move old documents to doc/note

diff --git a/README b/README
index b617cb6..b80aaaa 100644 (file)
--- a/README
+++ b/README
@@ -594,7 +594,7 @@ RSA), you can import them.
 Gnuk supports key generation, but this feature is young and should be
 considered experimental.
 
 Gnuk supports key generation, but this feature is young and should be
 considered experimental.
 

-For detail, please see doc/DEMO and doc/DEMO-2.
+For detail, please see doc/note/DEMO and doc/note/DEMO-2.

 
 Note that it make sense to preserve your keys on your computer so that
 you can import the keys (again) to (possibly another) Gnuk Token.  In
 
 Note that it make sense to preserve your keys on your computer so that
 you can import the keys (again) to (possibly another) Gnuk Token.  In


@@ -656,7 +656,7 @@ linux/Documentation/usb/usbmon.txt
 Firmware update
 ===============
 
 Firmware update
 ===============
 

-See doc/firmware-update.
+See doc/note/firmware-update.

 
 
 Read-only Git Repository
 
 
 Read-only Git Repository

diff --git a/doc/DEMO b/doc/DEMO
deleted file mode 100644 (file)
index 76946b1..0000000
--- a/doc/DEMO
+++ /dev/null
@@ -1,920 +0,0 @@
-Demonstration of Gnuk
-*********************
-
-In this text, I record my interaction to Gnuk.  It consists two parts,
-a GnuPG session on host side and debug output from the target.
-
-
-Generate RSA 2048-bit key
-=========================
-
-$ gpg --gen-key
-gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
-This is free software: you are free to change and redistribute it.
-There is NO WARRANTY, to the extent permitted by law.
-
-Please select what kind of key you want:
-   (1) RSA and RSA (default)
-   (2) DSA and Elgamal
-   (3) DSA (sign only)
-   (4) RSA (sign only)
-Your selection? 1
-RSA keys may be between 1024 and 4096 bits long.
-What keysize do you want? (2048) 
-
-Requested keysize is 2048 bits
-Please specify how long the key should be valid.
-         0 = key does not expire
-      <n>  = key expires in n days
-      <n>w = key expires in n weeks
-      <n>m = key expires in n months
-      <n>y = key expires in n years
-Key is valid for? (0) 
-
-Key does not expire at all
-Is this correct? (y/N) y
-
-You need a user ID to identify your key; the software constructs the user ID
-from the Real Name, Comment and Email Address in this form:
-    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
-
-Real name: Niibe Yutaka
-Email address: gniibe@fsij.org
-Comment: FSIJ USB Token v2
-You selected this USER-ID:
-    "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-
-Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
-You need a Passphrase to protect your secret key.
-
-We need to generate a lot of random bytes. It is a good idea to perform
-some other action (type on the keyboard, move the mouse, utilize the
-disks) during the prime generation; this gives the random number
-generator a better chance to gain enough entropy.
-..............+++++
-.+++++
-We need to generate a lot of random bytes. It is a good idea to perform
-some other action (type on the keyboard, move the mouse, utilize the
-disks) during the prime generation; this gives the random number
-generator a better chance to gain enough entropy.
-+++++
-..+++++
-gpg: key D849F25D marked as ultimately trusted
-public and secret key created and signed.
-
-gpg: checking the trustdb
-gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
-gpg: depth: 0  valid:   4  signed:  52  trust: 0-, 0q, 0n, 0m, 0f, 4u
-gpg: depth: 1  valid:  52  signed:  35  trust: 1-, 0q, 0n, 2m, 49f, 0u
-gpg: depth: 2  valid:  11  signed:  21  trust: 0-, 0q, 0n, 0m, 11f, 0u
-gpg: depth: 3  valid:   1  signed:   1  trust: 0-, 0q, 0n, 1m, 0f, 0u
-gpg: next trustdb check due at 2010-08-26
-pub   2048R/D849F25D 2010-08-26
-      Key fingerprint = 2CF6 AF50 1034 FDFE DCD9  80E3 4FF1 4AC4 D849 F25D
-uid                  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-sub   2048R/AB28AFD3 2010-08-26
-$
-
-
-Test Gnuk works 
-===============
-
-$ gpg --card-status
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-Application ID ...: D276000124010200FFFE000000010000
-Version ..........: 2.0
-Manufacturer .....: unmanaged S/N range
-Serial number ....: 00000001
-Name of cardholder: [not set]
-Language prefs ...: [not set]
-Sex ..............: unspecified
-URL of public key : [not set]
-Login data .......: [not set]
-Signature PIN ....: forced
-Key attributes ...: 2048R 2048R 2048R
-Max. PIN lengths .: 127 127 127
-PIN retry counter : 3 0 3
-Signature counter : 0
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-General key info..: [none]
-$
-
-
-Parsonalize the card
-====================
-
-$ gpg --card-edit
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-Application ID ...: D276000124010200FFFE000000010000
-Version ..........: 2.0
-Manufacturer .....: unmanaged S/N range
-Serial number ....: 00000001
-Name of cardholder: [not set]
-Language prefs ...: [not set]
-Sex ..............: unspecified
-URL of public key : [not set]
-Login data .......: [not set]
-Signature PIN ....: forced
-Key attributes ...: 2048R 2048R 2048R
-Max. PIN lengths .: 127 127 127
-PIN retry counter : 3 0 3
-Signature counter : 0
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-General key info..: [none]
-
-gpg/card> passwd
-gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
-gpg: gpg-agent is not available in this session
-
-Please enter the PIN
-Enter PIN:            
-New PIN
-Enter New PIN:                
-New PIN
-Repeat this PIN:                  PIN changed.
-
-gpg/card> admin
-Admin commands are allowed
-
-gpg/card> sex
-Sex ((M)ale, (F)emale or space): m
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN:                  
-gpg/card> name
-Cardholder's surname: Niibe
-Cardholder's given name: Yutaka
-
-gpg/card> login
-Login data (account name): gniibe
-
-gpg/card> url
-URL to retrieve public key: http://www.gniibe.org/gniibe.asc
-
-gpg/card> lang
-Language preferences: ja
-
-gpg/card> passwd
-gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? 3
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN:                  
-New Admin PIN
-Enter New Admin PIN:                      
-New Admin PIN
-Repeat this PIN:                  PIN changed.
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? 4
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN:                  
-New Reset Code
-Enter New PIN:                
-New Reset Code
-Repeat this PIN:                  Reset Code set.
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? q
-
-gpg/card> quit
-$
-
-
-Key import to the card
-======================
-
-$ gpg --edit-key d849f25d
-gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
-This is free software: you are free to change and redistribute it.
-There is NO WARRANTY, to the extent permitted by law.
-
-Secret key is available.
-
-pub  2048R/D849F25D  created: 2010-08-26  expires: never       usage: SC  
-                     trust: ultimate      validity: ultimate
-sub  2048R/AB28AFD3  created: 2010-08-26  expires: never       usage: E   
-[ultimate] (1). Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-
-gpg> toggle
-
-sec  2048R/D849F25D  created: 2010-08-26  expires: never     
-ssb  2048R/AB28AFD3  created: 2010-08-26  expires: never     
-(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-
-gpg> keytocard
-Really move the primary key? (y/N) y
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-
-Please select where to store the key:
-   (1) Signature key
-   (3) Authentication key
-Your selection? 1
-
-You need a passphrase to unlock the secret key for
-user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-2048-bit RSA key, ID D849F25D, created 2010-08-26
-
-gpg: gpg-agent is not available in this session
-Enter passphrase:                   gpg: writing new key
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN:                  
-sec  2048R/D849F25D  created: 2010-08-26  expires: never     
-                     card-no: FFFE 00000001
-ssb  2048R/AB28AFD3  created: 2010-08-26  expires: never     
-(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-
-gpg> key 1
-
-sec  2048R/D849F25D  created: 2010-08-26  expires: never     
-                     card-no: FFFE 00000001
-ssb* 2048R/AB28AFD3  created: 2010-08-26  expires: never     
-(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-
-gpg> keytocard
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-
-Please select where to store the key:
-   (2) Encryption key
-Your selection? 2
-
-You need a passphrase to unlock the secret key for
-user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-2048-bit RSA key, ID AB28AFD3, created 2010-08-26
-
-Enter passphrase:                   gpg: writing new key
-
-sec  2048R/D849F25D  created: 2010-08-26  expires: never     
-                     card-no: FFFE 00000001
-ssb* 2048R/AB28AFD3  created: 2010-08-26  expires: never     
-                     card-no: FFFE 00000001
-(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
-
-gpg> quit
-Save changes? (y/N) y
-$
-
-
-Making Digital signature
-========================
-
-$ gpg -u d849f25d --clearsign README
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-gpg: signatures created so far: 0
-
-Please enter the PIN
-[sigs done: 0]
-gpg: gpg-agent is not available in this session
-$ gpg --verify README.asc
-gpg: Signature made Mon Sep 13 11:28:00 2010 JST using RSA key ID D849F25D
-gpg: Good signature from "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-$
-
-
-Decryption using Gnuk
-=====================
-
-$ gpg -u d849f25d --encrypt README
-You did not specify a user ID. (you may use "-r")
-
-Current recipients:
-
-Enter the user ID.  End with an empty line: d849f25d
-
-Current recipients:
-2048R/AB28AFD3 2010-08-26 "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-
-Enter the user ID.  End with an empty line: 
-$ gpg --decrypt README.gpg 
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-
-Please enter the PIN
-gpg: gpg-agent is not available in this session
-Enter PIN:            gpg: verify CHV2 failed: bad passphrase
-gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
-      "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-gpg: public key decryption failed: bad passphrase
-gpg: decryption failed: secret key not available
-$ gpg --decrypt README.gpg 
-gpg: detected reader `FSIJ USB Token (20100910) 00 00'
-
-Please enter the PIN
-gpg: gpg-agent is not available in this session
-Enter PIN:            gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
