dangerousthings/flexsecure-applets

Collection of JavaCard applets for the FlexSecure, as well as build and testing scripts, and documentation.

flexsecure-applets

Collection of JavaCard applets for the DangerousThings FlexSecure and VivoKey Apex, as well as build and testing scripts.

For documentation, see docs/ . Or read the forums at https://forum.dangerousthings.com/c/support/flexsecure-support/24 .

Some submodules contain private / proprietary applets and require access permissions.

Download

Public compiled binaries are available from the GitHub releases page: https://github.com/DangerousThings/flexsecure-applets/releases .

Development Usage

Install Docker. Use the docker-*.sh scripts in scripts/ to compile and test the applets. Binaries will be placed in bin/. This repository also runs on a Drone CI server.

Version Command

The build system in this repository adds an extra version APDU command to each applet. See scripts/compile/res/version.py. Use this build system if you want to generate release equivalent binaries.

flexsecure-applets's Issues

ndef applet needs adjustment to AIDs

Apparently the maintainer of the NDEF applet made some decisions. The source should be adjusted and recompiled so it uses the correct AID and package IDs;

OpenJavaCard/openjavacard-ndef#10

Amal

Update documentation

• Add new FIDO2 docs
• Add keycard and dsatochip docs
• Check all docs for updates

Error when personalizing the GP installed ykhmac applet using ykman

I'm getting the following error when attempting to personalize the HMAC-SHA1 secret on a P71 chip that has the v0.18.6 YkHMAC applet installed.

File "C:\Program Files\Yubico\YubiKey Manager\pymodules\yubikit\core\smartcard.py", line 206, in send_apdu
    raise ApduError(response, sw)
yubikit.core.smartcard.ApduError: APDU error: SW=0x6c00

I am able to successfully provision the applet using the yktool.jar utility. I am also able to successfully provision the Fidesmo installed version of the applet on an Apex flex using ykman, so this appears to only be affecting the version installed via gp and the .cap file. I am using an administrative command prompt on Windows 10.

I get the same error when attempting to manually calculate a response via ykman, but it works via yktool.jar.

The chip is a P71 test card that used to be available from javacardos (it is no longer available via the website store, but the person who runs the site directed me to purchase from Alibaba instead).

Version information:

PS G:\> gp.exe --version
GlobalPlatformPro v20.01.23-0-g5ad373b
Running on Windows 10 10.0 amd64, Java 1.8.0_401 by Oracle Corporation

PS G:\> ykman.exe --version
YubiKey Manager (ykman) version: 5.0.1

YkHMACApplet.cap: v0.18.6

No other applets were installed on the card before installing HMAC. Here is the list output after the applet was installed.

PS G:\My Drive\apps\Dangerous Things\applets\v0.18.6> gp.exe --list
Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
ISD: A000000151000000 (OP_READY)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, CardLock, CardTerminate, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

APP: D276000085304A434F900001 (SELECTABLE)
     Parent:  A000000151000000
     From:    D276000085304A434F9000
     Privs:   CardReset

APP: A000000527200101 (SELECTABLE)
     Parent:  A000000151000000
     From:    A00000052720
     Privs:

PKG: A0000001515350 (LOADED)
     Parent:  A000000151000000
     Version: -1.-1
     Applet:  A000000151535041

PKG: D276000085304A434F9000 (LOADED)
     Parent:  A000000151000000
     Version: 1.0
     Applet:  D276000085304A434F900001

PKG: A0000000620204 (LOADED)
     Parent:  A000000151000000
     Version: 1.0

PKG: A0000000620202 (LOADED)
     Parent:  A000000151000000
     Version: 1.3

PKG: A00000052720 (LOADED)
     Parent:  A000000151000000
     Version: 1.0
     Applet:  A000000527200101

Full logs starting with the install

PS G:\My Drive\apps\Dangerous Things\applets\v0.18.6> gp.exe --list
Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
ISD: A000000151000000 (OP_READY)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, CardLock, CardTerminate, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

APP: D276000085304A434F900001 (SELECTABLE)
     Parent:  A000000151000000
     From:    D276000085304A434F9000
     Privs:   CardReset

PKG: A0000001515350 (LOADED)
     Parent:  A000000151000000
     Version: -1.-1
     Applet:  A000000151535041

PKG: D276000085304A434F9000 (LOADED)
     Parent:  A000000151000000
     Version: 1.0
     Applet:  D276000085304A434F900001

PKG: A0000000620204 (LOADED)
     Parent:  A000000151000000
     Version: 1.0

PKG: A0000000620202 (LOADED)
     Parent:  A000000151000000
     Version: 1.3

PS G:\My Drive\apps\Dangerous Things\applets\v0.18.6> gp.exe --install .\YkHMACApplet.cap
Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
CAP loaded

