OpenSC/OpenSC — pull request #145 by hiviah (2013-03-22 15:49:55+00:00)
Title: epass2003: support stricter privkey/pubkey ACLs

The patch allows to use ACLs requring PIN for deleting and updating private and public keys for epass2003. Currently default epass2003 profile has `ACL = *= NONE` for both private and public key files.

Privkey import worked before this patch, but generating failed.

**Testcase:**

1. In `/usr/share/opensc/epass2003.profile`, change ACL to require PIN for deleting and updating private and public key files 2900, 3000. E.g. by applying this diff to the profile:

--- epass2003.profile 2013-03-22 14:27:33.815532234 +0100
+++ epass2003.profile.new 2013-03-22 16:42:16.321706060 +0100
@@ -164,13 +164,13 @@
#type = internal-ef;
structure = 0xA3;
#ACL = READ=CHV1,UPDATE=CHV1,CRYPTO=CHV1;
- ACL = *=NONE;
+ ACL = *=NONE,UPDATE=$PIN,DELETE=$PIN;
}

EF public-key {
file-id = 3000;
structure = transparent;
- ACL = *=NONE;
+ ACL = *=NEVER,READ=NONE,UPDATE=$PIN,WRITE=$PIN,DELETE=$PIN;
}

# Certificate template

2. Erase card, initialize with onepin profile, generate keypair:

pkcs15-init -E
pkcs15-init --create-pkcs15 --profile pkcs15+onepin --label "Generated" --pin 1234 --puk 000000
pkcs15-init --generate-key rsa/2048 --auth-id 01 -u sign

Generating should now complete successfully. Deleting/updating 29xx and 30xx keyfiles will not be possible without PIN authorization. It can be checked via opensc-explorer's `rm` and `put` commands.