-      "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
-[... output of README ... ]
-$
-
-
-Corresponding DEBUG output
-==========================
-
-$ cu -l /dev/ttyACM0
-^GConnected.
-ON
-ON
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   0065
-GPG!: 20001284
- - Get Data
-   005b
-GPG!: 20001284
- - Get Data
-   5f2d
-GPG!: 20001284
- - Get Data
-   5f35
-GPG!: 20001284
- - Get Data
-   5f50
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   007a
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   0065
-GPG!: 20001284
- - Get Data
-   005b
-GPG!: 20001284
- - Get Data
-   5f2d
-GPG!: 20001284
- - Get Data
-   5f35
-GPG!: 20001284
- - Get Data
-   5f50
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   007a
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   007a
-GPG!: 20001284
-Change PW
-01
-flash DO
-flash DO...done
-Changed DO_KEYSTRING_PW1.
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - VERIFY
-83
-good
-GPG!: 20001284
- - PUT DATA
-   5f35
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   005b
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   005e
-flash DO
-flash DO...done
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - PUT DATA
-   5f50
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   5f2d
-flash DO
-flash DO...done
-GPG!: 20001284
- - Get Data
-   005b
-GPG!: 20001284
- - Get Data
-   5f2d
-GPG!: 20001284
- - Get Data
-   5f35
-GPG!: 20001284
- - Get Data
-   5f50
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   007a
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
-Change PW
-03
-Random: 000028ca
-Random: 00004d02
-flash DO
-flash DO...done
-done.
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - VERIFY
-83
-good
-GPG!: 20001284
- - PUT DATA
-   00d3
-Resetting Code!
-done (no prvkey).
-flash DO
-flash DO...done
-flash DO
-flash DO...done
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   0065
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - VERIFY
-83
-good
-GPG!: 20001284
- - PUT DATA
-   3fff
- 4d 82 01 16 b6 00 7f 48 08 91 04 92 81 80 93 81
- 80 5f 48 82 01 04 00 01 00 01 ee 1c 56 89 bf c7
- 78 9d b4 2b 30 2f 69 2d e4 ac 3f d8 79 83 60 02
- c0 b4 88 7d 46 4d be c3 ad 69 77 02 c1 3a 84 a1
- 0b 61 5c 73 79 b6 04 27 29 f7 f3 58 1d 31 45 cd
- 7d b0 1c d4 90 f8 fa 98 45 19 52 4b f0 f2 bc 5f
- 86 e5 2f 85 67 55 a3 3d f2 7f 57 66 c5 ce 5d ac
- 3f 72 d8 25 35 30 a9 73 e3 8a b9 8a b5 42 95 a0
- 73 8a 04 d7 4a 05 67 9c 8c 0b d4 56 0e 99 44 07
- 6e f9 aa 24 ce 88 07 ff 9d 39 f8 57 33 95 bc b9
- 96 64 cf 67 c2 bb c0 b4 a1 b0 44 ee e7 6b c9 6a
- ea ec e0 14 8c 57 00 39 04 20 7d 99 df f8 50 23
- 1e 80 79 ea 86 9b 2c 4d b8 4f 8c d3 7e 08 99 9b
- 63 ca 8f 93 dd 9f ce b6 ff 81 9e 53 86 79 70 52
- e8 5b be b0 62 ca 52 42 85 46 c0 6c 50 7d d1 9d
- 51 b6 c3 9e 2c d3 1a 60 e9 8a 62 2e 4e 67 d7 8d
- aa 31 f3 b3 2d 78 22 4c de fa 44 b7 6f a6 2c 08
- 09 da 3d 51 ab 8c 83 9c 29 e7
-Key import
-0100
-Getting keystore address...
-key_addr: 0800e800
-Random: 00001265
-Random: 00003e52
-ENC
- ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
- 3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
- 77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
- f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
- 52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
- 57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
- b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
- d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
- f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
- 44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
- 7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
- 8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
- 9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
- c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
- 62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
- 44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
- 1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
-
-ENC
- 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
-
-ENC
- 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
-
-ENC
- 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
-
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   00c7
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   00ce
-flash DO
-flash DO...done
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - PUT DATA
-   3fff
- 4d 82 01 16 b8 00 7f 48 08 91 04 92 81 80 93 81
- 80 5f 48 82 01 04 00 01 00 01 dd 7a 0f 38 d9 e5
- 29 e3 14 47 d9 b5 4e a7 f1 cf b0 8e 7c a4 9b 39
- 57 e0 ab 36 39 f5 97 0b 96 ac cd 8c c9 e3 de 45
- 0a 48 93 84 8a 14 ea cd 9b 91 1f d5 31 52 76 b0
- 60 e0 42 65 ab b3 dc 85 4c 6c 64 1c 13 83 89 4d
- b4 75 03 2d 11 38 29 72 5e 4b 89 4e c0 da 72 e5
- 1e 53 82 a7 e2 e8 f1 05 07 47 8d 72 02 46 c8 95
- 4d 52 6d e8 9d 28 75 d5 65 b3 2e f3 c1 a1 fb 5b
- 45 fa 4a 12 b1 04 3f 81 65 f5 ef a9 51 2b a2 13
- 60 5a 95 c1 c2 13 26 05 14 d5 9e 05 ec de 0a c1
- 53 1a d8 3e b0 5b d4 87 55 79 26 ff e5 91 79 96
- e9 98 a8 6f 54 eb e6 d7 a6 ba 81 fc a3 cc e7 5b
- 7a a0 7e 37 e1 4e af 82 f1 57 9b df bd 4f 18 65
- f2 b3 ab 7e 08 16 e6 d6 bf 6b 3f 9a 16 2a 1a 8c
- 2d c6 57 5a 48 3e 5a 43 96 19 a4 15 cf ef a5 be
- ab 48 97 09 e1 64 94 6e 88 c3 04 cd c9 5b 54 b0
- 95 38 5a 4d 0b a6 86 70 5c 1d
-Key import
-0100
-Getting keystore address...
-key_addr: 0800ea00
-Random: 00007dfd
-Random: 0000ac26
-ENC
- dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
- b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
- cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
- 1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
- 64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
- 89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
- 8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
- 2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
- ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
- 9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
- 26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
- 81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
- 9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
- 3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
- a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
- 04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
- 4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
-
-ENC
- 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
-
-ENC
- 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
-
-ENC
- 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
-
-flash DO
-flash DO...done
-flash DO
-flash DO...done
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   00c8
-flash DO
-flash DO...done
-GPG!: 20001284
- - PUT DATA
-   00cf
-flash DO
-flash DO...done
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   007a
-GPG!: 20001284
- - VERIFY
-81
-verify_pso_cds
-06
-DEC
- 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
-
-DEC
- ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
- 3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
- 77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
- f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
- 52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
- 57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
- b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
- d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
- f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
- 44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
- 7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
- 8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
- 9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
- c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
- 62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
- 44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
- 1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
-
-good
-GPG!: 20001284
- - PSO: 20001264
-0023
-RSA sign...ok...done.
-flash DO
-flash DO...done
-PSO done.
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - VERIFY
-82
-verify_pso_other
-DEC
- 1a d0 32 c3 06 c8 68 58 0c 5a 7b 81 80 62 2c 45
-
-DEC
- a0 e8 98 60 66 36 93 0e f2 cd e5 56 3c ca aa 0a
- d7 b1 5e 1f 97 20 1b c0 86 98 a5 fb bf da b3 c6
- 24 18 d9 8c e2 a1 c0 5c c1 7f 8d 8f 44 1d d3 78
- 30 97 da 55 6b 63 a4 3e 6f ad 4b c3 1e fa 6f 64
- 22 7b b3 63 c6 b5 2f 4b 84 cd e1 b4 12 3a a3 76
- 75 96 05 f8 a3 b4 9a 04 7c f4 e3 7a 47 c1 10 82
- f3 8b 5f d0 7a de 46 1a 7b d6 71 7d 11 f8 91 9e
- 03 6e af eb 9a 1a c2 3c 54 da fd 07 1f 94 b8 6c
- 14 3e c3 9e e0 57 65 56 cd af 59 74 27 06 72 56
- 35 1e 4b 8b fe 71 1a 6e 73 9a 59 b6 eb 61 35 81
- bf df d2 45 a3 be 4f a9 65 fe 6a b8 7e 60 0e e2
- 14 a4 bc f7 ef a1 f1 49 4e 67 e3 0a 37 ea 30 10
- c6 7f 20 94 91 2b 38 1a dc 90 c1 f5 b7 22 c7 0e
- 46 08 91 a0 ec 12 35 60 46 d4 9d f5 cb 00 b7 21
- 89 ae 8f 83 aa 24 c8 3b e5 25 ae 71 c6 3a 3f ae
- 90 47 86 1c 42 f4 fc 56 7c 9a 39 55 90 89 42 20
- 51 d0 e3 dc 45 c3 1f f7 69 26 36 f6 66 14 26 de
-
-gpg_do_load_prvkey failed.
-flash DO
-flash DO...done
-failed
-GPG!: 20001284
- - select DF by name
-GPG!: 20001284
- - Get Data
-   004f
-GPG!: 20001284
- - Get Data
-   5f52
-GPG!: 20001284
- - Get Data
-   00c4
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   005e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - Get Data
-   006e
-GPG!: 20001284
- - VERIFY
-82
-verify_pso_other
-DEC
- 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
-
-DEC
- dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
- b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
- cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
- 1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
- 64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
- 89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
- 8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
- 2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
- ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
- 9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
- 26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
- 81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
- 9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
- 3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
- a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
- 04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
- 4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
-
-flash DO
-flash DO...done
-good
-GPG!: 20001284
- - PSO: 20001264
-0101
-RSA decrypt:20001234
-00000100
-RSA decrypt ...done.
-PSO done.
--- 

