Re: “Hardware problem” with OpenPGP smart card

2020-12-07 Thread Nicolas Boullis
Hi,

On Mon, Dec 07, 2020 at 12:08:23PM +0100, Werner Koch via Gnupg-users wrote:
> 
> The show error code is indeed either a hardware error (EEPROM failure)
> or due to a card reader which filters certyain commands send to the card
> and return a bogus error code.  However, I doubt that the latter is the
> case.
> 
> In any case, it is best to try a different reader and if possible a
> different machine.

Thanks to all for your answers.

I had already tried on a different computer, with no success.
I have a second OpenPGP card (with different keys) installed in a second 
reader, which still works fine on both computers.
I tried the first card in the second reader; it still fails.
I tried the second card in the firest reader; it works.

Hence, I think my card is really dead.

Anyhow, even if it’s dead, I’d love to understand how/why it happened.


I see that the card includes a signature counter (which reads 89), hence 
I understand the card has to write the EEPROM (to update the counter) 
each time I perform a signature. But I think 89 is a much too low a 
number to wear en EEPROM.

I have used my card much more for file decryption and for SSH 
authentication. Does the card write the EEPROM each time such an 
operation is performed? A rough guess is that I might have performed 
between 1,000 and 10,000 authentications with that card. I think it 
might be sufficient to wear an EEPROM.

Also, the card reports 2 tries left for the PIN code, which means that 
my last try to unlock the unlock the pin was a failure. Did the card 
somehow fail updating the retry counter? (Either when I typed the wrong 
pin, or now when I type the right one and it tries to reset the counter 
to 3…)

If there’s anything I can do to investigate that failure, please tell 
me.


Cheers,

-- 
Nicolas Boullis

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: “Hardware problem” with OpenPGP smart card

2020-12-07 Thread Werner Koch via Gnupg-users
On Sun,  6 Dec 2020 13:43, John Scott said:

>> PIN retry counter : 2 0 3
> It looks like you're trying to decrypt a file and your encryption PIN counter 
> is zero. I wonder why it was giving you the strange error message.

No, it is not at zero.  Since OpenPGP card specification version 2 we
only have two PINs and not a separate one for the encryption key.  Thus
the the secund number is always zero.  Well, not always: If you set a
reset code the second retry counter is set to 3.  Such a reset code is
an alternative to the Admin PIN.  If an organization does not want to
hand out the Admin PIN a reset code is instead set and the user can use
that reset code to unblock they PIN.

The show error code is indeed either a hardware error (EEPROM failure)
or due to a card reader which filters certyain commands send to the card
and return a bogus error code.  However, I doubt that the latter is the
case.

In any case, it is best to try a different reader and if possible a
different machine.


Shalom-Salam,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users