zaphodbbx / eidlib Goto Github PK

What steps will reproduce the problem?
1. Bpx on TLV.java line 115
2. Run in debug mode
3. You will never enter on that bpx.

What is the expected output? What do you see instead?

I just ran findbugs, appears that there's a serious bug in TLV.java

What version of the product are you using? On what operating system?

Windows 7 x64. Java7 32bit release 1.7.0_07


Please provide any additional information below.

Bug: Bad comparison of signed byte with 255 in 
be.belgium.eid.eidcommon.TLV.parse(byte[])

Signed bytes can only have a value in the range -128 to 127. Comparing a signed 
byte with a value outside that range is vacuous and likely to be incorrect. To 
convert a signed byte b to an unsigned value in the range 0..255, use 0xff & b 

Confidence: High, Rank: Scariest (2)
Pattern: INT_BAD_COMPARISON_WITH_SIGNED_BYTE 
Type: INT, Category: CORRECTNESS (Correctness)



Solution:

Replace while (byteacterStream[i] == 0xFF) {
By while ((byteacterStream[i] & 0xFF) == 0xFF) {

What steps will reproduce the problem?
1. Read a card
2. Error is thrown
3. No data is readed

What is the expected output? What do you see instead?
Expected output should be normal reading

What version of the product are you using? On what operating system?
OS is Windows 7 64 Bit

Please provide any additional information below.

The printstacktrace of the program is:
be.belgium.eid.exceptions.EIDException: EID Exception: 
sun.security.smartcardio.PCSCException: Unknown error 0x8010002f
    at be.belgium.eid.eidlib.BeID.getIDData(BeID.java:200)
    at be.practimed.eidnascholing.controller.StartController$1.cardInserted(StartController.java:139)
    at be.belgium.eid.event.CardAlivePromptTask.run(CardAlivePromptTask.java:85)
Caused by: javax.smartcardio.CardException: 
sun.security.smartcardio.PCSCException: Unknown error 0x8010002f
    at sun.security.smartcardio.ChannelImpl.doTransmit(Unknown Source)
    at sun.security.smartcardio.ChannelImpl.transmit(Unknown Source)
    at be.belgium.eid.eidlib.SmartCard.transmitAPDU(SmartCard.java:279)
    at be.belgium.eid.eidlib.SmartCard.selectFile(SmartCard.java:308)
    at be.belgium.eid.eidlib.SmartCard.readFile(SmartCard.java:379)
    at be.belgium.eid.eidlib.BeID.getIDData(BeID.java:179)
    ... 2 more
Caused by: sun.security.smartcardio.PCSCException: Unknown error 0x8010002f
    at sun.security.smartcardio.PCSC.SCardTransmit(Native Method)
    ... 8 more

Is it possible to give feedback as soon as possible. I'm working on a project 
with this. And by the way, thanks for your library it's very useful

What steps will reproduce the problem?
1. Open GUI
2. Read data

What is the expected output? What do you see instead?
When doing erroneous operations, the system prints a stack trace instead 
of reporting the error. The BEIDGUI however, is more a proof of concept 
than a robust application. One day I will work on this, but I like the 
library itself to be as robust as possible and thus not waste time on some 
sample applications.

The IDData parser (and address file parser) could be driven by Java 5
annotations which would make it some more elegant and would prepare the
eidlib for future versions of the eID card (if the file content changes).
For example:

@FileLocation({0xfile, 0xid, 0xhere})
class ID {
 @TLVField(0xthe_tag_id)
 String name;
 ...
}

The generic parser could use the Java reflection API to convert the TLV
file to an ID object. Example:

ID id = TLVParser.parse(ID.class, ...);

What steps will reproduce the problem?
1. Using a Vasco Digipass 920 card reader and a functioning eID
2. Calling verifyPIN() or generateSignature() on an instance of BeID


What is the expected output? What do you see instead?
Expected: A byte array containing signature
Instead:
EID Exception: The returned status word values 105 and 133 should have been 
0x90 and 0x00.
Caused by: be.belgium.eid.exceptions.InvalidSWException: The returned status 
word values 105 and 133 should have been 0x90 and 0x00.
 at be.belgium.eid.eidlib.SmartCard.verifyPIN(SmartCard.java:601)
 at be.belgium.eid.eidlib.BeID.generateSignature(BeID.java:430)

What version of the product are you using? On what operating system?
 jEidlib_1.1.jar
 Windows 7 (64 bit)

When use the library whith an applet the new belgium card (2014) can not beeing 
read.  