diff --git a/doc/DEMO-2 b/doc/DEMO-2
deleted file mode 100644 (file)
index 022e715..0000000
--- a/doc/DEMO-2
+++ /dev/null
@@ -1,233 +0,0 @@
-$ unset GPG_AGENT_INFO
-$ gpg --card-edit
-
-gpg: detected reader `FSIJ USB Token (20101023) 00 00'
-Application ID ...: D276000124010200F517000000010000
-Version ..........: 2.0
-Manufacturer .....: unknown
-Serial number ....: 00000001
-Name of cardholder: [not set]
-Language prefs ...: [not set]
-Sex ..............: unspecified
-URL of public key : [not set]
-Login data .......: [not set]
-Signature PIN ....: forced
-Key attributes ...: 2048R 2048R 2048R
-Max. PIN lengths .: 127 127 127
-PIN retry counter : 3 0 3
-Signature counter : 0
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-General key info..: [none]
-
-gpg/card> passwd
-gpg: OpenPGP card no. D276000124010200F517000000010000 detected
-gpg: gpg-agent is not available in this session
-
-Please enter the PIN
-Enter PIN: 123456
-           
-New PIN
-Enter New PIN: *************
-               
-New PIN
-Repeat this PIN: *************
-PIN changed.
-
-gpg/card> admin
-Admin commands are allowed
-
-gpg/card> sex
-Sex ((M)ale, (F)emale or space): m
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN: 12345678
-                 
-gpg/card> name
-Cardholder's surname: Niibe
-Cardholder's given name: Yutaka
-
-gpg/card> login
-Login data (account name): gniibe
-
-gpg/card> url
-URL to retrieve public key: http://www.gniibe.org/gniibe.asc
-
-gpg/card> lang
-Language preferences: ja
-
-gpg/card> passwd
-gpg: OpenPGP card no. D276000124010200F517000000010000 detected
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? 3
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN: 12345678
-                 
-New Admin PIN
-Enter New Admin PIN: ***************
-                     
-New Admin PIN
-Repeat this PIN: ***************
-PIN changed.
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? 4
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN: ***************
-                 
-New Reset Code
-Enter New PIN: ************
-               
-New Reset Code
-Repeat this PIN: ************
-Reset Code set.
-
-1 - change PIN
-2 - unblock PIN
-3 - change Admin PIN
-4 - set the Reset Code
-Q - quit
-
-Your selection? q
-
-gpg/card> quit
-$ gpg --edit-key 4CA7BABE
-gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
-This is free software: you are free to change and redistribute it.
-There is NO WARRANTY, to the extent permitted by law.
-
-Secret key is available.
-
-pub  2048R/4CA7BABE  created: 2010-10-15  expires: never       usage: SC  
-                     trust: ultimate      validity: ultimate
-sub  2048R/084239CF  created: 2010-10-15  expires: never       usage: E   
-sub  2048R/5BB065DC  created: 2010-10-22  expires: never       usage: A   
-[ultimate] (1). NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> toggle
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-ssb  2048R/084239CF  created: 2010-10-15  expires: never     
-ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> keytocard
-Really move the primary key? (y/N) y
-gpg: detected reader `FSIJ USB Token (20101023) 00 00'
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-
-Please select where to store the key:
-   (1) Signature key
-   (3) Authentication key
-Your selection? 1
-
-You need a passphrase to unlock the secret key for
-user: "NIIBE Yutaka <gniibe@fsij.org>"
-2048-bit RSA key, ID 4CA7BABE, created 2010-10-15
-
-gpg: gpg-agent is not available in this session
-gpg: writing new key
-gpg: 3 Admin PIN attempts remaining before card is permanently locked
-
-Please enter the Admin PIN
-Enter Admin PIN: ***************
-                 
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/084239CF  created: 2010-10-15  expires: never     
-ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> key 1
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb* 2048R/084239CF  created: 2010-10-15  expires: never     
-ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> keytocard
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-
-Please select where to store the key:
-   (2) Encryption key
-Your selection? 2
-
-You need a passphrase to unlock the secret key for
-user: "NIIBE Yutaka <gniibe@fsij.org>"
-2048-bit RSA key, ID 084239CF, created 2010-10-15
-
-gpg: writing new key
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb* 2048R/084239CF  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> key 1
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/084239CF  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> key 2
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/084239CF  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb* 2048R/5BB065DC  created: 2010-10-22  expires: never     
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> keytocard
-Signature key ....: [none]
-Encryption key....: [none]
-Authentication key: [none]
-
-Please select where to store the key:
-   (3) Authentication key
-Your selection? 3
-
-You need a passphrase to unlock the secret key for
-user: "NIIBE Yutaka <gniibe@fsij.org>"
-2048-bit RSA key, ID 5BB065DC, created 2010-10-22
-
-gpg: writing new key
-
-sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb  2048R/084239CF  created: 2010-10-15  expires: never     
-                     card-no: F517 00000001
-ssb* 2048R/5BB065DC  created: 2010-10-22  expires: never     
-                     card-no: F517 00000001
-(1)  NIIBE Yutaka <gniibe@fsij.org>
-
-gpg> quit
-Save changes? (y/N) y
-$

