bin_len = 0;
   card_t card = ctrl->card_ctx;
 
   if (serialno)
     serialno_bin = hex_to_buffer (serialno, &serialno_bin_len);
 
   /* If we are already initialized for one specific application we
      need to check that the client didn't requested a specific
      application different from the one in use before we continue. */
   if (apptypestr && ctrl->card_ctx)
     {
       err = check_application_conflict (ctrl->card_ctx, apptypestr,
                                         serialno_bin, serialno_bin_len);
       if (gpg_err_code (err) == GPG_ERR_FALSE)
         {
           /* Different application but switching is supported.  */
           err = select_additional_application (ctrl, apptypestr);
         }
       goto leave;
     }
 
   /* Re-scan USB devices.  Release CARD, before the scan.  */
   /* FIXME: Is a card_unref sufficient or do we need to deallocate?  */
   ctrl->card_ctx = NULL;
   ctrl->current_apptype = APPTYPE_NONE;
   card_unref (card);
 
   err = select_application (ctrl, apptypestr, &ctrl->card_ctx, 1,
                             serialno_bin, serialno_bin_len);
   if (!err && opt_all)
     err = select_additional_application (ctrl, NULL);
 
  leave:
   xfree (serialno_bin);
   return err;
 }
 
 
 static const char hlp_serialno[] =
   "SERIALNO [--demand=<serialno>] [--all] [<apptype>]\n"
   "\n"
   "Return the serial number of the card using a status response.  This\n"
   "function should be used to check for the presence of a card.\n"
   "\n"
   "If --demand is given, an application on the card with SERIALNO is\n"
   "selected and an error is returned if no such card available.\n"
   "\n"
   "If --all is given, all possible other applications of the card are\n"
   "also selected to prepare for things like \"LEARN --force --multi\".\n"
   "\n"
   "If APPTYPE is given, an application of that type is selected and an\n"
   "error is returned if the application is not supported or available.\n"
   "The default is to auto-select the application using a hardwired\n"
   "preference system.\n"
   "\n"
   "This function is special in that it can be used to reset the card.\n"
   "Most other functions will return an error when a card change has\n"
   "been detected and the use of this function is therefore required.\n"
   "\n"
   "Background: We want to keep the client clear of handling card\n"
   "changes between operations; i.e. the client can assume that all\n"
   "operations are done on the same card unless he calls this function.";
 static gpg_error_t
 cmd_serialno (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   struct server_local_s *sl;
   int rc = 0;
   char *serial;
   const char *demand;
   int opt_all = has_option (line, "--all");
   int thisslot;
 
   if ( IS_LOCKED (ctrl) )
     return gpg_error (GPG_ERR_LOCKED);
 
   if ((demand = has_option_name (line, "--demand")))
     {
       if (*demand != '=')
         return set_error (GPG_ERR_ASS_PARAMETER, "missing value for option");
       line = (char *)++demand;
       for (; *line && !spacep (line); line++)
         ;
       if (*line)
         *line++ = 0;
     }
   else
     demand = NULL;
 
   line = skip_options (line);
 
   /* Clear the remove flag so that the open_card is able to reread it.  */
   ctrl->server_local->card_removed = 0;
   rc = open_card_with_request (ctrl, *line? line:NULL, demand, opt_all);
   /* Now clear or set the card_removed flag for all sessions using the
    * current slot.  In the error case make sure that the flag is set
    * for the current session. */
   thisslot = ctrl->card_ctx? ctrl->card_ctx->slot : -1;
   for (sl=session_list; sl; sl = sl->next_session)
     {
       ctrl_t c = sl->ctrl_backlink;
       if (c && c->card_ctx && c->card_ctx->slot == thisslot)
         c->server_local->card_removed = rc? 1 : 0;
     }
   if (rc)
     {
       ctrl->server_local->card_removed = 1;
       return rc;
     }
 
   serial = card_get_serialno (ctrl->card_ctx);
   if (!serial)
     return gpg_error (GPG_ERR_INV_VALUE);
 
   rc = assuan_write_status (ctx, "SERIALNO", serial);
   xfree (serial);
   return rc;
 }
 
 
 
 static const char hlp_switchcard[] =
   "SWITCHCARD [<serialno>]\n"
   "\n"
   "Make the card with SERIALNO the current card.\n"
   "The command \"getinfo card_list\" can be used to list\n"
   "the serial numbers of inserted and known cards.  Note\n"
   "that the command \"SERIALNO\" can be used to refresh\n"
   "the list of known cards.  A simple SERIALNO status\n"
   "is printed on success.";
 static gpg_error_t
 cmd_switchcard (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   unsigned char *sn_bin = NULL;
   size_t sn_bin_len = 0;
 
   if ((err = open_card (ctrl)))
     return err;
 
   line = skip_options (line);
 
   if (*line)
     {
       sn_bin = hex_to_buffer (line, &sn_bin_len);
       if (!sn_bin)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
     }
 
   /* Note that an SN_BIN of NULL will only print the status.  */
   err = app_switch_current_card (ctrl, sn_bin, sn_bin_len);
 
  leave:
   xfree (sn_bin);
   return err;
 }
 
 
 static const char hlp_switchapp[] =
   "SWITCHAPP [<appname>]\n"
   "\n"
   "Make APPNAME the active application for the current card.\n"
   "Only some cards support switching between application; the\n"
   "command \"getinfo active_app\" can be used to get a list of\n"
   "applications which can be switched to.  A SERIALNO status\n"
   "including the active appname is printed on success.";
 static gpg_error_t
 cmd_switchapp (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
 
   if ((err = open_card (ctrl)))
     return err;
 
   line = skip_options (line);
   return app_switch_active_app (ctrl->card_ctx, ctrl, line);
 }
 
 
 static const char hlp_learn[] =
   "LEARN [--force] [--keypairinfo] [--multi]\n"
   "\n"
   "Learn all useful information of the currently inserted card.  When\n"
   "used without the force options, the command might do an INQUIRE\n"
   "like this:\n"
   "\n"
   "   INQUIRE KNOWNCARDP <hexstring_with_serialNumber>\n"
   "\n"
   "The client should just send an \"END\" if the processing should go on\n"
   "or a \"CANCEL\" to force the function to terminate with a Cancel\n"
   "error message.\n"
   "\n"
-  "With the option --keypairinfo only KEYPARIINFO status lines are\n"
+  "With the option --keypairinfo only KEYPAIRINFO status lines are\n"
   "returned.\n"
   "\n"
   "The response of this command is a list of status lines formatted as\n"
   "this:\n"
   "\n"
   "  S APPTYPE <apptype>\n"
   "\n"
   "This returns the type of the application, currently the strings:\n"
   "\n"
   "    P15     = PKCS-15 structure used\n"
   "    DINSIG  = DIN SIG\n"
   "    OPENPGP = OpenPGP card\n"
   "    PIV     = PIV card\n"
   "    NKS     = NetKey card\n"
   "\n"
   "are implemented.  These strings are aliases for the AID.  With option\n"
   "--multi information for all switchable apps are returned.\n"
   "\n"
   "  S KEYPAIRINFO <hexstring_with_keygrip> <hexstring_with_id> [<usage>]\n"
   "\n"
   "If there is no certificate yet stored on the card a single 'X' is\n"
   "returned as the keygrip.  For more info see doc/DETAILS.  In addition\n"
   "to the keypair info, information about all certificates stored on the\n"
   "card is also returned:\n"
   "\n"
   "  S CERTINFO <certtype> <hexstring_with_id>\n"
   "\n"
   "Where CERTTYPE is a number indicating the type of certificate:\n"
   "   0   := Unknown\n"
   "   100 := Regular X.509 cert\n"
   "   101 := Trusted X.509 cert\n"
   "   102 := Useful X.509 cert\n"
   "   110 := Root CA cert in a special format (e.g. DINSIG)\n"
   "   111 := Root CA cert as standard X509 cert.\n"
   "\n"
   "For certain cards, more information will be returned:\n"
   "\n"
   "  S KEY-FPR <no> <hexstring>\n"
   "\n"
   "For OpenPGP cards this returns the stored fingerprints of the\n"
   "keys. This can be used check whether a key is available on the\n"
   "card.  NO may be 1, 2 or 3.\n"
   "\n"
   "  S CA-FPR <no> <hexstring>\n"
   "\n"
   "Similar to above, these are the fingerprints of keys assumed to be\n"
   "ultimately trusted.\n"
   "\n"
   "  S DISP-NAME <name_of_card_holder>\n"
   "\n"
   "The name of the card holder as stored on the card; percent\n"
   "escaping takes place, spaces are encoded as '+'\n"
   "\n"
   "  S PUBKEY-URL <url>\n"
   "\n"
   "The URL to be used for locating the entire public key.\n"
   "  \n"
   "Note, that this function may even be used on a locked card.";
 static gpg_error_t
 cmd_learn (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc = 0;
   int only_keypairinfo = has_option (line, "--keypairinfo");
   int opt_multi = has_option (line, "--multi");
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   /* Unless the force option is used we try a shortcut by identifying
      the card using a serial number and inquiring the client with
      that. The client may choose to cancel the operation if he already
      knows about this card */
   if (!only_keypairinfo)
     {
       const char *reader;
       char *serial;
       card_t card = ctrl->card_ctx;
 
       if (!card)
         return gpg_error (GPG_ERR_CARD_NOT_PRESENT);
 
       reader = apdu_get_reader_name (card->slot);
       if (!reader)
         return out_of_core ();
       send_status_direct (ctrl, "READER", reader);
       /* No need to free the string of READER.  */
 
       serial = card_get_serialno (ctrl->card_ctx);
       if (!serial)
         return gpg_error (GPG_ERR_INV_VALUE);
 
       rc = assuan_write_status (ctx, "SERIALNO", serial);
       if (rc < 0)
         {
           xfree (serial);
           return out_of_core ();
         }
 
       if (!has_option (line, "--force"))
         {
           char *command;
 
           rc = gpgrt_asprintf (&command, "KNOWNCARDP %s", serial);
           if (rc < 0)
             {
               xfree (serial);
               return out_of_core ();
             }
           rc = assuan_inquire (ctx, command, NULL, NULL, 0);
           xfree (command);
           if (rc)
             {
               if (gpg_err_code (rc) != GPG_ERR_ASS_CANCELED)
                 log_error ("inquire KNOWNCARDP failed: %s\n",
                            gpg_strerror (rc));
               xfree (serial);
               return rc;
             }
           /* Not canceled, so we have to proceed.  */
         }
       xfree (serial);
     }
 
