Re: PIN-counter
Frank Morgner <[email protected]> Fri, 21 Apr 2023 12:44:41 +0200
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============3891729247000821721== Content-Type: multipart/alternative; boundary="------------3yMHSLW9x7Ysw0TziAlEdHVX" Content-Language: en-US This is a multi-part message in MIME format. --------------3yMHSLW9x7Ysw0TziAlEdHVX Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit sc_pkcs15_get_pin_info is currently only called from some card drivers and the PKCS#11 layer. Unfortunately, the PIN counter is not directly visible for the user. You can get request the retry counter (if the card supports it) with the following command: pkcs11-tool -T Depending on pkcs11-tool's output message the retry counter is as follows: * "final user PIN try" -> counter=1 * "user PIN count low" -> 1<counter<maximum * "user PIN locked" -> counter=0 Regards, Frank. Am 18.04.23 um 17:36 schrieb Douglas E Engert: > `pkcs15-tool -s --list-pins` might work. > > https://github.com/OpenSC/OpenSC/blob/master/src/tools/pkcs15-tool.c#L1529-L1530 > > But it does not look like it will force the query of the token ans id > not working for PIV card. May work for others. > > On 4/18/2023 8:44 AM, Hans via Opensc-devel wrote: >> >> Thanks Frank, >> >> A dedicated CLI wouldn’t be needed, >> >> I hoped that it would be visible via pkcs11-tool –T >> >> Regards, Hans >> >> *From:*Frank Morgner <[email protected]> >> *Sent:* Tuesday, April 18, 2023 3:09 PM >> *To:* [email protected] >> *Subject:* Re: [Opensc-devel] PIN-counter >> >> Depending on the card you can send an empty VERIFY command (without >> PIN) and it will return the tries left. However, I don't think we >> have a dedicated CLI for this. >> >> Regards, Frank. >> >> Am 18.04.23 um 14:49 schrieb Hans via Opensc-devel: >> >> Hi all, >> >> Excuse me for troubling with a trivial question… >> >> I remember seeing many months ago in the release notes that it >> was possible to check the PIN-retry count. >> >> But, looking for it, (man-pages google) I fail to find it. >> (pkcs11-tools / pkcs15-tools / opensc) >> >> Is my mind playing tricks with me. >> >> From very long time ago, I remember when doing a PIN-verification >> by sending an APDU, you get the PIN-count (and tries-left) back. >> >> Though that seems a very crude way to do it. >> >> Met vriendelijke groet, >> >> *Hans Witvliet, J, Ing., DMO/OPS/I&S/APH, Kennis Team Opensource >> Coldenhovelaan 1 Maasland 3531RC Coldehovelaan 1, kamer B213* >> >> >> Dit bericht kan informatie bevatten die niet voor u is bestemd. >> Indien u niet de geadresseerde bent of dit bericht abusievelijk >> aan u is toegezonden, wordt u verzocht dat aan de afzender te >> melden en het bericht te verwijderen. De Staat aanvaardt geen >> aansprakelijkheid voor schade, van welke aard ook, die verband >> houdt met risico's verbonden aan het elektronisch verzenden van >> berichten. >> >> This message may contain information that is not intended for >> you. If you are not the addressee or if this message was sent to >> you by mistake, you are requested to inform the sender and delete >> the message. The State accepts no liability for damage of any >> kind resulting from the risks inherent in the electronic >> transmission of messages. >> >> >> _______________________________________________ >> >> Opensc-devel mailing list >> >> [email protected] >> >> https://lists.sourceforge.net/lists/listinfo/opensc-devel >> >> >> Dit bericht kan informatie bevatten die niet voor u is bestemd. >> Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u >> is toegezonden, wordt u verzocht dat aan de afzender te melden en het >> bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid >> voor schade, van welke aard ook, die verband houdt met risico's >> verbonden aan het elektronisch verzenden van berichten. >> >> This message may contain information that is not intended for you. If >> you are not the addressee or if this message was sent to you by >> mistake, you are requested to inform the sender and delete the >> message. The State accepts no liability for damage of any kind >> resulting from the risks inherent in the electronic transmission of >> messages. >> >> >> _______________________________________________ >> Opensc-devel mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/opensc-devel > > -- > > Douglas E. Engert<[email protected]> > > > > _______________________________________________ > Opensc-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/opensc-devel --------------3yMHSLW9x7Ysw0TziAlEdHVX Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p>sc_pkcs15_get_pin_info is currently only called from some card drivers and the PKCS#11 layer. Unfortunately, the PIN counter is not directly visible for the user. You can get request the retry counter (if the card supports it) with the following command:</p> <p><font face="monospace">pkcs11-tool -T</font></p> <p>Depending on pkcs11-tool's output message the retry counter is as follows:</p> <ul> <li>"final user PIN try" -> counter=1</li> <li>"user PIN count low" -> 1<counter<maximum</li> <li>"user PIN locked" -> counter=0</li> </ul> <p>Regards, Frank.