diff --git a/doc/HACKING b/doc/HACKING
deleted file mode 100644 (file)
index fc5be9a..0000000
--- a/doc/HACKING
+++ /dev/null
@@ -1,53 +0,0 @@
-* [DONE] Random Number Generator
-
-RNG is needed for Data Encryption Key to encrypt private key (P and Q).
-It is important to collect enough entropy.  Perhaps, it would
-be possible to get entropy from USB traffic (of other devices).
-
-
-* RSA
-
-It would be good not to use malloc.
-
-
-* Flash ROM recover from unexpected shutdown during write
-
-
-* [DONE] configure support
-
-configure script would be good to select a board and to generate
-random serial number.
-
-
-* [DONE] Random number update
-
-Implemented using SECECT_FILE and UPDATE_BINARY command, which is not
-in the OpenPGP card specification.
-
-Old description: Currently, Gnuk doesn't have random number generator,
-but use random bytes calculated by hosts.  After Gnuk uses random
-number, the entry in Flash ROM will be cleared.  Some scheme to update
-random number bytes is needed.  Possibly, private Data Objects, or by
-another SELECT FILE.
-
-
-* [DONE] Manufacture ID
-
-Get it from FSFE.
-
-
-* [DONE] Serial number
-
-The AID of the card contains serial number.  It should be unique.  USB
-serial number should be unique to identify different tokens, too.
-
-
-* [DONE] Flash ROM garbage collection
-
-
-* [DONE] Flash ROM protection
-
-Flash ROM can be protected with OpenOCD.  DfuSe users should know that
-the content can be accessible by DfuSe, even if we enable read
-protection of flash ROM.  For proper protection, don't use DfuSe but
-use OpenOCD to write and protect.

diff --git a/doc/NOTES b/doc/NOTES
deleted file mode 100644 (file)
index 7b4a052..0000000
--- a/doc/NOTES
+++ /dev/null
@@ -1,89 +0,0 @@
-USB communication (current)
-===========================
-
-* Get response, command chaining, short APDU only.
-
-
-If it were only for token and no smartcard:
-
-* Get response, command chaining and short APDU would be considered
-  useless.
-
-* It would be wise to use extended APDU and CCID/ICCD block chaining.
-
-The question would be: When lower layer (CCID/ICCD layer) support
-enough mechanism of block assembly, why not use one in the application
-layer (ISO 7816)?
-
-For token implementation, CCID/ICCD would be lower layer and ISO 7816
-would be higher layer, but it's different in fact.  The figure of
-communication is like::
-
-    host <-----------> reader <---------> smartcard
-           CCID/ICCD           ISO 7816
-    
-    host <--> token
-
-Given the situation host side (GnuPG) already has the features of
-handling get response, command chaining, and short APDU only, it is
-rather better to do that on token side too.
-
-Besides, supporting extended APDU on host side, it would be needed to
-prepare 64KB buffer (that's the maximum size), as there is no explicit
-limitation for buffer size.  64KB would be large, and this could be
-avoided when we use short APDU only.
-
-
-USB communication (second attempt)
-==================================
-
-* No get response, no command chaining, but extended APDU and extended
-  Lc and Le.  I think that this keep the code simple.
-
-* The value of dwMaxCCIDMessageLength is 320, that's the size
-  of header of ICC block plus size of maximum APDU (by 64
-  granularity).  Still, some ccid implementation (ccid 1.3.11, for
-  example) sends ICC block using chaining unfortunately, so we keep
-  the code of ICC block chaining.
-
-
-USB communication (initial attempt)
-===================================
-
-* Once in the past (version <= 0.4), the value of
-  dwMaxCCIDMessageLength was 64 and we supported CCID/ICCD block chaining,
-  so that we could not handle multple Bulk transactions.
-
-
-OpenPGP card protocol implementation
-====================================
-
-I try to follow "no clear password(s)" policy, even if it is on
-protected flash memory.  Further, keystrings for user and reset code
-are removed after key imports.  Because of this, replacing keys are
-not possible without password information.  (Thus, replacing existing
-keys are not supported.)
-
-Therefore, there is "no clear password" and "no keystrings" on flash
-ROM when Gnuk is used by admin-less mode.  When it is used with admin,
-the keystring of admin is on flash ROM.
-
-
-How a private key is stored
-===========================
-
-KEYPTR
-         ----> [   P   ][   Q   ][       N        ]
-               <---encrypted----><---  plain  ---->
-
-key_addr                       4-byte
-initial_vector (random)        16-byte
-checksum_encrypted             16-byte
-dek_encrypted_by_keystring_pw1 16-byte
-dek_encrypted_by_keystring_rc  16-byte
-dek_encrypted_by_keystring_pw3 16-byte
-
-... decrypted to
-
-[   P   ][   Q   ]
-checksum 16-byte

