Yubikey provider not being recognized?

[icenfrosty]

I'm new to fortify & yubikey tooling; and exploring the capabilities of this application. Here's what I've done so far.

I have tested the yubikey and it appears to work correctly. I have also ran yubikey-piv-tool and able to read certificates; ie yubico-piv-tool -s 9(a|c|d) --action read-certificate and it comes back with the certificates. Yubikey manager appears to functioning correctly.

When I launch the Fortify Tools the only providers that show up are Mac Crypto & NSS Certificate DB. The Yubikey provider does not show up. I have tested this with firefox & chrome and the same results.

I looked into the ~/.fortify/config.json. Everything looks vanilla.
In ~/.fortify/card.json; I see

{
"id": "993988460d8f49a2ac519a2935f00533",
"name": "YubiKey",
"file": {
"osx": "/usr/local/lib/libykcs11.dylib",
"linux": "/usr/local/lib/libykcs11.so",
"windows": "%WINDIR/System32/libykcs11-1.dll"
}
},

I've confirmed that the dylib is in the matching location:

$ ls -talr /usr/local/lib/libykcs11.dylib
lrwxr-xr-x 1 root wheel 17 Jul 3 17:15 /usr/local/lib/libykcs11.dylib -> libykcs11.2.dylib

Any idea on next steps to look at to try to figure out why the Yubikey provider is not showing up? I've tried to follow all the documentation/postings I could find to debug; what am I doing wrong?

[rmhrisk]

Fortify has logging capabilities. If you look in the tray application menu, enable logging, insert token, and go back to tray application you can get the log. Please attach it here.

[icenfrosty]

Hi Ryan,

I'm attaching the fortify log from a "fresh" boot.

clean-boot.log

I see this interesting warn line:

{"level":"warn","message":"Cannot parse MessageSignedProtocol","source":"server","timestamp":"2022-07-09T21:00:54.092Z"}

I still don't see it as a provider.

Since the first post; I've pulled down the sample sign html/javascript demo. I put that into a docker image and launched it under localhost. Localhost shows up under the tool's trusted site. When I go to the localhost page; I see the certificates. I select the certificate serial that maps to the yubikey 9c slot for digital signing and press the continue. I get a popup saying "failed to sign xml". I subsequently tried selecting all the certificates. All w/ the same net result.

I'm also attaching the extended fortify.log

fortify.log

Here's the screenshot of the signing error.

Thanks for the quick feedback response and any assistance you can provide.

[icenfrosty]

I noticed; I skipped a step (pull token & reinsert token). So here's updated logs with

clean-boot-then-plugin-key.log

then attempt sign request

clean-boot-then-plugin-key-then-attempt-sign.log

[rmhrisk]

Can you reproduce this transaction and gather the console log of the sample when the error is thrown.

[microshine]

I see from your log file that Fortify sees token ATR: 3bfd1300008131fe158073c021c057597562694b657940 and uses Yubikey library for it.

{
  "cryptokiVersion": {
    "major": 2,
    "minor": 40
  },
  "firmwareVersion": {
    "major": 1,
    "minor": 0
  },
  "level": "info",
  "library": "/usr/local/lib/libykcs11.dylib",
  "libraryVersion": {
    "major": 2,
    "minor": 30
  },
  "manufacturerId": "Yubico (www.yubico.com)",
  "message": "PKCS#11 library information",
  "source": "provider",
  "timestamp": "2022-07-09T21:00:53.200Z"
}
{
  "id": "b16ca252e8404535a826bc598bfa670a4078da6ae6c599e8dbd03b2e8759d7a7",
  "level": "info",
  "library": "/usr/local/lib/libykcs11.dylib",
  "message": "Crypto provider was added to the list",
  "name": "Yubico Yubikey 4 OTP+U2F+CCID",
  "reader": "Yubico YubiKey OTP+FIDO+CCID",
  "source": "provider",
  "timestamp": "2022-07-09T21:00:53.201Z"
}

And I see the login action and getting of 5 certificates and 1 private key. But I don't see any errors. I agree with @rmhrisk, we need more information about the problem and see your console logs, because looks like the problem is on the client side

When I launch the Fortify Tools the only providers that show up are Mac Crypto & NSS Certificate DB. The Yubikey provider does not show up. I have tested this with firefox & chrome and the same results.

I'm wondering why it doesn't show the Yubikey provider in tools app. It must show the provider if because there are logs about the provider registering and it's items getting.

Maybe there are some problems with token event catching and this problem is not stable. Could you try to restart the Fortify app multiple times and check out that it doesn't show the Yubikey provider on each time

{"level":"warn","message":"Cannot parse MessageSignedProtocol","source":"server","timestamp":"2022-07-09T21:00:54.092Z"}

It's ok. It can't be a reason of the problem

[icenfrosty]

It does look like a javascript browser issue. I'm attaching 3 different files.

1. fortify.log (from clean boot through clicking "continue" on sign.html
2. console.log which is the html javascript browser log.
3. sign.html.log I've added additional logging to help isolate the issue.

Error looks like "TypeError: cyclic object value". I don't remember seeing this error over the weekend (not sure if that's being good or bad)

I think this is causing the error: var provider = await event.detail.socketProvider.getCrypto(providerId); Any ideas how to debug?

Secondarily, the providers still don't show up in the tools app; which is weird b/c I agree it appears it should be rendering based on the logs.

Thanks for helping me research these issues.

[microshine]

I've updated your script and uploaded it to codesandbox

https://codesandbox.io/s/issue-82-4d8hsf

It works fine with my Yubikey token.