   /* Let the application print out its collection of useful status
      information. */
   if (!rc)
     rc = app_write_learn_status
       (ctrl->card_ctx, ctrl,
        ( (only_keypairinfo? APP_LEARN_FLAG_KEYPAIRINFO : 0)
          | (opt_multi? APP_LEARN_FLAG_MULTI : 0)) );
 
   return rc;
 }
 
 
 
 static const char hlp_readcert[] =
   "READCERT <hexified_certid>|<keyid>|<oid>\n"
   "\n"
   "Note, that this function may even be used on a locked card.";
 static gpg_error_t
 cmd_readcert (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   unsigned char *cert;
   size_t ncert;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   line = xtrystrdup (line); /* Need a copy of the line. */
   if (!line)
     return gpg_error_from_syserror ();
 
   rc = app_readcert (ctrl->card_ctx, ctrl, line, &cert, &ncert);
   if (rc)
     log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
   xfree (line);
   line = NULL;
   if (!rc)
     {
       rc = assuan_send_data (ctx, cert, ncert);
       xfree (cert);
       if (rc)
         return rc;
     }
 
   return rc;
 }
 
 
 static gpg_error_t
 do_readkey (card_t card, ctrl_t ctrl, const char *line,
             int opt_info, int opt_nokey,
             unsigned char **pk_p, size_t *pklen_p)
 {
   int rc;
 
   /* If the application supports the READKEY function we use that.
      Otherwise we use the old way by extracting it from the
      certificate.  */
   rc = app_readkey (card, ctrl, line,
                     opt_info? APP_READKEY_FLAG_INFO : 0,
                     opt_nokey? NULL : pk_p, pklen_p);
   if (!rc)
     /* Okay, got that key.  */
     return 0;
 
   if (gpg_err_code (rc) == GPG_ERR_UNSUPPORTED_OPERATION
       || gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
     {
       unsigned char *cert = NULL;
       size_t ncert;
 
       /* Fall back to certificate reading.  */
       rc = app_readcert (card, ctrl, line, &cert, &ncert);
       if (rc)
         {
           log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
           return rc;
         }
 
       rc = app_help_pubkey_from_cert (cert, ncert, pk_p, pklen_p);
       xfree (cert);
       if (rc)
         {
           log_error ("failed to parse the certificate: %s\n",
                      gpg_strerror (rc));
           return rc;
         }
 
       if (opt_info)
         {
           char keygripstr[KEYGRIP_LEN*2+1];
+          char *algostr;
 
           rc = app_help_get_keygrip_string_pk (*pk_p, *pklen_p,
-                                               keygripstr, NULL, NULL);
+                                               keygripstr, NULL, NULL,
+                                               &algostr);
           if (rc)
             {
               log_error ("app_help_get_keygrip_string failed: %s\n",
                          gpg_strerror (rc));
               return rc;
             }
 
           /* FIXME: Using LINE is not correct because it might be an
            * OID and has not been canonicalized (i.e. uppercased).  */
           send_status_info (ctrl, "KEYPAIRINFO",
                             keygripstr, strlen (keygripstr),
                             line, strlen (line),
+                            "-", (size_t)1,
+                            "-", (size_t)1,
+                            algostr, strlen (algostr),
                             NULL, (size_t)0);
+          xfree (algostr);
         }
     }
   else
     log_error ("app_readkey failed: %s\n", gpg_strerror (rc));
 
   return rc;
 }
 
 static const char hlp_readkey[] =
   "READKEY [--advanced] [--info[-only]] <keyid>|<oid>|<keygrip>\n"
   "\n"
   "Return the public key for the given cert or key ID as a standard\n"
   "S-expression.  With --advanced  the S-expression is returned in\n"
   "advanced format.  With --info a KEYPAIRINFO status line is also\n"
   "emitted; with --info-only the regular output is suppressed.";
 static gpg_error_t
 cmd_readkey (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   int advanced = 0;
   int opt_info = 0;
   int opt_nokey = 0;
   unsigned char *pk = NULL;
   size_t pklen;
   card_t card;
   int direct = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (has_option (line, "--advanced"))
     advanced = 1;
   if (has_option (line, "--info"))
     opt_info = 1;
   if (has_option (line, "--info-only"))
     opt_info = opt_nokey = 1;
 
   line = skip_options (line);
 
   line = xtrystrdup (line); /* Need a copy of the line. */
   if (!line)
     return gpg_error_from_syserror ();
 
   if (strlen (line) == 40)
     {
       card = app_do_with_keygrip (ctrl, KEYGRIP_ACTION_LOOKUP, line, 0);
       direct = 1;
     }
   else
     card = ctrl->card_ctx;
 
   if (card)
     {
       if (direct)
         card_ref (card);
 
       rc = do_readkey (card, ctrl, line, opt_info, opt_nokey, &pk, &pklen);
 
       if (direct)
         card_unref (card);
     }
   else
     rc = gpg_error (GPG_ERR_NO_SECKEY);
 
   if (opt_nokey)
     ;
   else if (advanced)
     {
       gcry_sexp_t s_key;
       unsigned char *pkadv;
       size_t pkadvlen;
 
       rc = gcry_sexp_new (&s_key, pk, pklen, 0);
       if (rc)
         goto leave;
 
       pkadvlen = gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, NULL, 0);
       pkadv = xtrymalloc (pkadvlen);
       if (!pkadv)
         {
           rc = gpg_error_from_syserror ();
           goto leave;
         }
       log_assert (pkadvlen);
 
       gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, pkadv, pkadvlen);
       gcry_sexp_release (s_key);
       /* (One less to adjust for the trailing '\0') */
       rc = assuan_send_data (ctx, pkadv, pkadvlen-1);
       xfree (pkadv);
     }
   else
     rc = assuan_send_data (ctx, pk, pklen);
 
  leave:
   xfree (pk);
   xfree (line);
   return rc;
 }
 
 
 
 static const char hlp_setdata[] =
   "SETDATA [--append] <hexstring>\n"
   "\n"
   "The client should use this command to tell us the data he want to sign.\n"
   "With the option --append, the data is appended to the data set by a\n"
   "previous SETDATA command.";
 static gpg_error_t
 cmd_setdata (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int append;
   int n, i, off;
   char *p;
   unsigned char *buf;
 
   append = (ctrl->in_data.value && has_option (line, "--append"));
 
   line = skip_options (line);
 
   if (locked_session && locked_session != ctrl->server_local)
     return gpg_error (GPG_ERR_LOCKED);
 
   /* Parse the hexstring. */
   for (p=line,n=0; hexdigitp (p); p++, n++)
     ;
   if (*p)
     return set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring");
   if (!n)
     return set_error (GPG_ERR_ASS_PARAMETER, "no data given");
   if ((n&1))
     return set_error (GPG_ERR_ASS_PARAMETER, "odd number of digits");
   n /= 2;
   if (append)
     {
       if (ctrl->in_data.valuelen + n > MAXLEN_SETDATA)
         return set_error (GPG_ERR_TOO_LARGE,
                           "limit on total size of data reached");
       buf = xtrymalloc (ctrl->in_data.valuelen + n);
     }
   else
     buf = xtrymalloc (n);
   if (!buf)
     return out_of_core ();
 
   if (append)
     {
       memcpy (buf, ctrl->in_data.value, ctrl->in_data.valuelen);
       off = ctrl->in_data.valuelen;
     }
   else
     off = 0;
   for (p=line, i=0; i < n; p += 2, i++)
     buf[off+i] = xtoi_2 (p);
 
   xfree (ctrl->in_data.value);
   ctrl->in_data.value = buf;
   ctrl->in_data.valuelen = off+n;
   return 0;
 }
 
 
 
 static gpg_error_t
 pin_cb (void *opaque, const char *info, char **retstr)
 {
   assuan_context_t ctx = opaque;
   char *command;
   int rc;
   unsigned char *value;
   size_t valuelen;
 
   if (!retstr)
     {
       /* We prompt for pinpad entry.  To make sure that the popup has
          been show we use an inquire and not just a status message.
          We ignore any value returned.  */
       if (info)
         {
           log_debug ("prompting for pinpad entry '%s'\n", info);
           rc = gpgrt_asprintf (&command, "POPUPPINPADPROMPT %s", info);
           if (rc < 0)
             return gpg_error (gpg_err_code_from_errno (errno));
           rc = assuan_inquire (ctx, command, &value, &valuelen, MAXLEN_PIN);
           xfree (command);
         }
       else
         {
           log_debug ("dismiss pinpad entry prompt\n");
           rc = assuan_inquire (ctx, "DISMISSPINPADPROMPT",
                                &value, &valuelen, MAXLEN_PIN);
         }
       if (!rc)
         xfree (value);
       return rc;
     }
 
   *retstr = NULL;
   log_debug ("asking for PIN '%s'\n", info);
 
   rc = gpgrt_asprintf (&command, "NEEDPIN %s", info);
   if (rc < 0)
     return gpg_error (gpg_err_code_from_errno (errno));
 