diff --git a/doc/firmware-update b/doc/firmware-update
deleted file mode 100644 (file)
index 52ff93f..0000000
--- a/doc/firmware-update
+++ /dev/null
@@ -1,132 +0,0 @@
-Firmware update feature
-=======================
-
-The firmware update feature of Gnuk is experimental.  Please be
-careful using that.
-
-Note that updating firmware, all data objects and keys will be
-removed.  There is _no way_ to preserve those data.
-
-
-Preparation
-===========
-
-In addition to settings of Gnuk, I create a file
-/etc/udev/rules.d/92-gnuk.rules::
-
-   # For updating firmware, permission settings are needed.
-   
-   SUBSYSTEMS=="usb", ATTRS{idVendor}=="234b", ATTRS{idProduct}=="0000", \
-       ENV{ID_USB_INTERFACES}=="*:ff0000:*", GROUP="pcscd"
-
-
-While I am a member of group "pcscd" in /etc/group.
-
-This is needed for reGNUal, the firmware update program.
-
-
-Registering a public key for firmware update
-============================================
-
-You need to register a public key to update the firmware.  It should
-be RSA 2048-bit.
-
-One way to extract public key data is by using "gpg-connect-agent"
-command connecting gpg-agent.
-
-We can examine key information of gpg-agent by "KEYINFO" command.
-Here is my example::
-
-   $ gpg-connect-agent "KEYINFO --list" /bye
-   S KEYINFO 4970A0D537CA2EF7CE6A106E47AD89B0EFB684C8 D - - - - -
-   S KEYINFO 65F67E742101C7FE6D5B33FCEFCF4F65EAF0688C T D276000124010200F517000000010000 OPENPGP.2 - - -
-   S KEYINFO 5D6C89682D07CCFC034AF508420BF2276D8018ED T D276000124010200F517000000010000 OPENPGP.3 - - -
-   S KEYINFO 7D180C0C2A991B25204110A92F5F92A5A509845B D - - - - -
-   S KEYINFO 101DE7B639FE29F4636BDEECF442A9273AFA6565 T D276000124010200F517000000010000 OPENPGP.1 - - -
-   OK
-
-I have two local keys (in my PC) and three keys in my token.
-
-With the script below, I extract public key of the keygrip
-5D6C89682D07CCFC034AF508420BF2276D8018ED into the file: 5D6C8968.bin::
-
-   $ ./get_public_key.py 5D6C89682D07CCFC034AF508420BF2276D8018ED
-
-Here is the script, get_public_key.py::
-
-   #! /usr/bin/python
-   
-   import sys, binascii
-   from subprocess import check_output
-   
-   def get_gpg_public_key(keygrip):
-       result = check_output(["gpg-connect-agent", "READKEY %s" % keygrip, "/bye"])
-       key = ""
-       while True:
-              i = result.find('%')
-           if i < 0:
-               key += result
-               break
-           hex_str = result[i+1:i+3]
-           key += result[0:i]
-           key += chr(int(hex_str,16))
-           result = result[i+3:]
-
-       pos = key.index("D (10:public-key(3:rsa(1:n257:") + 31 # skip NUL too
-       key = key[pos:-17]           # )(1:e3:XYZ)))\nOK\n
-       if len(key) != 256:
-           raise ValueError, binascii.hexlify(key)
-       return key
-
-   if __name__ == '__main__':
-       keygrip = sys.argv[1]
-       k = get_gpg_public_key(keygrip)
-       shorthand = keygrip[0:8] + ".bin"
-       f = open(shorthand,"w")
-       f.write(k)
-       f.close()
-
-
-Then, we can put the data of public key into token by::
-
-   $ tool/gnuk_put_binary_libusb.py -k 0 5D6C8968.bin
-
-
-Invoking firmware update
-========================
-
-We specify reGNUal binary and Gnuk binary.
-
-  $ ../tool/gnuk_upgrade.py ../regnual/regnual.bin gnuk.bin 
-
-
-Two or more tokens
-==================
-
-Currently, GnuPG doesn't support multiple devices connected to the
-host.
-
-In order to update the firmware of a TARGET token, we use GnuPG to
-authenticate with public key.  It is assumed that you have another
-AUTH token for this.  This situation is somewhat complicated.
-
-What I do is:
-(1) Don't run PC/SC daemon::
-
-  # /etc/init.d/pcscd stop
-
-(2) To make sure, kill scdaemon::
-
-  $ killall -9 scdaemon
-
-(3) Insert the AUTH token to USB, and use it::
-
-  $ gpg --card-status
-
-(4) Insert the TARGET token to USB (after scdaemon communicates AUTH
-    token), and invoke gnuk_upgrade.py.
-    In this situation, gnuk_upgrade.py tries to connect one of tokens,
-    but a connection to the AUTH token will fail because scdaemon is
-    connecting to that device, and will be expected to connect to the
-    TARGET token succesufully, instead.
--- 