PS G:\My Drive\apps\Dangerous Things\applets\v0.18.6> ykman.exe list -r
ACS ACR1252 1S CL Reader PICC 0
ACS ACR1252 1S CL Reader SAM 0
JAVACOS Virtual Contact Reader 0
JAVACOS Virtual Contactless Reader 1
PS G:\My Drive\apps\Dangerous Things\applets\v0.18.6> ykman -l debug -r 'ACS ACR1252 1S CL Reader PICC 0' otp chalresp -f 1 '0000000001000000000200000000030000000004'
INFO 18:07:10.683 [ykman.logging.set_log_level:60] Logging at level: DEBUG
WARNING 18:07:10.683 [ykman.logging.set_log_level:64]
#############################################################################
#                                                                           #
# WARNING: Sensitive data may be logged!                                    #
# Some personally identifying information may be logged, such as usernames! #
#                                                                           #
#############################################################################
INFO 18:07:10.683 [ykman._cli.__main__.cli:238] System info:
  ykman:            5.0.1
  Python:           3.11.1 (tags/v3.11.1:a7a450f, Dec  6 2022, 19:58:39) [MSC v.1934 64 bit (AMD64)]
  Platform:         win32
  Arch:             AMD64
  System date:      2024-03-09
  Running as admin: True
  Windows version:  (10, 0, 19045)

DEBUG 18:07:10.726 [yubikit.support.read_info:261] Attempting to read device info, using ScardSmartCardConnection
DEBUG 18:07:10.764 [yubikit.management.__init__:443] Management session initialized for connection=ScardSmartCardConnection, version=4.0.0
DEBUG 18:07:10.787 [yubikit.core.smartcard.enable_touch_workaround:150] Touch workaround enabled=False
DEBUG 18:07:10.787 [yubikit.yubiotp.__init__:739] YubiOTP session initialized for connection=ScardSmartCardConnection, version=4.0.0, state=ConfigState(configured: (False, False), touch_triggered: (False, False), led_inverted: False)
DEBUG 18:07:10.794 [yubikit.support._read_info_ccid:114] Scan for available applications...
DEBUG 18:07:10.801 [yubikit.support._read_info_ccid:122] Missing applet: aid: AID.FIDO, capability: U2F: 0x2
DEBUG 18:07:10.807 [yubikit.support._read_info_ccid:122] Missing applet: aid: b"\xa0\x00\x00\x05'\x10\x02", capability: U2F: 0x2
DEBUG 18:07:10.815 [yubikit.support._read_info_ccid:122] Missing applet: aid: AID.PIV, capability: PIV: 0x10
DEBUG 18:07:10.821 [yubikit.support._read_info_ccid:122] Missing applet: aid: AID.OPENPGP, capability: OPENPGP: 0x8
DEBUG 18:07:10.829 [yubikit.support._read_info_ccid:122] Missing applet: aid: AID.OATH, capability: OATH: 0x20
DEBUG 18:07:10.829 [yubikit.support.read_info:289] Read info: DeviceInfo(config=DeviceConfig(enabled_capabilities={}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG: 0>), serial=276870963, version=Version(major=4, minor=0, patch=0), form_factor=<FORM_FACTOR.UNKNOWN: 0>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.OTP|U2F: 3>, <TRANSPORT.NFC: 'nfc'>: <CAPABILITY.OTP|U2F: 3>}, is_locked=False, is_fips=False, is_sky=False)
DEBUG 18:07:10.829 [yubikit.support.read_info:348] Device info, after tweaks: DeviceInfo(config=DeviceConfig(enabled_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY: 0>, <TRANSPORT.NFC: 'nfc'>: <CAPABILITY.OTP|U2F: 3>}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG: 0>), serial=276870963, version=Version(major=4, minor=0, patch=0), form_factor=<FORM_FACTOR.UNKNOWN: 0>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.OTP|U2F: 3>, <TRANSPORT.NFC: 'nfc'>: <CAPABILITY.OTP|U2F: 3>}, is_locked=False, is_fips=False, is_sky=False)
ERROR 18:07:10.901 [ykman._cli.__main__.main:380] An unexpected error has occured
Traceback (most recent call last):
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\ykman\_cli\__main__.py", line 364, in main
    cli(obj={})
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 1055, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\core.py", line 760, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\click\decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\ykman\_cli\otp.py", line 608, in chalresp
    session = _get_session(ctx)
              ^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\ykman\_cli\otp.py", line 207, in _get_session
    return YubiOtpSession(conn)
           ^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\yubikit\yubiotp.py", line 720, in __init__
    card_protocol.select(AID.MANAGEMENT)
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\yubikit\core\smartcard.py", line 154, in select
    return self.send_apdu(0, INS_SELECT, P1_SELECT, P2_SELECT, aid)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Yubico\YubiKey Manager\pymodules\yubikit\core\smartcard.py", line 206, in send_apdu
    raise ApduError(response, sw)
yubikit.core.smartcard.ApduError: APDU error: SW=0x6c00