What steps will reproduce the problem?
1. Read information from the card.
2.
3.

What is the expected output? What do you see instead?
Although it is not really a defect, it is rather annoying. On Windows 
computers when reading multiple files after each other, the select file 
command of the next file throws a PCSCException with an UnknownError with 
ID 0x6F7. When having written a Thread.sleep(500) at the end of the read 
File command, the error does not occur. I think this has something to do 
with the read command giving control back to the application too soon 
which causes upstream data to collide with the downstream data. 

I don't think I can do anything about it. The defect is also not really a 
defect, but more a cumbersome slow-down. I can however try to sharpen the 
time to sleep, but this could cause the library not to work on certain 
PC's that read the data slower. 

I could also advise to use Linux ^_^.

This library is working as expected on Java SE 6 64 bits  (Snow Leopard) - 
Great Job !

Please update doc and wiki accordingly

Seb

What steps will reproduce the problem?
        try {
            final BeID eID = new BeID(false);
            CertificateChain chain = eID.getCertificateChain();
            if (!eID.verifyOCSP(chain)) {
                System.out.println("ERROR ?");
            }

        } catch (EIDException e) {
            System.err.println("EIDException: " + e.getMessage());
        }

What is the expected output? What do you see instead?
eID.verifyOCSP(chain) should return true with no exception
The current ouput is:
Exception in thread "main" java.lang.NoSuchFieldError: id_pkix_ocsp_nonce
    at be.belgium.eid.security.OCSPClient.generateOCSPRequest(OCSPClient.java:54)
    at be.belgium.eid.security.OCSPClient.processOCSPRequest(OCSPClient.java:92)
    at be.belgium.eid.eidlib.BeID.verifyOCSP(BeID.java:542)


What version of the product are you using? On what operating system?
Win7, valid identity card.


Please provide any additional information below.

Using Apache Maven 2 as build system would make the library independent of
the used IDE. Pushing the eidlib to an official Maven 2 repository would
also increase the visibility of the library.

This patch speeds up card reading significantly. (24s -> 8s in our case)
This is done by caching the results of SmartCard.readFile()

Tried the verifyOCSP like this:
out.println("OCSP validation:" + 
Boolean.toString(eID.verifyOCSP(eID.getCertificateChain())));

gives a stacktrace

saying the bouncycastleProvider can't be found.
imported the newest veresion of bouncycastle's project, but no improvement.
Are you using a specific version?

Can the eid library be used in combination with sha512 security algorithm?

What steps will reproduce the problem?
1. Read data that contains special marks such as é

What is the expected output? What do you see instead?
We would expect é to be returned. Some odd symbols are shown instead.

What steps will reproduce the problem?
1. take an ID card with birthdate in july
2. read Birthdate... 

What is the expected output? What do you see instead?

1 July 1977 becomes 1 Juny 1977

What version of the product are you using? On what operating system?

Problem exists on both Windows and Linux

Please provide any additional information below.

be/belgium/eid/eidcommon/FormattedTLV.java
Lines 165-166:
                        replacements.put("JUIN", "JUN");
                        replacements.put("JUIL", "JUN");

Second should probably convert to JUL instead of JUN

the problem may appear at some other places (I didn't check the whole source 
tree)

What steps will reproduce the problem?
1. Insert a 2010 eid card into the reader.
2. get the card number from the card (getIDData().getCardNumber();)

What is the expected output? 
the card number.

What do you see instead?
nullpointerexception

What version of the product are you using? On what operating system?
latest version

What steps will reproduce the problem?
Read an electronic card with a date of birth

What is the expected output? What do you see instead?
An example: 31 July 82 -> [reading] -> 01 July 82

What version of the product are you using? On what operating system?
Last version. Windows 8 64 bits

Please provide any additional information below.
In some cases a birth date in July returns a date of birth in June

This patch adds support for the newer root certificate, used on BeID cards 
after 17 october 2008.