GNU POC Henning Koester, henning@crackinghacking.de V1.2, Wed May 16 16:06:46 CEST 2001 This document describes how to use GNU POC (Passwords On Card). ______________________________________________________________________ Table of Contents 1. Introduction 2. Installation 3. Invocation 4. Upgrade from 1.0 to 1.1 5. How does POC work? 6. Contact ______________________________________________________________________ 11.. IInnttrroodduuccttiioonn With GNU POC you can manage passwords on smartcards (only I2C memory cards at the moment). Every entry on the card consits of a password and a description, which gives information about the password. All data is stored encrypted on the card. Thus it's impossible for someone to get the passwords, when he/she finds/steals the card. poc makes use of the CT-API library _(_h_t_t_p_:_/_/_w_w_w_._l_i_n_u_x_n_e_t_._c_o_m_/_s_m_a_r_t_c_a_r_d_/_c_t_a_p_i_/_c_t_a_p_i_._h_t_m_l_) to access cards. So you'll need a CT-API library to use poc. I use the CT-API library by Carlos Prados _(_h_t_t_p_:_/_/_w_w_w_._g_e_o_c_i_t_i_e_s_._c_o_m_/_c_p_r_a_d_o_s_) for TOWITOKO readers. poc was developed under Debian GNU/Linux. It migh work on other *IX systems as well. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. POC is free software and distributed under the terms of the GNU General Public License. 22.. IInnssttaallllaattiioonn Installing poc is easy. Unpack the archive, change to the correct directory and type: ./configure make If everything works fine, you can execute make install make install-docs (optional) to install the binary and poc's manpage. Note: Normally only root can access com-ports. So you have to explicit allow people to read and write to the ports, by adding them to the appropiate group. 33.. IInnvvooccaattiioonn COMMANDS [-s | --save-password] _S_a_v_e _a _p_a_s_s_w_o_r_d_: First you will be asked for a password and a description of the password. After that you have to enter the card's key. You'll see "Password saved.", if everything worked. Otherwise an error message will be printed. [-r DESCRIPTION | --remove-password=DESCRIPTION] _R_e_m_o_v_e _a _p_a_s_s_w_o_r_d_: You'll be asked to enter the card's key. If everything worked and poc removed a password you'll see "Password removed." [-l DESCRIPTION | --list-password=DESCRIPTION] _L_i_s_t _a _p_a_s_s_w_o_r_d_: You'll be asked to enter the card's key. If a description is found, which matches the given one, poc will print the password and the corresponding description. [-f | --format-card] _F_o_r_m_a_t _a _c_a_r_d_: You have to enter the size of the card and confirm the card's formatting. [-c | --change-cardkey] _C_h_a_n_g_e _t_h_e _c_a_r_d_'_s _k_e_y_: You'll be asked for the current key and then for the new key. [--backup=FILE] _B_a_c_k_u_p _a _c_a_r_d_: A backup of the card's memory will be made to "FILE". [--restore=FILE] _R_e_s_t_o_r_e _a _b_a_c_k_u_p_e_d _c_a_r_d_: "FILE" is an image of a backuped card. It will be written to the card. You are responsible for a card with enough size to hold the backuped image. poc does not check whether the card has sufficient size or not. OPTIONS [--cipher=CHIPER] _S_e_l_e_c_t_i_n_g _a _c_i_p_h_e_r_: This option allows you to change the cipher which will be used for encryption. You can choose between "AES" and "BLOWFISH". By default poc will use AES for encryption. If you want to use BLOWFISH instead of AES, but don't want to specify it every time you invoke poc, you can set the environment variable "POC_CIPHER" to avoid it. (if you are using the bash: "export POC_CIPHER=BLOWFISH") [--security=LEVEL] _S_e_l_e_c_t_i_n_g _t_h_e _s_e_c_u_r_i_t_y _l_e_v_e_l_: You can choose which security level to use. There are two available "1" and "2". If you select "1" a 192 bit key will be used for encryption. And if you select "2" a 256 bit key will be used. As well as for the cipher selection you can set an environment variable for the security level selection. The variable is "POC_SL" and must be set to "1" or "2". [-p NUM | --port=NUM] _S_e_t _t_h_e _c_o_m_p_o_r_t _w_h_e_r_e _t_h_e _c_a_r_d _r_e_a_d_e_r _i_s _i_n_s_t_a_l_l_e_d_: This let's you specify where to find the card reader. NUM can be 1...4. 44.. UUppggrraaddee ffrroomm 11..00 ttoo 11..11 _*_*_* _Y_o_u _c_a_n_n_o_t _u_s_e _c_a_r_d_s _w_h_i_c_h _h_a_v_e _b_e_e_n _m_a_d_e _w_i_t_h 11..00 with 11..11 *** List all passwords: poc -l all > FILE NOTE: FILE should be not readable by other users! Format the card: poc -f And then add all password again. 55.. HHooww ddooeess PPOOCC wwoorrkk?? FFoorrmmaatt ooff tthhee ccaarrdd''ss mmeemmoorryy The first 2 byte of the card contain the card's size. Byte 3 and 4 contain the data size (the data size is the number of bytes of the data area which are used.) From the 5'th byte starts the data area, which is the area of the card where the passwords+descriptions are stored. The data area is encrypted. EEnnccrryyppttiioonn The encryption key entered by the user is hashed using Tiger (192 bit key), or SHA-2 (256 bit key). In the next step this hashed key is passed to the ciphers key-scheduleing function. And finally the data area is encrypted using one of the ciphers in OFB mode. (Take a look at _h_t_t_p_:_/_/_h_o_m_e_._e_c_n_._a_b_._c_a_/ _j_s_a_v_a_r_d_/_c_r_y_p_t_o_/_c_o_0_4_0_9_._h_t_m for a description of different block cipher modes.) 66.. CCoonnttaacctt If you have suggestions or want to report bugs mail to bug-poc@gnu.org . If you want to contact me, you can mail to henning@crackinghacking.de .