   /* Fixme: Write an inquire function which returns the result in
      secure memory and check all further handling of the PIN. */
   rc = assuan_inquire (ctx, command, &value, &valuelen, MAXLEN_PIN);
   xfree (command);
   if (rc)
     return rc;
 
   if (!valuelen || value[valuelen-1])
     {
       /* We require that the returned value is an UTF-8 string */
       xfree (value);
       return gpg_error (GPG_ERR_INV_RESPONSE);
     }
   *retstr = (char*)value;
   return 0;
 }
 
 
 static const char hlp_pksign[] =
   "PKSIGN [--hash=[rmd160|sha{1,224,256,384,512}|md5|none]] <hexified_id>\n"
   "\n"
   "The --hash option is optional; the default is SHA1.";
 static gpg_error_t
 cmd_pksign (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   unsigned char *outdata;
   size_t outdatalen;
   char *keyidstr;
   int hash_algo;
   card_t card;
   int direct = 0;
 
   if (has_option (line, "--hash=rmd160"))
     hash_algo = GCRY_MD_RMD160;
   else if (has_option (line, "--hash=sha1"))
     hash_algo = GCRY_MD_SHA1;
   else if (has_option (line, "--hash=sha224"))
     hash_algo = GCRY_MD_SHA224;
   else if (has_option (line, "--hash=sha256"))
     hash_algo = GCRY_MD_SHA256;
   else if (has_option (line, "--hash=sha384"))
     hash_algo = GCRY_MD_SHA384;
   else if (has_option (line, "--hash=sha512"))
     hash_algo = GCRY_MD_SHA512;
   else if (has_option (line, "--hash=md5"))
     hash_algo = GCRY_MD_MD5;
   else if (has_option (line, "--hash=none"))  /* For raw RSA.  */
     hash_algo = 0;
   else if (!strstr (line, "--"))
     hash_algo = GCRY_MD_SHA1;
   else
     return set_error (GPG_ERR_ASS_PARAMETER, "invalid hash algorithm");
 
   line = skip_options (line);
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   /* We have to use a copy of the key ID because the function may use
      the pin_cb which in turn uses the assuan line buffer and thus
      overwriting the original line with the keyid */
   keyidstr = xtrystrdup (line);
   if (!keyidstr)
     return out_of_core ();
 
   /* When it's a keygrip, we directly use the card, with no change of
      ctrl->card_ctx. */
   if (strlen (keyidstr) == 40)
     {
       card = app_do_with_keygrip (ctrl, KEYGRIP_ACTION_LOOKUP, keyidstr, 0);
       direct = 1;
     }
   else
     card = ctrl->card_ctx;
 
   if (card)
     {
       if (direct)
         card_ref (card);
       rc = app_sign (card, ctrl,
                      keyidstr, hash_algo,
                      pin_cb, ctx,
                      ctrl->in_data.value, ctrl->in_data.valuelen,
                      &outdata, &outdatalen);
       if (direct)
         card_unref (card);
     }
   else
     rc = gpg_error (GPG_ERR_NO_SECKEY);
 
   xfree (keyidstr);
   if (rc)
     {
       log_error ("app_sign failed: %s\n", gpg_strerror (rc));
     }
   else
     {
       rc = assuan_send_data (ctx, outdata, outdatalen);
       xfree (outdata);
       if (rc)
         return rc; /* that is already an assuan error code */
     }
 
   return rc;
 }
 
 
 static const char hlp_pkauth[] =
   "PKAUTH <hexified_id>";
 static gpg_error_t
 cmd_pkauth (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   unsigned char *outdata;
   size_t outdatalen;
   char *keyidstr;
   card_t card;
   int direct = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
  /* We have to use a copy of the key ID because the function may use
      the pin_cb which in turn uses the assuan line buffer and thus
      overwriting the original line with the keyid */
   keyidstr = xtrystrdup (line);
   if (!keyidstr)
     return out_of_core ();
 
   /* When it's a keygrip, we directly use CARD, with no change of
      ctrl->card_ctx. */
   if (strlen (keyidstr) == 40)
     {
       card = app_do_with_keygrip (ctrl, KEYGRIP_ACTION_LOOKUP, keyidstr, 0);
       direct = 1;
     }
   else
     card = ctrl->card_ctx;
 
   if (card)
     {
       if (direct)
         card_ref (card);
       rc = app_auth (card, ctrl, keyidstr, pin_cb, ctx,
                      ctrl->in_data.value, ctrl->in_data.valuelen,
                      &outdata, &outdatalen);
       if (direct)
         card_unref (card);
     }
   else
     rc = gpg_error (GPG_ERR_NO_SECKEY);
 
   xfree (keyidstr);
   if (rc)
     {
       log_error ("app_auth failed: %s\n", gpg_strerror (rc));
     }
   else
     {
       rc = assuan_send_data (ctx, outdata, outdatalen);
       xfree (outdata);
       if (rc)
         return rc; /* that is already an assuan error code */
     }
 
   return rc;
 }
 
 
 static const char hlp_pkdecrypt[] =
   "PKDECRYPT <hexified_id>";
 static gpg_error_t
 cmd_pkdecrypt (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   unsigned char *outdata;
   size_t outdatalen;
   char *keyidstr;
   unsigned int infoflags;
   card_t card;
   int direct = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   keyidstr = xtrystrdup (line);
   if (!keyidstr)
     return out_of_core ();
 
   /* When it's a keygrip, we directly use CARD, with no change of
      ctrl->card_ctx. */
   if (strlen (keyidstr) == 40)
     {
       card = app_do_with_keygrip (ctrl, KEYGRIP_ACTION_LOOKUP, keyidstr, 0);
       direct = 1;
     }
   else
     card = ctrl->card_ctx;
 
   if (card)
     {
       if (direct)
         card_ref (card);
       rc = app_decipher (card, ctrl, keyidstr, pin_cb, ctx,
                          ctrl->in_data.value, ctrl->in_data.valuelen,
                          &outdata, &outdatalen, &infoflags);
       if (direct)
         card_unref (card);
     }
   else
     rc = gpg_error (GPG_ERR_NO_SECKEY);
 
   xfree (keyidstr);
   if (rc)
     {
       log_error ("app_decipher failed: %s\n", gpg_strerror (rc));
     }
   else
     {
       /* If the card driver told us that there is no padding, send a
          status line.  If there is a padding it is assumed that the
          caller knows what padding is used.  It would have been better
          to always send that information but for backward
          compatibility we can't do that.  */
       if ((infoflags & APP_DECIPHER_INFO_NOPAD))
         send_status_direct (ctrl, "PADDING", "0");
       rc = assuan_send_data (ctx, outdata, outdatalen);
       xfree (outdata);
       if (rc)
         return rc; /* that is already an assuan error code */
     }
 
   return rc;
 }
 
 
 static const char hlp_getattr[] =
   "GETATTR <name> [<keygrip>]\n"
   "\n"
   "This command is used to retrieve data from a smartcard.  The\n"
   "allowed names depend on the currently selected smartcard\n"
   "application.  NAME must be percent and '+' escaped.  The value is\n"
   "returned through status message, see the LEARN command for details.\n"
   "\n"
   "However, the current implementation assumes that Name is not escaped;\n"
   "this works as long as no one uses arbitrary escaping. \n"
   "\n"
   "Note, that this function may even be used on a locked card.\n"
   "When KEYGRIP is specified, it accesses directly with the KEYGRIP.";
 static gpg_error_t
 cmd_getattr (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   const char *keyword;
   card_t card;
   int direct = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   keyword = line;
   for (; *line && !spacep (line); line++)
     ;
   if (*line)
     *line++ = 0;
 
   if (strlen (line) == 40)
     {
       card = app_do_with_keygrip (ctrl, KEYGRIP_ACTION_LOOKUP, line, 0);
       direct = 1;
     }
   else
     card = ctrl->card_ctx;
 
   if (card)
     {
       if (direct)
         card_ref (card);
 
       /* FIXME: Applications should not return sensitive data if the card
          is locked.  */
       rc = app_getattr (card, ctrl, keyword);
 
       if (direct)
         card_unref (card);
     }
   else
     rc = gpg_error (GPG_ERR_NO_SECKEY);
 
   return rc;
 }
 
 
 static const char hlp_setattr[] =
   "SETATTR [--inquire] <name> <value> \n"
   "\n"
   "This command is used to store data on a smartcard.  The allowed\n"
   "names and values are depend on the currently selected smartcard\n"
   "application.  NAME and VALUE must be percent and '+' escaped.\n"
   "\n"
   "However, the current implementation assumes that NAME is not\n"
   "escaped; this works as long as no one uses arbitrary escaping.\n"
   "\n"
   "If the option --inquire is used, VALUE shall not be given; instead\n"
   "an inquiry using the keyword \"VALUE\" is used to retrieve it.  The\n"
   "value is in this case considered to be confidential and not logged.\n"
   "\n"
   "A PIN will be requested for most NAMEs.  See the corresponding\n"
   "setattr function of the actually used application (app-*.c) for\n"
   "details.";
 static gpg_error_t
 cmd_setattr (assuan_context_t ctx, char *orig_line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err;
   char *keyword;
   int keywordlen;
   size_t nbytes;
   char *line, *linebuf;
   int opt_inquire;
 
   opt_inquire = has_option (orig_line, "--inquire");
   orig_line = skip_options (orig_line);
 
   if ((err = open_card (ctrl)))
     return err;
 