diff --git a/doc/note/DEMO b/doc/note/DEMO
new file mode 100644 (file)
index 0000000..76946b1
--- /dev/null
+++ b/doc/note/DEMO
@@ -0,0 +1,920 @@
+Demonstration of Gnuk
+*********************
+
+In this text, I record my interaction to Gnuk.  It consists two parts,
+a GnuPG session on host side and debug output from the target.
+
+
+Generate RSA 2048-bit key
+=========================
+
+$ gpg --gen-key
+gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+
+Please select what kind of key you want:
+   (1) RSA and RSA (default)
+   (2) DSA and Elgamal
+   (3) DSA (sign only)
+   (4) RSA (sign only)
+Your selection? 1
+RSA keys may be between 1024 and 4096 bits long.
+What keysize do you want? (2048) 
+
+Requested keysize is 2048 bits
+Please specify how long the key should be valid.
+         0 = key does not expire
+      <n>  = key expires in n days
+      <n>w = key expires in n weeks
+      <n>m = key expires in n months
+      <n>y = key expires in n years
+Key is valid for? (0) 
+
+Key does not expire at all
+Is this correct? (y/N) y
+
+You need a user ID to identify your key; the software constructs the user ID
+from the Real Name, Comment and Email Address in this form:
+    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
+
+Real name: Niibe Yutaka
+Email address: gniibe@fsij.org
+Comment: FSIJ USB Token v2
+You selected this USER-ID:
+    "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+
+Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
+You need a Passphrase to protect your secret key.
+
+We need to generate a lot of random bytes. It is a good idea to perform
+some other action (type on the keyboard, move the mouse, utilize the
+disks) during the prime generation; this gives the random number
+generator a better chance to gain enough entropy.
+..............+++++
+.+++++
+We need to generate a lot of random bytes. It is a good idea to perform
+some other action (type on the keyboard, move the mouse, utilize the
+disks) during the prime generation; this gives the random number
+generator a better chance to gain enough entropy.
++++++
+..+++++
+gpg: key D849F25D marked as ultimately trusted
+public and secret key created and signed.
+
+gpg: checking the trustdb
+gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
+gpg: depth: 0  valid:   4  signed:  52  trust: 0-, 0q, 0n, 0m, 0f, 4u
+gpg: depth: 1  valid:  52  signed:  35  trust: 1-, 0q, 0n, 2m, 49f, 0u
+gpg: depth: 2  valid:  11  signed:  21  trust: 0-, 0q, 0n, 0m, 11f, 0u
+gpg: depth: 3  valid:   1  signed:   1  trust: 0-, 0q, 0n, 1m, 0f, 0u
+gpg: next trustdb check due at 2010-08-26
+pub   2048R/D849F25D 2010-08-26
+      Key fingerprint = 2CF6 AF50 1034 FDFE DCD9  80E3 4FF1 4AC4 D849 F25D
+uid                  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+sub   2048R/AB28AFD3 2010-08-26
+$
+
+
+Test Gnuk works 
+===============
+
+$ gpg --card-status
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+Application ID ...: D276000124010200FFFE000000010000
+Version ..........: 2.0
+Manufacturer .....: unmanaged S/N range
+Serial number ....: 00000001
+Name of cardholder: [not set]
+Language prefs ...: [not set]
+Sex ..............: unspecified
+URL of public key : [not set]
+Login data .......: [not set]
+Signature PIN ....: forced
+Key attributes ...: 2048R 2048R 2048R
+Max. PIN lengths .: 127 127 127
+PIN retry counter : 3 0 3
+Signature counter : 0
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+General key info..: [none]
+$
+
+
+Parsonalize the card
+====================
+
+$ gpg --card-edit
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+Application ID ...: D276000124010200FFFE000000010000
+Version ..........: 2.0
+Manufacturer .....: unmanaged S/N range
+Serial number ....: 00000001
+Name of cardholder: [not set]
+Language prefs ...: [not set]
+Sex ..............: unspecified
+URL of public key : [not set]
+Login data .......: [not set]
+Signature PIN ....: forced
+Key attributes ...: 2048R 2048R 2048R
+Max. PIN lengths .: 127 127 127
+PIN retry counter : 3 0 3
+Signature counter : 0
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+General key info..: [none]
+
+gpg/card> passwd
+gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
+gpg: gpg-agent is not available in this session
+
+Please enter the PIN
+Enter PIN:            
+New PIN
+Enter New PIN:                
+New PIN
+Repeat this PIN:                  PIN changed.
+
+gpg/card> admin
+Admin commands are allowed
+
+gpg/card> sex
+Sex ((M)ale, (F)emale or space): m
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN:                  
+gpg/card> name
+Cardholder's surname: Niibe
+Cardholder's given name: Yutaka
+
+gpg/card> login
+Login data (account name): gniibe
+
+gpg/card> url
+URL to retrieve public key: http://www.gniibe.org/gniibe.asc
+
+gpg/card> lang
+Language preferences: ja
+
+gpg/card> passwd
+gpg: OpenPGP card no. D276000124010200FFFE000000010000 detected
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? 3
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN:                  
+New Admin PIN
+Enter New Admin PIN:                      
+New Admin PIN
+Repeat this PIN:                  PIN changed.
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? 4
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN:                  
+New Reset Code
+Enter New PIN:                
+New Reset Code
+Repeat this PIN:                  Reset Code set.
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? q
+
+gpg/card> quit
+$
+
+
+Key import to the card
+======================
+
+$ gpg --edit-key d849f25d
+gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+
+Secret key is available.
+
+pub  2048R/D849F25D  created: 2010-08-26  expires: never       usage: SC  
+                     trust: ultimate      validity: ultimate
+sub  2048R/AB28AFD3  created: 2010-08-26  expires: never       usage: E   
+[ultimate] (1). Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+
+gpg> toggle
+
+sec  2048R/D849F25D  created: 2010-08-26  expires: never     
+ssb  2048R/AB28AFD3  created: 2010-08-26  expires: never     
+(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+
+gpg> keytocard
+Really move the primary key? (y/N) y
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+
+Please select where to store the key:
+   (1) Signature key
+   (3) Authentication key
+Your selection? 1
+
+You need a passphrase to unlock the secret key for