</p> <p><br> </p> <div class="moz-cite-prefix">Am 18.04.23 um 17:36 schrieb Douglas E Engert:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> `pkcs15-tool -s --list-pins` might work. <br> <br> <a class="moz-txt-link-freetext" href="https://github.com/OpenSC/OpenSC/blob/master/src/tools/pkcs15-tool.c#L1529-L1530" moz-do-not-send="true">https://github.com/OpenSC/OpenSC/blob/master/src/tools/pkcs15-tool.c#L1529-L1530</a><br> <br> But it does not look like it will force the query of the token ans id not working for PIV card. May work for others.<br> <br> <div class="moz-cite-prefix">On 4/18/2023 8:44 AM, Hans via Opensc-devel wrote:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <div class="WordSection1"> <p class="MsoNormal"><span>Thanks Frank,</span></p> <p class="MsoNormal"><span> </span></p> <p class="MsoNormal"><span lang="EN-US">A dedicated CLI wouldn’t be needed,</span></p> <p class="MsoNormal"><span lang="EN-US">I hoped that it would be visible via pkcs11-tool –T</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <p class="MsoNormal"><span lang="EN-US">Regards, Hans</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <div> <div> <p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Frank Morgner <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]" moz-do-not-send="true"><[email protected]></a> <br> <b>Sent:</b> Tuesday, April 18, 2023 3:09 PM<br> <b>To:</b> <a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a><br> <b>Subject:</b> Re: [Opensc-devel] PIN-counter</span></p> </div> </div> <p class="MsoNormal"> </p> <p>Depending on the card you can send an empty VERIFY command (without PIN) and it will return the tries left. However, I don't think we have a dedicated CLI for this.</p> <p>Regards, Frank.</p> <div> <p class="MsoNormal">Am 18.04.23 um 14:49 schrieb Hans via Opensc-devel:</p> </div> <blockquote> <div> <p class="MsoNormal">Hi all,</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="EN-US">Excuse me for troubling with a trivial question…</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <p class="MsoNormal"><span lang="EN-US">I remember seeing many months ago in the release notes that it was possible to check the PIN-retry count.</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <p class="MsoNormal"><span lang="EN-US">But, looking for it, (man-pages google) I fail to find it. (pkcs11-tools / pkcs15-tools / opensc)</span></p> <p class="MsoNormal"><span lang="EN-US">Is my mind playing tricks with me.</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <p class="MsoNormal"><span lang="EN-US">From very long time ago, I remember when doing a PIN-verification by sending an APDU, you get the PIN-count (and tries-left) back.</span></p> <p class="MsoNormal"><span lang="EN-US">Though that seems a very crude way to do it.</span></p> <p class="MsoNormal"><span lang="EN-US"> </span></p> <div> <p class="MsoNormal"><span lang="EN-US"> </span></p> </div> <p class="MsoNormal">Met vriendelijke groet,</p> <p class="MsoNormal"><b>Hans Witvliet, J, Ing., DMO/OPS/I&S/APH, Kennis Team Opensource<br> Coldenhovelaan 1 Maasland 3531RC Coldehovelaan 1, kamer B213</b></p> <p class="MsoNormal"> </p> </div> <p class="MsoNormal"><br> Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. <br> <br> This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. <br> <br> <br> </p> <pre>_______________________________________________</pre> <pre>Opensc-devel mailing list</pre> <pre><a href="mailto:[email protected]" class="moz-txt-link-freetext" moz-do-not-send="true">[email protected]</a></pre> <pre><a href="https://lists.sourceforge.net/lists/listinfo/opensc-devel" class="moz-txt-link-freetext" moz-do-not-send="true">https://lists.sourceforge.net/lists/listinfo/opensc-devel</a></pre> </blockquote> </div> <br> Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. <br> <br> This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre class="moz-quote-pre" wrap="">_______________________________________________ Opensc-devel mailing list <a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/opensc-devel" moz-do-not-send="true">https://lists.sourceforge.net/lists/listinfo/opensc-devel</a> </pre> </blockquote> <br> <pre class="moz-signature" cols="200">-- Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]" moz-do-not-send="true"><[email protected]></a> </pre> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre class="moz-quote-pre" wrap="">_______________________________________________ Opensc-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/opensc-devel">https://lists.sourceforge.net/lists/listinfo/opensc-devel</a> </pre> </blockquote> </body> </html> --------------3yMHSLW9x7Ysw0TziAlEdHVX-- --===============3891729247000821721== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3891729247000821721== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Opensc-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opensc-devel --===============3891729247000821721==--