Re: RFC - one old and one new bluetooth device driver.

--===============7284803192550355894==
Content-Type: multipart/alternative; boundary="001a113e6e38d300a40556d9504b"

--001a113e6e38d300a40556d9504b
Content-Type: text/plain; charset="UTF-8"

Cool! Last time I asked OmniKey/HID for a specification of the transport
layer, I received silence... The fact that it has simple plaintext
communication is probably the reason why it is discontinued.

My only comment would be to make it clear in the patch that these features
are  "HID/omnikey" which has nothing to do with HID as
https://en.wikipedia.org/wiki/Human_interface_device (because devices like
FIDO and Yubikey DO use HID and/or CCID for communication and this could
create confusion)

I hope I did not trash the 2061 as a useless reader and can find it to test.

Best,
Martin

On Mon, 14 Aug 2017 at 16:20 James <[email protected]> wrote:

> Attached are patches to support the HID Omnikey 2061, and
> the ACR3901U-S1 bluetooth card readers.
>
> ---
>
> The HID Omnikey 2061, is end of life but is readily
> available on eBay. I reverse engineered the protocol
> from observing the windows drivers. It uses CCID over
> serial over Bluetooth RFCOMM. As such the pin is not
> particularly well protected.
>
> To use the HID driver, first pair the reader with the
> computer using your favourite bluetooth stack then create
> a file in /etc/reader.conf.d/ containing (edit the path
> and set the DEVICENAME to be the MAC address of the reader)
>
> DEVICENAME        00:80:25:33:44:55
> FRIENDLYNAME      "My HID 2061"
> LIBPATH           /usr/lib64/pcsc/drivers/serial/libccidhid.so
>
> ---
>
> The ACR3901U-S1 is in current production and communicates
> using a stripped down version of CCID over Bluetooth
> Low-Energy GATT, or CCID over USB. The over-the-air
> interface is protected by mutual authentication, and
> encrypted using 128 bit AES CBC using a random session
> key. The driver implements support for both interfaces.
>
> The device requires a 16 byte secret key to be known by
> the connecting computer, at the moment pcscd doesn't
> provide a simple way to insert this - (in this patch it's
> hard coded to the default value). What would be the
> preffered method of getting this into the driver?
>
> To use the ACR driver find the MAC address of the device
> (use hcitool lescan) on linux
>
> and create a file in /etc/reader.conf.d/ containing (edit
> the path and set the DEVICENAME to be the MAC address of
> the reader)
>
> DEVICENAME        11:22:33:44:55:66
> FRIENDLYNAME      "My ACR3901U-S1"
> LIBPATH           /usr/lib64/pcsc/drivers/serial/libccidacr.so
>
> For USB operation the drive is plug and play.
>
> The ACR driver still outputs some debug output to stderr
> which should be fixed.
>
> The HID driver patch contains support for multiple serial
> devices, which is used by the ACR driver patch.
>
>
> James.
> _______________________________________________
> Pcsclite-muscle mailing list
> [email protected]
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle

-- 

typos expected due to mobile device

--001a113e6e38d300a40556d9504b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Cool! Last time I asked OmniKey/HID for a specificati=
on of the transport layer, I received silence... The fact that it has simpl=
e plaintext communication is probably the reason why it is discontinued.<br=
><br>My only comment would be to make it clear in the patch that these feat=
ures are =C2=A0&quot;HID/omnikey&quot; which has nothing to do with HID as=
=C2=A0<a href=3D"https://en.wikipedia.org/wiki/Human_interface_device">http=
s://en.wikipedia.org/wiki/Human_interface_device</a>=C2=A0(because devices =
like FIDO and Yubikey DO use HID and/or CCID for communication and this cou=
ld create confusion)</div><div><br></div><div>I hope I did not trash the 20=
61 as a useless reader and can find it to test.</div><div><br></div><div>Be=
st,</div><div>Martin<br><br><div class=3D"gmail_quote"><div dir=3D"ltr">On =
Mon, 14 Aug 2017 at 16:20 James &lt;<a href=3D"mailto:[email protected]=
g">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left=
:1ex">Attached are patches to support the HID Omnikey 2061, and<br>
the ACR3901U-S1 bluetooth card readers.<br>
<br>
---<br>
<br>
The HID Omnikey 2061, is end of life but is readily<br>
available on eBay. I reverse engineered the protocol<br>
from observing the windows drivers. It uses CCID over<br>
serial over Bluetooth RFCOMM. As such the pin is not<br>
particularly well protected.<br>
<br>
To use the HID driver, first pair the reader with the<br>
computer using your favourite bluetooth stack then create<br>
a file in /etc/reader.conf.d/ containing (edit the path<br>
and set the DEVICENAME to be the MAC address of the reader)<br>
<br>
DEVICENAME=C2=A0 =C2=A0 =C2=A0 =C2=A0 00:80:25:33:44:55<br>
FRIENDLYNAME=C2=A0 =C2=A0 =C2=A0 &quot;My HID 2061&quot;<br>
LIBPATH=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/lib64/pcsc/drivers/ser=
ial/libccidhid.so<br>
<br>
---<br>
<br>
The ACR3901U-S1 is in current production and communicates<br>
using a stripped down version of CCID over Bluetooth<br>
Low-Energy GATT, or CCID over USB. The over-the-air<br>
interface is protected by mutual authentication, and<br>
encrypted using 128 bit AES CBC using a random session<br>
key. The driver implements support for both interfaces.<br>
<br>
The device requires a 16 byte secret key to be known by<br>
the connecting computer, at the moment pcscd doesn&#39;t<br>
provide a simple way to insert this - (in this patch it&#39;s<br>
hard coded to the default value). What would be the<br>
preffered method of getting this into the driver?<br>
<br>
To use the ACR driver find the MAC address of the device<br>
(use hcitool lescan) on linux<br>
<br>
and create a file in /etc/reader.conf.d/ containing (edit<br>
the path and set the DEVICENAME to be the MAC address of<br>
the reader)<br>
<br>
DEVICENAME=C2=A0 =C2=A0 =C2=A0 =C2=A0 11:22:33:44:55:66<br>
FRIENDLYNAME=C2=A0 =C2=A0 =C2=A0 &quot;My ACR3901U-S1&quot;<br>
LIBPATH=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/lib64/pcsc/drivers/ser=
ial/libccidacr.so<br>
<br>
For USB operation the drive is plug and play.<br>
<br>
The ACR driver still outputs some debug output to stderr<br>
which should be fixed.<br>
<br>
The HID driver patch contains support for multiple serial<br>
devices, which is used by the ACR driver patch.<br>
<br>
<br>
James.<br>
_______________________________________________<br>
Pcsclite-muscle mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank=
">[email protected]</a><br>
<a href=3D"http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite=
-muscle" rel=3D"noreferrer" target=3D"_blank">http://lists.alioth.debian.or=
g/cgi-bin/mailman/listinfo/pcsclite-muscle</a></blockquote></div></div></di=
v><div dir=3D"ltr">-- <br></div><div class=3D"gmail_signature" data-smartma=
il=3D"gmail_signature"><div dir=3D"ltr"><p dir=3D"ltr">typos expected due t=
o mobile device</p>
</div></div>

--001a113e6e38d300a40556d9504b--


--===============7284803192550355894==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pcsclite-muscle mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle
--===============7284803192550355894==--