Device and Environment
Secure Element (currently) used: Yubikey 5 NFC
OS (currently) used: Linux (future targets will be Win and Android)
Readers used: ACS ACR122U, REINER SCT cyberJack RFID, SCM SCL011
Goals
Connect to Yubikey via NFC and implement/run the following methods:
- Create Key Pair
- Export Public Key
- Sign
- Encrypt
- Decrypt
Current status
Based on Yubico's PKCS#11 wrapper library I implemented the 5 methods above. With the Yubikey connected via USB they work pretty fine.
Issues
1) Docs/Support
I couldn't found any related docs on Yubico's website regarding APIs via NFC. There seems to be no mailing list but a hint:
Ask Technical Questions: For technical questions, try Stack Exchange sites. Stack Exchange is a network of question and answer sites for developers to learn and share their knowledge, which includes Stack Overflow.
Here I am. ;-)
Update according to Alexander (thank you): Some sources are published by Yubico on github at github.com/Yubico
2) Errors on CLI tools
The Yubikey is shown by pcsc_scan on every reader mentioned above.
But using common tools like gp, opensc-tool, pkcs11-tool and pkcs15-tool mostly issue error 0x6A80 is shown when trying to use e.g. common APDU access.
I'm not able to see any cardlet or even select one.
(Using other NFC devices I get 0x9000/success and data on some commands which cause 0x6A80 on the Yubikey.)
Example output of gp:
gp -lvdi
[DEBUG] TerminalManager - Selected the only reader with a card
SCardConnect("Yubico YubiKey OTP+FIDO+CCID 00 00", T=*) -> T=1, 3BFD1300008131FE158073C021C057597562694B657940
# GlobalPlatformPro 325fe84
# Running on Linux 5.18.5-100.fc35.x86_64 amd64, Java 11.0.14 by SAP SE
A>> T=1 (4+0000) 00A40400 00
A<< (0000+2) (1ms) 6A80
Error: Could not SELECT default selected: 0x6A80 (Wrong data/incorrect values in data)
pro.javacard.gp.GPException: Could not SELECT default selected: 0x6A80 (Wrong data/incorrect values in data)
at pro.javacard.gp.GPException.check(GPException.java:64)
at pro.javacard.gp.GPSession.discover(GPSession.java:145)
at pro.javacard.gp.GPTool.run(GPTool.java:208)
at pro.javacard.gp.GPTool.main(GPTool.java:107)
SCardDisconnect("Yubico YubiKey OTP+FIDO+CCID 00 00", true) tx:5/rx:2
Questions
- Where can related docs be found?
- Which APIs are available to access the Yubikey via NFC to implement the 5 methods mentioned above?
- What needs to be done to use those APIs (e.g. installation of additional libs)?
Updates
2022-08-16
Got a hint: In yubico-piv-tool/blob/master/lib/ykpiv.h is a define of YKPIV_INS_SELECT_APPLICATION with value A4 which looks very common.
Success for select:
# opensc-tool -s 00:A4:04:00:05:A0:00:00:03:08:00 -v
Using reader with a card: ACS ACR122U 00 00
Connecting to card in reader ACS ACR122U 00 00...
Using card driver Personal Identity Verification Card.
Sending: 00 A4 04 00 05 A0 00 00 03 08 00
Received (SW1=0x90, SW2=0x00):
61 11 4F 06 00 00 10 00 01 00 79 07 4F 05 A0 00 a.O.......y.O...
00 03 08 ...
2022-08-31
yubico-piv-tool can be used for access via USB and NFC. The "reader" option -r is used for this. Default is Yubikey which can even be abbreviated with Y.
The same "light" matching of reader name happens for NFC readers: The name just need to match roughly. In my case it works with these strings for my three readers: ACR122U, cyberJack and (ancient) SCL011. By specifying the reader names I can easily get the status via NFC.
I asked Yubico support again for docs. But at least I see now a way to investigate by analyzing the yubico-piv-tool source code. Maybe it could be even possible to use PKCS#11 via NFC.
Will keep this updated here.