+user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+2048-bit RSA key, ID D849F25D, created 2010-08-26
+
+gpg: gpg-agent is not available in this session
+Enter passphrase:                   gpg: writing new key
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN:                  
+sec  2048R/D849F25D  created: 2010-08-26  expires: never     
+                     card-no: FFFE 00000001
+ssb  2048R/AB28AFD3  created: 2010-08-26  expires: never     
+(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+
+gpg> key 1
+
+sec  2048R/D849F25D  created: 2010-08-26  expires: never     
+                     card-no: FFFE 00000001
+ssb* 2048R/AB28AFD3  created: 2010-08-26  expires: never     
+(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+
+gpg> keytocard
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+
+Please select where to store the key:
+   (2) Encryption key
+Your selection? 2
+
+You need a passphrase to unlock the secret key for
+user: "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+2048-bit RSA key, ID AB28AFD3, created 2010-08-26
+
+Enter passphrase:                   gpg: writing new key
+
+sec  2048R/D849F25D  created: 2010-08-26  expires: never     
+                     card-no: FFFE 00000001
+ssb* 2048R/AB28AFD3  created: 2010-08-26  expires: never     
+                     card-no: FFFE 00000001
+(1)  Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>
+
+gpg> quit
+Save changes? (y/N) y
+$
+
+
+Making Digital signature
+========================
+
+$ gpg -u d849f25d --clearsign README
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+gpg: signatures created so far: 0
+
+Please enter the PIN
+[sigs done: 0]
+gpg: gpg-agent is not available in this session
+$ gpg --verify README.asc
+gpg: Signature made Mon Sep 13 11:28:00 2010 JST using RSA key ID D849F25D
+gpg: Good signature from "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+$
+
+
+Decryption using Gnuk
+=====================
+
+$ gpg -u d849f25d --encrypt README
+You did not specify a user ID. (you may use "-r")
+
+Current recipients:
+
+Enter the user ID.  End with an empty line: d849f25d
+
+Current recipients:
+2048R/AB28AFD3 2010-08-26 "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+
+Enter the user ID.  End with an empty line: 
+$ gpg --decrypt README.gpg 
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+
+Please enter the PIN
+gpg: gpg-agent is not available in this session
+Enter PIN:            gpg: verify CHV2 failed: bad passphrase
+gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
+      "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+gpg: public key decryption failed: bad passphrase
+gpg: decryption failed: secret key not available
+$ gpg --decrypt README.gpg 
+gpg: detected reader `FSIJ USB Token (20100910) 00 00'
+
+Please enter the PIN
+gpg: gpg-agent is not available in this session
+Enter PIN:            gpg: encrypted with 2048-bit RSA key, ID AB28AFD3, created 2010-08-26
+      "Niibe Yutaka (FSIJ USB Token v2) <gniibe@fsij.org>"
+[... output of README ... ]
+$
+
+
+Corresponding DEBUG output
+==========================
+
+$ cu -l /dev/ttyACM0
+^GConnected.
+ON
+ON
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   0065
+GPG!: 20001284
+ - Get Data
+   005b
+GPG!: 20001284
+ - Get Data
+   5f2d
+GPG!: 20001284
+ - Get Data
+   5f35
+GPG!: 20001284
+ - Get Data
+   5f50
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   007a
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   0065
+GPG!: 20001284
+ - Get Data
+   005b
+GPG!: 20001284
+ - Get Data
+   5f2d
+GPG!: 20001284
+ - Get Data
+   5f35
+GPG!: 20001284
+ - Get Data
+   5f50
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   007a
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   007a
+GPG!: 20001284
+Change PW
+01
+flash DO
+flash DO...done
+Changed DO_KEYSTRING_PW1.
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - VERIFY
+83
+good
+GPG!: 20001284
+ - PUT DATA
+   5f35
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   005b
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   005e
+flash DO
+flash DO...done
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - PUT DATA
+   5f50
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   5f2d
+flash DO
+flash DO...done
+GPG!: 20001284
+ - Get Data
+   005b
+GPG!: 20001284
+ - Get Data
+   5f2d
+GPG!: 20001284
+ - Get Data
+   5f35
+GPG!: 20001284
+ - Get Data
+   5f50
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   007a
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+Change PW
+03
+Random: 000028ca
+Random: 00004d02
+flash DO
+flash DO...done
+done.
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - VERIFY
+83
+good
+GPG!: 20001284
+ - PUT DATA
+   00d3
+Resetting Code!
+done (no prvkey).
+flash DO
+flash DO...done
+flash DO
+flash DO...done
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   0065
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - VERIFY
+83
+good
+GPG!: 20001284
+ - PUT DATA
+   3fff
+ 4d 82 01 16 b6 00 7f 48 08 91 04 92 81 80 93 81
+ 80 5f 48 82 01 04 00 01 00 01 ee 1c 56 89 bf c7
+ 78 9d b4 2b 30 2f 69 2d e4 ac 3f d8 79 83 60 02
+ c0 b4 88 7d 46 4d be c3 ad 69 77 02 c1 3a 84 a1
+ 0b 61 5c 73 79 b6 04 27 29 f7 f3 58 1d 31 45 cd
+ 7d b0 1c d4 90 f8 fa 98 45 19 52 4b f0 f2 bc 5f
+ 86 e5 2f 85 67 55 a3 3d f2 7f 57 66 c5 ce 5d ac
+ 3f 72 d8 25 35 30 a9 73 e3 8a b9 8a b5 42 95 a0
+ 73 8a 04 d7 4a 05 67 9c 8c 0b d4 56 0e 99 44 07
+ 6e f9 aa 24 ce 88 07 ff 9d 39 f8 57 33 95 bc b9
+ 96 64 cf 67 c2 bb c0 b4 a1 b0 44 ee e7 6b c9 6a
+ ea ec e0 14 8c 57 00 39 04 20 7d 99 df f8 50 23
+ 1e 80 79 ea 86 9b 2c 4d b8 4f 8c d3 7e 08 99 9b
+ 63 ca 8f 93 dd 9f ce b6 ff 81 9e 53 86 79 70 52
+ e8 5b be b0 62 ca 52 42 85 46 c0 6c 50 7d d1 9d
+ 51 b6 c3 9e 2c d3 1a 60 e9 8a 62 2e 4e 67 d7 8d
+ aa 31 f3 b3 2d 78 22 4c de fa 44 b7 6f a6 2c 08
+ 09 da 3d 51 ab 8c 83 9c 29 e7
+Key import
+0100
+Getting keystore address...
+key_addr: 0800e800
+Random: 00001265
+Random: 00003e52
+ENC
+ ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
+ 3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
+ 77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
+ f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
+ 52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
+ 57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
+ b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
+ d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
+ f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