   /* We need to use a copy of LINE, because PIN_CB uses the same
      context and thus reuses the Assuan provided LINE. */
   line = linebuf = xtrystrdup (orig_line);
   if (!line)
     return out_of_core ();
 
   keyword = line;
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
     ;
   if (*line)
       *line++ = 0;
   while (spacep (line))
     line++;
   if (opt_inquire)
     {
       unsigned char *value;
 
       assuan_begin_confidential (ctx);
       err = assuan_inquire (ctx, "VALUE", &value, &nbytes, MAXLEN_SETATTRDATA);
       assuan_end_confidential (ctx);
       if (!err)
         {
           err = app_setattr (ctrl->card_ctx, ctrl, keyword, pin_cb, ctx,
                              value, nbytes);
           wipememory (value, nbytes);
           xfree (value);
         }
 
    }
   else
     {
       nbytes = percent_plus_unescape_inplace (line, 0);
       err = app_setattr (ctrl->card_ctx, ctrl, keyword, pin_cb, ctx,
                          (const unsigned char*)line, nbytes);
     }
 
   xfree (linebuf);
   return err;
 }
 
 
 static const char hlp_writecert[] =
   "WRITECERT <hexified_certid>\n"
   "\n"
   "This command is used to store a certificate on a smartcard.  The\n"
   "allowed certids depend on the currently selected smartcard\n"
   "application. The actual certifciate is requested using the inquiry\n"
   "\"CERTDATA\" and needs to be provided in its raw (e.g. DER) form.\n"
   "\n"
   "In almost all cases a PIN will be requested.  See the related\n"
   "writecert function of the actually used application (app-*.c) for\n"
   "details.";
 static gpg_error_t
 cmd_writecert (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   char *certid;
   unsigned char *certdata;
   size_t certdatalen;
 
   line = skip_options (line);
 
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER, "no certid given");
   certid = line;
   while (*line && !spacep (line))
     line++;
   *line = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   certid = xtrystrdup (certid);
   if (!certid)
     return out_of_core ();
 
   /* Now get the actual keydata. */
   rc = assuan_inquire (ctx, "CERTDATA",
                        &certdata, &certdatalen, MAXLEN_CERTDATA);
   if (rc)
     {
       xfree (certid);
       return rc;
     }
 
   /* Write the certificate to the card. */
   rc = app_writecert (ctrl->card_ctx, ctrl, certid,
                       pin_cb, ctx, certdata, certdatalen);
   xfree (certid);
   xfree (certdata);
 
   return rc;
 }
 
 
 static const char hlp_writekey[] =
   "WRITEKEY [--force] <keyid> \n"
   "\n"
   "This command is used to store a secret key on a smartcard.  The\n"
   "allowed keyids depend on the currently selected smartcard\n"
   "application. The actual keydata is requested using the inquiry\n"
   "\"KEYDATA\" and need to be provided without any protection.  With\n"
   "--force set an existing key under this KEYID will get overwritten.\n"
   "The keydata is expected to be the usual canonical encoded\n"
   "S-expression.\n"
   "\n"
   "A PIN will be requested for most NAMEs.  See the corresponding\n"
   "writekey function of the actually used application (app-*.c) for\n"
   "details.";
 static gpg_error_t
 cmd_writekey (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   char *keyid;
   int force = has_option (line, "--force");
   unsigned char *keydata;
   size_t keydatalen;
 
   line = skip_options (line);
 
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER, "no keyid given");
   keyid = line;
   while (*line && !spacep (line))
     line++;
   *line = 0;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   keyid = xtrystrdup (keyid);
   if (!keyid)
     return out_of_core ();
 
   /* Now get the actual keydata. */
   assuan_begin_confidential (ctx);
   rc = assuan_inquire (ctx, "KEYDATA", &keydata, &keydatalen, MAXLEN_KEYDATA);
   assuan_end_confidential (ctx);
   if (rc)
     {
       xfree (keyid);
       return rc;
     }
 
   /* Write the key to the card. */
   rc = app_writekey (ctrl->card_ctx, ctrl, keyid, force? 1:0,
                      pin_cb, ctx, keydata, keydatalen);
   xfree (keyid);
   xfree (keydata);
 
   return rc;
 }
 
 
 static const char hlp_genkey[] =
   "GENKEY [--force] [--timestamp=<isodate>] [--algo=ALGO] <keyref>\n"
   "\n"
   "Generate a key on-card identified by <keyref>, which is application\n"
   "specific.  Return values are also application specific.  For OpenPGP\n"
   "cards 3 status lines are returned:\n"
   "\n"
   "  S KEY-FPR  <hexstring>\n"
   "  S KEY-CREATED-AT <seconds_since_epoch>\n"
   "  S KEY-DATA [-|p|n] <hexdata>\n"
   "\n"
   "  'p' and 'n' are the names of the RSA parameters; '-' is used to\n"
   "  indicate that HEXDATA is the first chunk of a parameter given\n"
   "  by the next KEY-DATA.  Only used by GnuPG version < 2.1.\n"
   "\n"
   "--force is required to overwrite an already existing key.  The\n"
   "KEY-CREATED-AT is required for further processing because it is\n"
   "part of the hashed key material for the fingerprint.\n"
   "\n"
   "If --timestamp is given an OpenPGP key will be created using this\n"
   "value.  The value needs to be in ISO Format; e.g.\n"
   "\"--timestamp=20030316T120000\" and after 1970-01-01 00:00:00.\n"
   "\n"
   "The option --algo can be used to request creation using a specific\n"
   "algorithm.  The possible algorithms are card dependent.\n"
   "\n"
   "The public part of the key can also later be retrieved using the\n"
   "READKEY command.";
 static gpg_error_t
 cmd_genkey (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err;
   char *keyref_buffer = NULL;
   char *keyref;
   int force;
   const char *s;
   char *opt_algo = NULL;
   time_t timestamp;
 
   force = has_option (line, "--force");
 
   if ((s=has_option_name (line, "--timestamp")))
     {
       if (*s != '=')
         return set_error (GPG_ERR_ASS_PARAMETER, "missing value for option");
       timestamp = isotime2epoch (s+1);
       if (timestamp < 1)
         return set_error (GPG_ERR_ASS_PARAMETER, "invalid time value");
     }
   else
     timestamp = 0;
 
   err = get_option_value (line, "--algo", &opt_algo);
   if (err)
     goto leave;
 
   line = skip_options (line);
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER, "no key number given");
   keyref = line;
   while (*line && !spacep (line))
     line++;
   *line = 0;
 
   if ((err = open_card (ctrl)))
     goto leave;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   keyref = keyref_buffer = xtrystrdup (keyref);
   if (!keyref)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   err = app_genkey (ctrl->card_ctx, ctrl, keyref, opt_algo,
                     force? APP_GENKEY_FLAG_FORCE : 0,
                     timestamp, pin_cb, ctx);
 
  leave:
   xfree (keyref_buffer);
   xfree (opt_algo);
   return err;
 }
 
 
 static const char hlp_random[] =
   "RANDOM <nbytes>\n"
   "\n"
   "Get NBYTES of random from the card and send them back as data.\n"
   "This usually involves EEPROM write on the card and thus excessive\n"
   "use of this command may destroy the card.\n"
   "\n"
   "Note, that this function may be even be used on a locked card.";
 static gpg_error_t
 cmd_random (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   size_t nbytes;
   unsigned char *buffer;
 
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER,
                       "number of requested bytes missing");
   nbytes = strtoul (line, NULL, 0);
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   buffer = xtrymalloc (nbytes);
   if (!buffer)
     return out_of_core ();
 
   rc = app_get_challenge (ctrl->card_ctx, ctrl, nbytes, buffer);
   if (!rc)
     {
       rc = assuan_send_data (ctx, buffer, nbytes);
       xfree (buffer);
       return rc; /* that is already an assuan error code */
     }
   xfree (buffer);
 
   return rc;
 }
 
 
 
 static const char hlp_passwd[] =
   "PASSWD [--reset] [--nullpin] [--clear] <chvno>\n"
   "\n"
   "Change the PIN or, if --reset is given, reset the retry counter of\n"
   "the card holder verification vector CHVNO.  The option --nullpin is\n"
   "used for TCOS cards to set the initial PIN.  The option --clear clears\n"
   "the security status associated with the PIN so that the PIN needs to\n"
   "be presented again. The format of CHVNO depends on the card application.";
 static gpg_error_t
 cmd_passwd (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   char *chvnostr;
   unsigned int flags = 0;
 
   if (has_option (line, "--reset"))
     flags |= APP_CHANGE_FLAG_RESET;
   if (has_option (line, "--nullpin"))
     flags |= APP_CHANGE_FLAG_NULLPIN;
   if (has_option (line, "--clear"))
     flags |= APP_CHANGE_FLAG_CLEAR;
 
   line = skip_options (line);
 
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER, "no CHV number given");
   chvnostr = line;
   while (*line && !spacep (line))
     line++;
   *line = 0;
 