Yubikey: 1.2.4
ATR: 3bfc1300008131fe15597562696b65794e454f7233e1

[microshine]

TypeError: cyclic object value

It occurs on JSON.stringify. To fix it, we need to implement toJSON method for all Proto objects in @webcrypto-local/proto module

[icenfrosty]

I've tested with your sandbox. Now I'm even more baffled. (yikes).

So it works. I saw the xmldsig. I'm pretty much 99.999999% certain I had selected the 2E:F8:6A:D6:AE:A2:F2:85:2A:30:15:BE:04:C8:59:D4:8B:47:3E:AA serial certificate. So I was like "cool" let me copy down the html/js and test locally.

After building a new nginx container (with sandbox code). It didn't work (huh?). I went to remove the trusted localhost site. Re-trusted it and tested again. Again no bueno. So I click one of the other certificates that listed. That worked! So essentially the other 3 slots now work somehow?

I went back to the sandbox and tested the 2E; which no longer works. But the other 3 certs do. So largely, I'm confused lol.

After that I closed down the browser again; and tried again. 2E works. Long story short I’m losing it :)
After multiple testing iterations toggling between 2E working or the other 3 certs. I’m cannot consistently reproduce working or not working. Getting the 2E key working is “more inconsistent” than the other 3 certs.

Here's the screenshot of the console log

It’s a real head scratcher.

The other piece I need clarification on for my own understanding. I thought Yubikey could only digitally sign based on the key in the 9C slot? I assumed that when it generates the key pair inside the Yubikey Manager; it would only give the type capability associated to the PIV slot type?

Based on the Yubikey documentation it says:

9A - authentication
9C - digital signature
9D - key mgmt
9E - card authentication

So how does xmldsig even work w/ 9A/D/E? Does fortify verify the key type operation mode?

[rmhrisk]

Keytype in this context is a PIVism and not something that fortify is aware of. If the device supports the operation then fortify uses it.

As for your inconsistent behavior without logs we can’t help.

[microshine]

I've got the same error with my test and here is my ticket

Yubico/yubico-piv-tool#392

You can call provider.logout() method after signing

[icenfrosty]

@microshine thanks for the tips... yeah that provider.logout allowed me to resign over and over (obviously had to refresh certs & re-pass pin b/c of logout).

really appreciate the assistance on wrapping my head around all this.

i guess my only remaining question is around the original question. why the fortify tools doesn't list the yubikey provider? I've tried to load that page multiple times and it's always blank (see original screen shot)...

any ideas on how to debug this? I agree that from the logs it says yubikey stuff but in the UI it's empty.

{ "cryptokiVersion": { "major": 2, "minor": 40 }, "firmwareVersion": { "major": 1, "minor": 0 }, "level": "info", "library": "/usr/local/lib/libykcs11.dylib", "libraryVersion": { "major": 2, "minor": 30 }, "manufacturerId": "Yubico (www.yubico.com)", "message": "PKCS#11 library information", "source": "provider", "timestamp": "2022-07-19T23:26:25.513Z" } { "id": "b16ca252e8404535a826bc598bfa670a4078da6ae6c599e8dbd03b2e8759d7a7", "level": "info", "library": "/usr/local/lib/libykcs11.dylib", "message": "Crypto provider was added to the list", "name": "Yubico Yubikey 4 OTP+U2F+CCID", "reader": "Yubico YubiKey OTP+FIDO+CCID", "source": "provider", "timestamp": "2022-07-19T23:26:25.514Z" }

but the debugging browser console

SocketProvider:on error [webcrypto-socket.min.mjs:1:140970](https://fortifyapp.com/external/webcrypto-local/client/1.6.5/webcrypto-socket.min.mjs) SocketProvider:on listening [webcrypto-socket.min.mjs:1:140970](https://fortifyapp.com/external/webcrypto-local/client/1.6.5/webcrypto-socket.min.mjs) SocketProvider:on close [webcrypto-socket.min.mjs:1:140970](https://fortifyapp.com/external/webcrypto-local/client/1.6.5/webcrypto-socket.min.mjs) SocketProvider:on token [webcrypto-socket.min.mjs:1:140970](https://fortifyapp.com/external/webcrypto-local/client/1.6.5/webcrypto-socket.min.mjs) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "WS:STATUS", state: "online" } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "DIALOG:CLOSE" } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "WS:ON_LISTENING" } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "APP:SET_STATE", state: {…}, … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "PROVIDER:SET_LIST", list: [], … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "PROVIDER:SET_LIST", list: (2) […], … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "ITEM:SELECT", id: undefined, … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "PROVIDER:UPDATE", result: {…}, id: undefined, … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:2:10](webpack:///src/middlewares/debug.js) Object { type: "APP:DATA_LOADED", state: true, … } [debug.js:3:10](webpack:///src/middlewares/debug.js) ============================== [debug.js:4:10](webpack:///src/middlewares/debug.js)

under the SET_LIST event (no yubikey):

Object { type: "PROVIDER:SET_LIST", list: (2) […], … } ​ "@@redux-saga/SAGA_ACTION": true ​ list: Array [ {…}, {…} ] ​​ 0: Object { id: "48b4f8235d37eeb9c3a31f04074fd23587f0bdd6", name: "MacOS Crypto", _name: "MacOS Crypto", … } ​​ 1: Object { id: "8bbae6f98340d7a92006c21da65c1acd345ba946", name: "NSS Certificate DB", _name: "NSS Certificate DB", … } ​​ length: 2 ​​ <prototype>: Array [] ​ type: "PROVIDER:SET_LIST" ​ <prototype>: Object { … }

thoughts?

[microshine]

@icenfrosty Have you tried to restart Fortify?

Maybe there are some problems with token event catching and this problem is not stable. Could you try to restart the Fortify app multiple times and check out that it doesn't show the Yubikey provider on each time

Fortify shows my Yubico token provider each time. I can't reproduce your problem