YkTool and custom cards
Closed this issue · 6 comments
Hello,
I tried to install the applet onto my card (JNXP) and although the installation went flawlessly, the yktool does not seem to have recognized it. Is it an issue or only yubikey smart cards are supported?
Thank you
Ok tried another card (older sdk, no NFC..) and worked...
@Aiosa did only a change of what card you installed on allow the card to be detected by yktool? I have tested on two cards, a 2.2.2 and a 3.0.4 version, and both yktool and ykman otp do not detect a yubikey.
Well I tried with JavaCOS A40 or something similar (I have two, one unknown version, I think it was the unknown one). But, for some reason when I tried it again later, it did not work anymore. I was a bit confused, but could not find out the reason, using different cards, different yktool versions and observing with APDU tracer. I don't really remember but my notes say I did notice successful select command on the applet aid before.
Please let me know if you succeed in the applet use. Yubico apps most likely check the reader vendor and allow communication with Yubico HW only, though it may not be the case with yktool. I thought so at first, but nothing has worked for me ever since closing the issue - ironically.
@Aiosa I looked through to see if yktool was doing a hardware check of some kind, it looks like the tool just tries to connect to each card connected: https://github.com/arekinath/yktool/blob/master/yktool.java#L132
As a small aside: I use the Yubikey OTP applet for securing a KeePassXC database. This is my backup for if that yubikey auth method fails or becomes unavailable. There is a tool available for computing the HMAC-SHA1 response that is useful for my case in the meantime, but I still do need to have the backup on a physical card and I will let you know when I have that available.
I am using Ubuntu 19.10 as my primary development workstation. There is a Linux issue when working with smartcards that is documented here: https://stackoverflow.com/questions/12376257/accessing-javax-smartcardio-from-linux-64-bits
On my machine, using java -Dsun.security.smartcardio.library=/usr/lib/x86_64-linux-gnu/libpcsclite.so -jar yktool.jar for yktool allows me to list the YkOtpApplet as a yubikey with the tool and program that HMAC slot. Currently I don't have it working from KeePassXC yet, which I think is probably the same issue ... but I am able to interact with and program the card!