   /* Do not allow other flags aside of --clear. */
   if ((flags & APP_CHANGE_FLAG_CLEAR) && (flags & ~APP_CHANGE_FLAG_CLEAR))
     return set_error (GPG_ERR_UNSUPPORTED_OPERATION,
                       "--clear used with other options");
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   chvnostr = xtrystrdup (chvnostr);
   if (!chvnostr)
     return out_of_core ();
   rc = app_change_pin (ctrl->card_ctx, ctrl, chvnostr, flags, pin_cb, ctx);
   if (rc)
     log_error ("command passwd failed: %s\n", gpg_strerror (rc));
   xfree (chvnostr);
 
   return rc;
 }
 
 
 static const char hlp_checkpin[] =
   "CHECKPIN <idstr>\n"
   "\n"
   "Perform a VERIFY operation without doing anything else.  This may\n"
   "be used to initialize a the PIN cache earlier to long lasting\n"
   "operations.  Its use is highly application dependent.\n"
   "\n"
   "For OpenPGP:\n"
   "\n"
   "   Perform a simple verify operation for CHV1 and CHV2, so that\n"
   "   further operations won't ask for CHV2 and it is possible to do a\n"
   "   cheap check on the PIN: If there is something wrong with the PIN\n"
   "   entry system, only the regular CHV will get blocked and not the\n"
   "   dangerous CHV3.  IDSTR is the usual card's serial number in hex\n"
   "   notation; an optional fingerprint part will get ignored.  There\n"
   "   is however a special mode if the IDSTR is suffixed with the\n"
   "   literal string \"[CHV3]\": In this case the Admin PIN is checked\n"
   "   if and only if the retry counter is still at 3.\n"
   "\n"
   "For Netkey:\n"
   "\n"
   "   Any of the valid PIN Ids may be used.  These are the strings:\n"
   "\n"
   "     PW1.CH       - Global password 1\n"
   "     PW2.CH       - Global password 2\n"
   "     PW1.CH.SIG   - SigG password 1\n"
   "     PW2.CH.SIG   - SigG password 2\n"
   "\n"
   "   For a definitive list, see the implementation in app-nks.c.\n"
   "   Note that we call a PW2.* PIN a \"PUK\" despite that since TCOS\n"
   "   3.0 they are technically alternative PINs used to mutally\n"
   "   unblock each other.";
 static gpg_error_t
 cmd_checkpin (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc;
   char *idstr;
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   /* We have to use a copy of the key ID because the function may use
      the pin_cb which in turn uses the assuan line buffer and thus
      overwriting the original line with the keyid. */
   idstr = xtrystrdup (line);
   if (!idstr)
     return out_of_core ();
 
   rc = app_check_pin (ctrl->card_ctx, ctrl, idstr, pin_cb, ctx);
   xfree (idstr);
   if (rc)
     log_error ("app_check_pin failed: %s\n", gpg_strerror (rc));
 
   return rc;
 }
 
 
 static const char hlp_lock[] =
   "LOCK [--wait]\n"
   "\n"
   "Grant exclusive card access to this session.  Note that there is\n"
   "no lock counter used and a second lock from the same session will\n"
   "be ignored.  A single unlock (or RESET) unlocks the session.\n"
   "Return GPG_ERR_LOCKED if another session has locked the reader.\n"
   "\n"
   "If the option --wait is given the command will wait until a\n"
   "lock has been released.";
 static gpg_error_t
 cmd_lock (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc = 0;
 
  retry:
   if (locked_session)
     {
       if (locked_session != ctrl->server_local)
         rc = gpg_error (GPG_ERR_LOCKED);
     }
   else
     locked_session = ctrl->server_local;
 
 #ifdef USE_NPTH
   if (rc && has_option (line, "--wait"))
     {
       rc = 0;
       npth_sleep (1); /* Better implement an event mechanism. However,
                          for card operations this should be
                          sufficient. */
       /* FIXME: Need to check that the connection is still alive.
          This can be done by issuing status messages. */
       goto retry;
     }
 #endif /*USE_NPTH*/
 
   if (rc)
     log_error ("cmd_lock failed: %s\n", gpg_strerror (rc));
   return rc;
 }
 
 
 static const char hlp_unlock[] =
   "UNLOCK\n"
   "\n"
   "Release exclusive card access.";
 static gpg_error_t
 cmd_unlock (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   int rc = 0;
 
   (void)line;
 
   if (locked_session)
     {
       if (locked_session != ctrl->server_local)
         rc = gpg_error (GPG_ERR_LOCKED);
       else
         locked_session = NULL;
     }
   else
     rc = gpg_error (GPG_ERR_NOT_LOCKED);
 
   if (rc)
     log_error ("cmd_unlock failed: %s\n", gpg_strerror (rc));
   return rc;
 }
 
 
 static const char hlp_getinfo[] =
   "GETINFO <what>\n"
   "\n"
   "Multi purpose command to return certain information.  \n"
   "Supported values of WHAT are:\n"
   "\n"
   "  version     - Return the version of the program.\n"
   "  pid         - Return the process id of the server.\n"
   "  socket_name - Return the name of the socket.\n"
   "  connections - Return number of active connections.\n"
   "  status      - Return the status of the current reader (in the future,\n"
   "                may also return the status of all readers).  The status\n"
   "                is a list of one-character flags.  The following flags\n"
   "                are currently defined:\n"
   "                  'u'  Usable card present.\n"
   "                  'r'  Card removed.  A reset is necessary.\n"
   "                These flags are exclusive.\n"
   "  reader_list - Return a list of detected card readers.  Does\n"
   "                currently only work with the internal CCID driver.\n"
   "  deny_admin  - Returns OK if admin commands are not allowed or\n"
   "                GPG_ERR_GENERAL if admin commands are allowed.\n"
   "  app_list    - Return a list of supported applications.  One\n"
   "                application per line, fields delimited by colons,\n"
   "                first field is the name.\n"
   "  card_list   - Return a list of serial numbers of all inserted cards.\n"
   "  active_apps - Return a list of active apps on the current card.\n"
   "  all_active_apps\n"
   "              - Return a list of active apps on all inserted cards.\n"
   "  cmd_has_option CMD OPT\n"
   "               - Returns OK if command CMD has option OPT.\n";
 static gpg_error_t
 cmd_getinfo (assuan_context_t ctx, char *line)
 {
   int rc = 0;
 
   if (!strcmp (line, "version"))
     {
       const char *s = VERSION;
       rc = assuan_send_data (ctx, s, strlen (s));
     }
   else if (!strcmp (line, "pid"))
     {
       char numbuf[50];
 
       snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
       rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
     }
   else if (!strncmp (line, "cmd_has_option", 14)
            && (line[14] == ' ' || line[14] == '\t' || !line[14]))
     {
       char *cmd, *cmdopt;
       line += 14;
       while (*line == ' ' || *line == '\t')
         line++;
       if (!*line)
         rc = gpg_error (GPG_ERR_MISSING_VALUE);
       else
         {
           cmd = line;
           while (*line && (*line != ' ' && *line != '\t'))
             line++;
           if (!*line)
             rc = gpg_error (GPG_ERR_MISSING_VALUE);
           else
             {
               *line++ = 0;
               while (*line == ' ' || *line == '\t')
                 line++;
               if (!*line)
                 rc = gpg_error (GPG_ERR_MISSING_VALUE);
               else
                 {
                   cmdopt = line;
                   if (!command_has_option (cmd, cmdopt))
                     rc = gpg_error (GPG_ERR_FALSE);
                 }
             }
         }
     }
   else if (!strcmp (line, "socket_name"))
     {
       const char *s = scd_get_socket_name ();
 
       if (s)
         rc = assuan_send_data (ctx, s, strlen (s));
       else
         rc = gpg_error (GPG_ERR_NO_DATA);
     }
   else if (!strcmp (line, "connections"))
     {
       char numbuf[20];
 
       snprintf (numbuf, sizeof numbuf, "%d", get_active_connection_count ());
       rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
     }
   else if (!strcmp (line, "status"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
       char flag;
 
       if (open_card (ctrl))
         flag = 'r';
       else
         flag = 'u';
 
       rc = assuan_send_data (ctx, &flag, 1);
     }
   else if (!strcmp (line, "reader_list"))
     {
 #ifdef HAVE_LIBUSB
       char *s = ccid_get_reader_list ();
 #else
       char *s = NULL;
 #endif
 
       if (s)
         rc = assuan_send_data (ctx, s, strlen (s));
       else
         rc = gpg_error (GPG_ERR_NO_DATA);
       xfree (s);
     }
   else if (!strcmp (line, "deny_admin"))
     rc = opt.allow_admin? gpg_error (GPG_ERR_GENERAL) : 0;
   else if (!strcmp (line, "app_list"))
     {
       char *s = get_supported_applications ();
       if (s)
         rc = assuan_send_data (ctx, s, strlen (s));
       else
         rc = 0;
       xfree (s);
     }
   else if (!strcmp (line, "card_list"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
 
       rc = app_send_card_list (ctrl);
     }
   else if (!strcmp (line, "active_apps"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
       if (!ctrl->card_ctx)
         rc = 0; /* No current card - no active apps.  */
       else
         rc = app_send_active_apps (ctrl->card_ctx, ctrl);
     }
   else if (!strcmp (line, "all_active_apps"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
       rc = app_send_active_apps (NULL, ctrl);
     }
   else
     rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
   return rc;
 }
 
 
 static const char hlp_restart[] =
   "RESTART\n"
   "\n"
   "Restart the current connection; this is a kind of warm reset.  It\n"
   "deletes the context used by this connection but does not send a\n"
   "RESET to the card.  Thus the card itself won't get reset. \n"
   "\n"
   "This is used by gpg-agent to reuse a primary pipe connection and\n"
   "may be used by clients to backup from a conflict in the serial\n"
   "command; i.e. to select another application.";
 static gpg_error_t
 cmd_restart (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   card_t card = ctrl->card_ctx;
 
   (void)line;
 
   if (card)
     {
       ctrl->card_ctx = NULL;
       ctrl->current_apptype = APPTYPE_NONE;
       card_unref (card);
     }
   if (locked_session && ctrl->server_local == locked_session)
     {
       locked_session = NULL;
       log_info ("implicitly unlocking due to RESTART\n");
     }
   return 0;
 }
 
 
 static const char hlp_disconnect[] =
   "DISCONNECT\n"
   "\n"
   "Disconnect the card if the backend supports a disconnect operation.";
 static gpg_error_t
 cmd_disconnect (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   (void)line;
 
   if (!ctrl->card_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
   apdu_disconnect (ctrl->card_ctx->slot);
   return 0;
 }
 
 
 
 static const char hlp_apdu[] =
   "APDU [--[dump-]atr] [--more] [--exlen[=N]] [hexstring]\n"
   "\n"
   "Send an APDU to the current reader.  This command bypasses the high\n"
   "level functions and sends the data directly to the card.  HEXSTRING\n"
   "is expected to be a proper APDU.  If HEXSTRING is not given no\n"
   "commands are set to the card but the command will implicitly check\n"
   "whether the card is ready for use. \n"
   "\n"
   "Using the option \"--atr\" returns the ATR of the card as a status\n"
   "message before any data like this:\n"
   "  S CARD-ATR 3BFA1300FF813180450031C173C00100009000B1\n"
   "\n"
   "Using the option --more handles the card status word MORE_DATA\n"
   "(61xx) and concatenates all responses to one block.\n"
   "\n"
   "Using the option \"--exlen\" the returned APDU may use extended\n"
   "length up to N bytes.  If N is not given a default value is used\n"
   "(currently 4096).";
 static gpg_error_t
 cmd_apdu (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   card_t card;
   int rc;
   unsigned char *apdu;
   size_t apdulen;
   int with_atr;
   int handle_more;
   const char *s;
   size_t exlen;
 
   if (has_option (line, "--dump-atr"))
     with_atr = 3;
   else if (has_option (line, "--data-atr"))
     with_atr = 2;
   else
     with_atr = has_option (line, "--atr");
   handle_more = has_option (line, "--more");
 
   if ((s=has_option_name (line, "--exlen")))
     {
       if (*s == '=')
         exlen = strtoul (s+1, NULL, 0);
       else
         exlen = 4096;
     }
   else
     exlen = 0;
 
   line = skip_options (line);
 
   if ((rc = open_card (ctrl)))
     return rc;
 
   card = ctrl->card_ctx;
   if (!card)
     return gpg_error (GPG_ERR_CARD_NOT_PRESENT);
 
   if (with_atr)
     {
       unsigned char *atr;
       size_t atrlen;
       char hexbuf[400];
 
       atr = apdu_get_atr (card->slot, &atrlen);
       if (!atr || atrlen > sizeof hexbuf - 2 )
         {
           rc = gpg_error (GPG_ERR_INV_CARD);
           goto leave;
         }
       if (with_atr == 3)
         {
           char *string, *p, *pend;
 
           string = atr_dump (atr, atrlen);
           if (string)
             {
               for (rc=0, p=string; !rc && (pend = strchr (p, '\n')); p = pend+1)
                 {
                   rc = assuan_send_data (ctx, p, pend - p + 1);
                   if (!rc)
                     rc = assuan_send_data (ctx, NULL, 0);
                 }
               if (!rc && *p)
                 rc = assuan_send_data (ctx, p, strlen (p));
               es_free (string);
               if (rc)
                 {
                   xfree (atr);
                   goto leave;
                 }
             }
         }
       else if (with_atr == 2)
         {
           rc = assuan_send_data (ctx, atr, atrlen);
           if (rc)
             {
               xfree (atr);
               goto leave;
             }
         }
       else
         {
           bin2hex (atr, atrlen, hexbuf);
           send_status_info (ctrl, "CARD-ATR", hexbuf, strlen (hexbuf), NULL, 0);
         }
       xfree (atr);
     }
 
   apdu = hex_to_buffer (line, &apdulen);
   if (!apdu)
     {
       rc = gpg_error_from_syserror ();
       goto leave;
     }
   if (apdulen)
     {
       unsigned char *result = NULL;
       size_t resultlen;
 
       rc = apdu_send_direct (card->slot, exlen,
                              apdu, apdulen, handle_more,
                              NULL, &result, &resultlen);
       if (rc)
         log_error ("apdu_send_direct failed: %s\n", gpg_strerror (rc));
       else
         {
           rc = assuan_send_data (ctx, result, resultlen);
           xfree (result);
         }
     }
   xfree (apdu);
 
  leave:
   return rc;
 }
 
 
 static const char hlp_killscd[] =
   "KILLSCD\n"
   "\n"
   "Commit suicide.";
 static gpg_error_t
 cmd_killscd (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   (void)line;
 
   ctrl->server_local->stopme = 1;
   assuan_set_flag (ctx, ASSUAN_FORCE_CLOSE, 1);
   return 0;
 }
 
 
 static const char hlp_keyinfo[] =
   "KEYINFO [--list[=auth|encr|sign]] [--data] <keygrip>\n"
   "\n"
   "Return information about the key specified by the KEYGRIP.  If the\n"
   "key is not available GPG_ERR_NOT_FOUND is returned.  If the option\n"
   "--list is given the keygrip is ignored and information about all\n"
   "available keys are returned.  Capability may limit the listing.\n"
   "Unless --data is given, the\n"
   "information is returned as a status line using the format:\n"
   "\n"
   "  KEYINFO <keygrip> T <serialno> <idstr>\n"
   "\n"
   "KEYGRIP is the keygrip.\n"
   "\n"
   "SERIALNO is an ASCII string with the serial number of the\n"
   "         smartcard.  If the serial number is not known a single\n"
   "         dash '-' is used instead.\n"
   "\n"
   "IDSTR is the IDSTR used to distinguish keys on a smartcard.  If it\n"
   "      is not known a dash is used instead.\n"
   "\n"
   "More information may be added in the future.";
 static gpg_error_t
 cmd_keyinfo (assuan_context_t ctx, char *line)
 {
   int cap;
   int opt_data;
   int action;
   char *keygrip_str;
   ctrl_t ctrl = assuan_get_pointer (ctx);
   card_t card;
 
   cap = 0;
   keygrip_str = NULL;
   if (has_option (line, "--list"))
     cap = 0;
   else if (has_option (line, "--list=sign"))
     cap = GCRY_PK_USAGE_SIGN;
   else if (has_option (line, "--list=encr"))
     cap = GCRY_PK_USAGE_ENCR;
   else if (has_option (line, "--list=auth"))
     cap = GCRY_PK_USAGE_AUTH;
   else
     keygrip_str = line;
 
   opt_data = has_option (line, "--data");
   line = skip_options (line);
 
   if (opt_data)
     action = KEYGRIP_ACTION_SEND_DATA;
   else
     action = KEYGRIP_ACTION_WRITE_STATUS;
 
   card = app_do_with_keygrip (ctrl, action, keygrip_str, cap);
 
   if (keygrip_str && !card)
     return gpg_error (GPG_ERR_NOT_FOUND);
   return 0;
 }
 
 
 /* Send a keyinfo string as used by the KEYGRIP_ACTION_SEND_DATA.  If
  * DATA is true the string is emitted as a data line, else as a status
  * line.  */
 void
 send_keyinfo (ctrl_t ctrl, int data, const char *keygrip_str,
               const char *serialno, const char *idstr)
 {
   char *string;
   assuan_context_t ctx = ctrl->server_local->assuan_ctx;
 
   string = xtryasprintf ("%s T %s %s%s", keygrip_str,
                          serialno? serialno : "-",
                          idstr? idstr : "-",
                          data? "\n" : "");
 
   if (!string)
     return;
 
   if (!data)
     assuan_write_status (ctx, "KEYINFO", string);
   else
     assuan_send_data (ctx, string, strlen (string));
 
   xfree (string);
   return;
 }
 
 
 static const char hlp_devinfo[] =
   "DEVINFO [--watch]\n"
   "\n"
   "Return information about devices.  If the option --watch is given,\n"
   "it keeps reporting status change until it detects no device is\n"
   "available."
   "The information is returned as a status line using the format:\n"
   "\n"
   "  DEVICE <card_type> <serialno> <app_type>\n"
   "\n"
   "CARD_TYPE is the type of the card.\n"
   "\n"
   "SERIALNO is an ASCII string with the serial number of the\n"
   "         smartcard.  If the serial number is not known a single\n"
   "         dash '-' is used instead.\n"
   "\n"
   "APP_TYPE is the type of the application.\n"
   "\n"
   "More information may be added in the future.";
 static gpg_error_t
 cmd_devinfo (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   int watch = 0;
 
   if (has_option (line, "--watch"))
     {
       watch = 1;
       ctrl->server_local->watching_status = 1;
     }
 
   /* Firstly, send information of available devices.  */
   err = app_send_devinfo (ctrl);
 
   /* If not watching, that's all.  */
   if (!watch)
     return err;
 
   if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND)
     return err;
 
   /* Secondly, try to open device(s) available.  */
 
   /* Clear the remove flag so that the open_card is able to reread it.  */
   if (ctrl->server_local->card_removed)
     ctrl->server_local->card_removed = 0;
 
   if ((err = open_card (ctrl))
       && gpg_err_code (err) != GPG_ERR_ENODEV)
     return err;
 
   err = 0;
 
   /* Remove reference(s) to the card.  */
   ctrl->card_ctx = NULL;
   ctrl->current_apptype = APPTYPE_NONE;
   card_unref (ctrl->card_ctx);
 
   /* Then, keep watching the status change.  */
   while (!err)
     {
       app_wait ();
 
       /* Send information of available devices.  */
       err = app_send_devinfo (ctrl);
     }
 
   ctrl->server_local->watching_status = 0;
   return 0;
 }
 
 /* Return true if the command CMD implements the option OPT.  */
 static int
 command_has_option (const char *cmd, const char *cmdopt)
 {
   if (!strcmp (cmd, "SERIALNO"))
     {
       if (!strcmp (cmdopt, "all"))
         return 1;
     }
 
   return 0;
 }
 
 
 /* Tell the assuan library about our commands */
 static int
 register_commands (assuan_context_t ctx)
 {
   static struct {
     const char *name;
     assuan_handler_t handler;
     const char * const help;
   } table[] = {
     { "SERIALNO",     cmd_serialno, hlp_serialno },
     { "SWITCHCARD",   cmd_switchcard,hlp_switchcard },
     { "SWITCHAPP",    cmd_switchapp,hlp_switchapp },
     { "LEARN",        cmd_learn,    hlp_learn },
     { "READCERT",     cmd_readcert, hlp_readcert },
     { "READKEY",      cmd_readkey,  hlp_readkey },
     { "SETDATA",      cmd_setdata,  hlp_setdata },
     { "PKSIGN",       cmd_pksign,   hlp_pksign },
     { "PKAUTH",       cmd_pkauth,   hlp_pkauth },
     { "PKDECRYPT",    cmd_pkdecrypt,hlp_pkdecrypt },
     { "INPUT",        NULL },
     { "OUTPUT",       NULL },
     { "GETATTR",      cmd_getattr,  hlp_getattr },
     { "SETATTR",      cmd_setattr,  hlp_setattr },
     { "WRITECERT",    cmd_writecert,hlp_writecert },
     { "WRITEKEY",     cmd_writekey, hlp_writekey },
     { "GENKEY",       cmd_genkey,   hlp_genkey },
     { "RANDOM",       cmd_random,   hlp_random },
     { "PASSWD",       cmd_passwd,   hlp_passwd },
     { "CHECKPIN",     cmd_checkpin, hlp_checkpin },
     { "LOCK",         cmd_lock,     hlp_lock },
     { "UNLOCK",       cmd_unlock,   hlp_unlock },
     { "GETINFO",      cmd_getinfo,  hlp_getinfo },
     { "RESTART",      cmd_restart,  hlp_restart },
     { "DISCONNECT",   cmd_disconnect,hlp_disconnect },
     { "APDU",         cmd_apdu,     hlp_apdu },
     { "KILLSCD",      cmd_killscd,  hlp_killscd },
     { "KEYINFO",      cmd_keyinfo,  hlp_keyinfo },
     { "DEVINFO",      cmd_devinfo,  hlp_devinfo },
     { NULL }
   };
   int i, rc;
 
   for (i=0; table[i].name; i++)
     {
       rc = assuan_register_command (ctx, table[i].name, table[i].handler,
                                     table[i].help);
       if (rc)
         return rc;
     }
   assuan_set_hello_line (ctx, "GNU Privacy Guard's Smartcard server ready");
 
   assuan_register_reset_notify (ctx, reset_notify);
   assuan_register_option_handler (ctx, option_handler);
   return 0;
 }
 
 
 /* Startup the server.  If FD is given as -1 this is simple pipe
    server, otherwise it is a regular server.  Returns true if there
    are no more active asessions.  */
 int
 scd_command_handler (ctrl_t ctrl, int fd)
 {
   int rc;
   assuan_context_t ctx = NULL;
   int stopme;
 
   rc = assuan_new (&ctx);
   if (rc)
     {
       log_error ("failed to allocate assuan context: %s\n",
                  gpg_strerror (rc));
       scd_exit (2);
     }
 
   if (fd == -1)
     {
       assuan_fd_t filedes[2];
 
       filedes[0] = assuan_fdopen (0);
       filedes[1] = assuan_fdopen (1);
       rc = assuan_init_pipe_server (ctx, filedes);
     }
   else
     {
       rc = assuan_init_socket_server (ctx, INT2FD(fd),
                                       ASSUAN_SOCKET_SERVER_ACCEPTED);
     }
   if (rc)
     {
       log_error ("failed to initialize the server: %s\n",
                  gpg_strerror(rc));
       scd_exit (2);
     }
   rc = register_commands (ctx);
   if (rc)
     {
       log_error ("failed to register commands with Assuan: %s\n",
                  gpg_strerror(rc));
       scd_exit (2);
     }
   assuan_set_pointer (ctx, ctrl);
 
   /* Allocate and initialize the server object.  Put it into the list
      of active sessions. */
   ctrl->server_local = xcalloc (1, sizeof *ctrl->server_local);
   ctrl->server_local->next_session = session_list;
   session_list = ctrl->server_local;
   ctrl->server_local->ctrl_backlink = ctrl;
   ctrl->server_local->assuan_ctx = ctx;
 
   /* Command processing loop. */
   for (;;)
     {
       rc = assuan_accept (ctx);
       if (rc == -1)
         {
           break;
         }
       else if (rc)
         {
           log_info ("Assuan accept problem: %s\n", gpg_strerror (rc));
           break;
         }
 
       rc = assuan_process (ctx);
       if (rc)
         {
           log_info ("Assuan processing failed: %s\n", gpg_strerror (rc));
           continue;
         }
     }
 
   /* Cleanup.  We don't send an explicit reset to the card.  */
   do_reset (ctrl, 0);
 
   /* Release the server object.  */
   if (session_list == ctrl->server_local)
     session_list = ctrl->server_local->next_session;
   else
     {
       struct server_local_s *sl;
 
       for (sl=session_list; sl->next_session; sl = sl->next_session)
         if (sl->next_session == ctrl->server_local)
           break;
       if (!sl->next_session)
           BUG ();
       sl->next_session = ctrl->server_local->next_session;
     }
   stopme = ctrl->server_local->stopme;
   xfree (ctrl->server_local);
   ctrl->server_local = NULL;
 
   /* Release the Assuan context.  */
   assuan_release (ctx);
 
   if (stopme)
     scd_exit (0);
 
   /* If there are no more sessions return true.  */
   return !session_list;
 }
 
 
 /* Send a line with status information via assuan and escape all given
    buffers. The variable elements are pairs of (char *, size_t),
    terminated with a (NULL, 0). */
 void
 send_status_info (ctrl_t ctrl, const char *keyword, ...)
 {
   va_list arg_ptr;
   const unsigned char *value;
   size_t valuelen;
   char buf[950], *p;
   size_t n;
   assuan_context_t ctx = ctrl->server_local->assuan_ctx;
 
   va_start (arg_ptr, keyword);
 
   p = buf;
   n = 0;
   while ( (value = va_arg (arg_ptr, const unsigned char *))
            && n < DIM (buf)-2 )
     {
       valuelen = va_arg (arg_ptr, size_t);
       if (!valuelen)
         continue; /* empty buffer */
       if (n)
         {
           *p++ = ' ';
           n++;
         }
       for ( ; valuelen && n < DIM (buf)-2; n++, valuelen--, value++)
         {
           if (*value == '+' || *value == '\"' || *value == '%'
               || *value < ' ')
             {
               sprintf (p, "%%%02X", *value);
               p += 3;
               n += 2;
             }
           else if (*value == ' ')
             *p++ = '+';
           else
             *p++ = *value;
         }
     }
   *p = 0;
   assuan_write_status (ctx, keyword, buf);
 
   va_end (arg_ptr);
 }
 
 
 /* Send a ready formatted status line via assuan.  */
 void
 send_status_direct (ctrl_t ctrl, const char *keyword, const char *args)
 {
   assuan_context_t ctx = ctrl->server_local->assuan_ctx;
 
   if (strchr (args, '\n'))
     log_error ("error: LF detected in status line - not sending\n");
   else
     assuan_write_status (ctx, keyword, args);
 }
 
 
 /* This status functions expects a printf style format string.  No
  * filtering of the data is done instead the printf formatted data is
  * send using assuan_send_status. */
 gpg_error_t
 send_status_printf (ctrl_t ctrl, const char *keyword, const char *format, ...)
 {
   gpg_error_t err;
   va_list arg_ptr;
   assuan_context_t ctx;
 
   if (!ctrl || !ctrl->server_local || !(ctx = ctrl->server_local->assuan_ctx))
     return 0;
 
   va_start (arg_ptr, format);
   err = vprint_assuan_status (ctx, keyword, format, arg_ptr);
   va_end (arg_ptr);
   return err;
 }
 
 
 /* Set a gcrypt key for use with the pincache.  The key is a random
  * key unique for this process and is useless after this process has
  * terminated.  This way the cached PINs stored in the gpg-agent are
  * bound to this specific process.  The main purpose of this
  * encryption is to hide the PIN in logs of the IPC.  */
 static gpg_error_t
 set_key_for_pincache (gcry_cipher_hd_t hd)
 {
   static int initialized;
   static unsigned char keybuf[16];
 
   if (!initialized)
     {
       gcry_randomize (keybuf, sizeof keybuf, GCRY_STRONG_RANDOM);
       initialized = 1;
     }
 
   return gcry_cipher_setkey (hd, keybuf, sizeof keybuf);
 }
 
 
 /* Store the PIN in the PIN cache. The key to identify the PIN
  * consists of (SLOT,APPNAME,PINREF).  If PIN is NULL the PIN stored
  * under the given key is cleared.  If APPNAME and PINREF are NULL the
  * entire PIN cache for SLOT is cleared.  If SLOT is -1 the entire PIN
  * cache is cleared.  We do no use an scdaemon internal cache but let
  * gpg-agent cache it because it is better suited for this.  */
 void
 pincache_put (ctrl_t ctrl, int slot, const char *appname, const char *pinref,
               const char *pin, unsigned int pinlen)
 {
   gpg_error_t err = 0;
   assuan_context_t ctx;
   char line[950];
   gcry_cipher_hd_t cipherhd = NULL;
   char *pinbuf = NULL;
   unsigned char *wrappedkey = NULL;
   size_t pinbuflen, wrappedkeylen;
 
   if (!ctrl)
     {
       /* No CTRL object provided.  We could pick an arbitrary
        * connection and send the status to that one.  However, such a
        * connection is inlikley to wait for a respinse from use and
        * thus it would at best be read as a response to the next
        * command send to us.  That is not good because it may clog up
        * our connection.  Thus we better don't do that.  A better will
        * be to queue this up and let the agent poll for general status
        * messages.  */
       /* struct server_local_s *sl; */
       /* for (sl=session_list; sl; sl = sl->next_session) */
       /*   if (sl->ctrl_backlink && sl->ctrl_backlink->server_local */
       /*       && sl->ctrl_backlink->server_local->assuan_ctx) */
       /*     { */
       /*       ctrl = sl->ctrl_backlink; */
       /*       break; */
       /*     } */
     }
 
   if (!ctrl || !ctrl->server_local || !(ctx=ctrl->server_local->assuan_ctx))
     return;
   if (pin && !pinlen)
     return;  /* Ignore an empty PIN.  */
 
   snprintf (line, sizeof line, "%d/%s/%s ",
             slot, appname? appname:"", pinref? pinref:"");
 
   /* Without an APPNAME etc or without a PIN we clear the cache and
    * thus there is no need to send the pin - even if the caller
    * accidentally passed a pin.  */
   if (pin && slot != -1 && appname && pinref)
     {
       /* FIXME: Replace this by OCB mode and use the cache key as
        * additional data.  */
       /* Pad with zeroes (AESWRAP requires multiples of 64 bit but
        * at least 128 bit data).  */
       pinbuflen = pinlen + 8 - (pinlen % 8);
       if (pinbuflen < 16)
         pinbuflen = 16;
       pinbuf = xtrycalloc_secure (1, pinbuflen);
       if (!pinbuf)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
       memcpy (pinbuf, pin, pinlen);
       pinlen = pinbuflen;
       pin = pinbuf;
 
       err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
                               GCRY_CIPHER_MODE_AESWRAP, 0);
       if (!err)
         err = set_key_for_pincache (cipherhd);
       if (err)
         goto leave;
 
       wrappedkeylen = pinlen + 8;
       wrappedkey = xtrymalloc (wrappedkeylen);
       if (!wrappedkey)
         {
           err = gpg_error_from_syserror ();
           goto leave;
         }
 
       err = gcry_cipher_encrypt (cipherhd, wrappedkey, wrappedkeylen,
                                  pin, pinlen);
       if (err)
         goto leave;
       gcry_cipher_close (cipherhd);
       cipherhd = NULL;
       if (strlen (line) + 2*wrappedkeylen + 1 >= sizeof line)
         {
           log_error ("%s: PIN or pinref string too long - ignored", __func__);
           goto leave;
         }
       bin2hex (wrappedkey, wrappedkeylen, line + strlen (line));
     }
 
   send_status_direct (ctrl, "PINCACHE_PUT", line);
 
  leave:
   xfree (pinbuf);
   xfree (wrappedkey);
   gcry_cipher_close (cipherhd);
   if (err)
     log_error ("%s: error caching PIN: %s\n", __func__, gpg_strerror (err));
 }
 
 
 /* Ask the agent for a cached PIN for the tuple (SLOT,APPNAME,PINREF).
  * Returns on success and stores the PIN at R_PIN; the caller needs to
  * wipe(!)  and then free that value.  On error NULL is stored at
  * R_PIN and an error code returned.  Common error codes are:
  *  GPG_ERR_NOT_SUPPORTED - Client does not support the PIN cache
  *  GPG_ERR_NO_DATA       - No PIN cached for the given key tuple
  */
 gpg_error_t
 pincache_get (ctrl_t ctrl, int slot, const char *appname, const char *pinref,
               char **r_pin)
 {
   gpg_error_t err;
   assuan_context_t ctx;
   char command[512];
   unsigned char *value = NULL;
   size_t valuelen;
   unsigned char *wrappedkey = NULL;
   size_t wrappedkeylen;
   gcry_cipher_hd_t cipherhd = NULL;
 
   if (slot == -1 || !appname || !pinref || !r_pin)
     {
       err = gpg_error (GPG_ERR_INV_ARG);
       goto leave;
     }
   if (!ctrl || !ctrl->server_local || !(ctx = ctrl->server_local->assuan_ctx))
     {
       err = gpg_error (GPG_ERR_USE_CONDITIONS);
       log_error ("%s: called w/o assuan context\n", __func__);
       goto leave;
     }
 
   snprintf (command, sizeof command, "PINCACHE_GET %d/%s/%s",
             slot, appname? appname:"", pinref? pinref:"");
 
   /* Limit the inquire to something reasonable.  The 32 extra bytes
    * are a guessed size for padding etc.  */
   err = assuan_inquire (ctx, command, &wrappedkey, &wrappedkeylen,
                         2*MAXLEN_PIN+32);
   if (gpg_err_code (err) == GPG_ERR_ASS_CANCELED)
     {
       err = gpg_error (GPG_ERR_NOT_SUPPORTED);
       log_info ("caller does not feature a PIN cache");
       goto leave;
     }
   if (err)
     {
       log_error ("%s: sending PINCACHE_GET to caller failed: %s\n",
                  __func__, gpg_strerror (err));
       goto leave;
     }
   if (!wrappedkey || !wrappedkeylen)
     {
       err = gpg_error (GPG_ERR_NOT_FOUND);
       goto leave;
     }
 
   /* Convert to hex to binary and store it in (wrappedkey, wrappedkeylen).  */
   if (!hex2str (wrappedkey, wrappedkey, wrappedkeylen, &wrappedkeylen))
     {
       err = gpg_error_from_syserror ();
       log_error ("%s: caller returned invalid hex string: %s\n",
                  __func__, gpg_strerror (err));
       goto leave;
     }
 
   if (!wrappedkey || wrappedkeylen < 24)
     {
       err = gpg_error (GPG_ERR_INV_LENGTH); /* too short cryptogram */
       goto leave;
     }
 
   valuelen = wrappedkeylen - 8;
   value = xtrymalloc_secure (valuelen);
   if (!value)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
                           GCRY_CIPHER_MODE_AESWRAP, 0);
   if (!err)
     err = set_key_for_pincache (cipherhd);
   if (err)
     goto leave;
 
   err = gcry_cipher_decrypt (cipherhd, value, valuelen,
                              wrappedkey, wrappedkeylen);
   if (err)
     {
       log_error ("%s: cached value could not be decrypted: %s\n",
                  __func__, gpg_strerror (err));
       goto leave;
     }
 
   *r_pin = value;
   value = NULL;
 
  leave:
   gcry_cipher_close (cipherhd);
   xfree (wrappedkey);
   xfree (value);
   return err;
 }
 
 
 void
 popup_prompt (void *opaque, int on)
 {
   ctrl_t ctrl = opaque;
 
   if (ctrl)
     {
       assuan_context_t ctx = ctrl->server_local->assuan_ctx;
 
       if (ctx)
         {
           const char *cmd;
           gpg_error_t err;
           unsigned char *value;
           size_t valuelen;
 
           if (on)
             cmd = "POPUPPINPADPROMPT --ack";
           else
             cmd = "DISMISSPINPADPROMPT";
           err = assuan_inquire (ctx, cmd, &value, &valuelen, 100);
           if (!err)
             xfree (value);
         }
     }
 }
 
 
 /* Helper to send the clients a status change notification.  Note that
  * this function assumes that APP is already locked.  */
 void
 send_client_notifications (card_t card, int removal)
 {
   struct {
     pid_t pid;
 #ifdef HAVE_W32_SYSTEM
     HANDLE handle;
 #else
     int signo;
 #endif
   } killed[50];
   int killidx = 0;
   int kidx;
   struct server_local_s *sl;
 
   for (sl=session_list; sl; sl = sl->next_session)
     {
       if (sl->watching_status)
         {
           if (removal)
             assuan_write_status (sl->assuan_ctx, "DEVINFO_STATUS", "removal");
           else
             assuan_write_status (sl->assuan_ctx, "DEVINFO_STATUS", "new");
         }
 
       if (sl->ctrl_backlink && sl->ctrl_backlink->card_ctx == card)
         {
           pid_t pid;
 #ifdef HAVE_W32_SYSTEM
           HANDLE handle;
 #else
           int signo;
 #endif
 
           if (removal)
             {
               sl->ctrl_backlink->card_ctx = NULL;
               sl->ctrl_backlink->current_apptype = APPTYPE_NONE;
               sl->card_removed = 1;
               card_unref_locked (card);
             }
 
           if (!sl->event_signal || !sl->assuan_ctx)
             continue;
 
           pid = assuan_get_pid (sl->assuan_ctx);
 
 #ifdef HAVE_W32_SYSTEM
           handle = sl->event_signal;
           for (kidx=0; kidx < killidx; kidx++)
             if (killed[kidx].pid == pid
                 && killed[kidx].handle == handle)
               break;
           if (kidx < killidx)
             log_info ("event %p (%p) already triggered for client %d\n",
                       sl->event_signal, handle, (int)pid);
           else
             {
               log_info ("triggering event %p (%p) for client %d\n",
                         sl->event_signal, handle, (int)pid);
               if (!SetEvent (handle))
                 log_error ("SetEvent(%p) failed: %s\n",
                            sl->event_signal, w32_strerror (-1));
               if (killidx < DIM (killed))
                 {
                   killed[killidx].pid = pid;
                   killed[killidx].handle = handle;
                   killidx++;
                 }
             }
 #else /*!HAVE_W32_SYSTEM*/
           signo = sl->event_signal;
 
           if (pid != (pid_t)(-1) && pid && signo > 0)
             {
               for (kidx=0; kidx < killidx; kidx++)
                 if (killed[kidx].pid == pid
                     && killed[kidx].signo == signo)
                   break;
               if (kidx < killidx)
                 log_info ("signal %d already sent to client %d\n",
                           signo, (int)pid);
               else
                 {
                   log_info ("sending signal %d to client %d\n",
                             signo, (int)pid);
                   kill (pid, signo);
                   if (killidx < DIM (killed))
                     {
                       killed[killidx].pid = pid;
                       killed[killidx].signo = signo;
                       killidx++;
                     }
                 }
             }
 #endif /*!HAVE_W32_SYSTEM*/
         }
     }
 }