+ 44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
+ 7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
+ 8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
+ 9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
+ c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
+ 62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
+ 44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
+ 1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
+
+ENC
+ 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
+
+ENC
+ 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
+
+ENC
+ 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
+
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   00c7
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   00ce
+flash DO
+flash DO...done
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - PUT DATA
+   3fff
+ 4d 82 01 16 b8 00 7f 48 08 91 04 92 81 80 93 81
+ 80 5f 48 82 01 04 00 01 00 01 dd 7a 0f 38 d9 e5
+ 29 e3 14 47 d9 b5 4e a7 f1 cf b0 8e 7c a4 9b 39
+ 57 e0 ab 36 39 f5 97 0b 96 ac cd 8c c9 e3 de 45
+ 0a 48 93 84 8a 14 ea cd 9b 91 1f d5 31 52 76 b0
+ 60 e0 42 65 ab b3 dc 85 4c 6c 64 1c 13 83 89 4d
+ b4 75 03 2d 11 38 29 72 5e 4b 89 4e c0 da 72 e5
+ 1e 53 82 a7 e2 e8 f1 05 07 47 8d 72 02 46 c8 95
+ 4d 52 6d e8 9d 28 75 d5 65 b3 2e f3 c1 a1 fb 5b
+ 45 fa 4a 12 b1 04 3f 81 65 f5 ef a9 51 2b a2 13
+ 60 5a 95 c1 c2 13 26 05 14 d5 9e 05 ec de 0a c1
+ 53 1a d8 3e b0 5b d4 87 55 79 26 ff e5 91 79 96
+ e9 98 a8 6f 54 eb e6 d7 a6 ba 81 fc a3 cc e7 5b
+ 7a a0 7e 37 e1 4e af 82 f1 57 9b df bd 4f 18 65
+ f2 b3 ab 7e 08 16 e6 d6 bf 6b 3f 9a 16 2a 1a 8c
+ 2d c6 57 5a 48 3e 5a 43 96 19 a4 15 cf ef a5 be
+ ab 48 97 09 e1 64 94 6e 88 c3 04 cd c9 5b 54 b0
+ 95 38 5a 4d 0b a6 86 70 5c 1d
+Key import
+0100
+Getting keystore address...
+key_addr: 0800ea00
+Random: 00007dfd
+Random: 0000ac26
+ENC
+ dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
+ b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
+ cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
+ 1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
+ 64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
+ 89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
+ 8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
+ 2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
+ ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
+ 9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
+ 26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
+ 81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
+ 9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
+ 3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
+ a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
+ 04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
+ 4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
+
+ENC
+ 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
+
+ENC
+ 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
+
+ENC
+ 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
+
+flash DO
+flash DO...done
+flash DO
+flash DO...done
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   00c8
+flash DO
+flash DO...done
+GPG!: 20001284
+ - PUT DATA
+   00cf
+flash DO
+flash DO...done
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   007a
+GPG!: 20001284
+ - VERIFY
+81
+verify_pso_cds
+06
+DEC
+ 4f 11 96 38 28 a0 cd cb 13 c3 6c a9 62 5e b3 40
+
+DEC
+ ee 1c 56 89 bf c7 78 9d b4 2b 30 2f 69 2d e4 ac
+ 3f d8 79 83 60 02 c0 b4 88 7d 46 4d be c3 ad 69
+ 77 02 c1 3a 84 a1 0b 61 5c 73 79 b6 04 27 29 f7
+ f3 58 1d 31 45 cd 7d b0 1c d4 90 f8 fa 98 45 19
+ 52 4b f0 f2 bc 5f 86 e5 2f 85 67 55 a3 3d f2 7f
+ 57 66 c5 ce 5d ac 3f 72 d8 25 35 30 a9 73 e3 8a
+ b9 8a b5 42 95 a0 73 8a 04 d7 4a 05 67 9c 8c 0b
+ d4 56 0e 99 44 07 6e f9 aa 24 ce 88 07 ff 9d 39
+ f8 57 33 95 bc b9 96 64 cf 67 c2 bb c0 b4 a1 b0
+ 44 ee e7 6b c9 6a ea ec e0 14 8c 57 00 39 04 20
+ 7d 99 df f8 50 23 1e 80 79 ea 86 9b 2c 4d b8 4f
+ 8c d3 7e 08 99 9b 63 ca 8f 93 dd 9f ce b6 ff 81
+ 9e 53 86 79 70 52 e8 5b be b0 62 ca 52 42 85 46
+ c0 6c 50 7d d1 9d 51 b6 c3 9e 2c d3 1a 60 e9 8a
+ 62 2e 4e 67 d7 8d aa 31 f3 b3 2d 78 22 4c de fa
+ 44 b7 6f a6 2c 08 09 da 3d 51 ab 8c 83 9c 29 e7
+ 1d f5 b7 13 a4 f4 87 93 47 6e 75 6b 20 4b 45 59
+
+good
+GPG!: 20001284
+ - PSO: 20001264
+0023
+RSA sign...ok...done.
+flash DO
+flash DO...done
+PSO done.
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - VERIFY
+82
+verify_pso_other
+DEC
+ 1a d0 32 c3 06 c8 68 58 0c 5a 7b 81 80 62 2c 45
+
+DEC
+ a0 e8 98 60 66 36 93 0e f2 cd e5 56 3c ca aa 0a
+ d7 b1 5e 1f 97 20 1b c0 86 98 a5 fb bf da b3 c6
+ 24 18 d9 8c e2 a1 c0 5c c1 7f 8d 8f 44 1d d3 78
+ 30 97 da 55 6b 63 a4 3e 6f ad 4b c3 1e fa 6f 64
+ 22 7b b3 63 c6 b5 2f 4b 84 cd e1 b4 12 3a a3 76
+ 75 96 05 f8 a3 b4 9a 04 7c f4 e3 7a 47 c1 10 82
+ f3 8b 5f d0 7a de 46 1a 7b d6 71 7d 11 f8 91 9e
+ 03 6e af eb 9a 1a c2 3c 54 da fd 07 1f 94 b8 6c
+ 14 3e c3 9e e0 57 65 56 cd af 59 74 27 06 72 56
+ 35 1e 4b 8b fe 71 1a 6e 73 9a 59 b6 eb 61 35 81
+ bf df d2 45 a3 be 4f a9 65 fe 6a b8 7e 60 0e e2
+ 14 a4 bc f7 ef a1 f1 49 4e 67 e3 0a 37 ea 30 10
+ c6 7f 20 94 91 2b 38 1a dc 90 c1 f5 b7 22 c7 0e
+ 46 08 91 a0 ec 12 35 60 46 d4 9d f5 cb 00 b7 21
+ 89 ae 8f 83 aa 24 c8 3b e5 25 ae 71 c6 3a 3f ae
+ 90 47 86 1c 42 f4 fc 56 7c 9a 39 55 90 89 42 20
+ 51 d0 e3 dc 45 c3 1f f7 69 26 36 f6 66 14 26 de
+
+gpg_do_load_prvkey failed.
+flash DO
+flash DO...done
+failed
+GPG!: 20001284
+ - select DF by name
+GPG!: 20001284
+ - Get Data
+   004f
+GPG!: 20001284
+ - Get Data
+   5f52
+GPG!: 20001284
+ - Get Data
+   00c4
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   005e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - Get Data
+   006e
+GPG!: 20001284
+ - VERIFY
+82
+verify_pso_other
+DEC
+ 6a b6 44 aa 33 fd fa d0 10 0d 24 a2 f0 a4 51 64
+
+DEC
+ dd 7a 0f 38 d9 e5 29 e3 14 47 d9 b5 4e a7 f1 cf
+ b0 8e 7c a4 9b 39 57 e0 ab 36 39 f5 97 0b 96 ac
+ cd 8c c9 e3 de 45 0a 48 93 84 8a 14 ea cd 9b 91
+ 1f d5 31 52 76 b0 60 e0 42 65 ab b3 dc 85 4c 6c
+ 64 1c 13 83 89 4d b4 75 03 2d 11 38 29 72 5e 4b
+ 89 4e c0 da 72 e5 1e 53 82 a7 e2 e8 f1 05 07 47
+ 8d 72 02 46 c8 95 4d 52 6d e8 9d 28 75 d5 65 b3
+ 2e f3 c1 a1 fb 5b 45 fa 4a 12 b1 04 3f 81 65 f5
+ ef a9 51 2b a2 13 60 5a 95 c1 c2 13 26 05 14 d5
+ 9e 05 ec de 0a c1 53 1a d8 3e b0 5b d4 87 55 79
+ 26 ff e5 91 79 96 e9 98 a8 6f 54 eb e6 d7 a6 ba
+ 81 fc a3 cc e7 5b 7a a0 7e 37 e1 4e af 82 f1 57
+ 9b df bd 4f 18 65 f2 b3 ab 7e 08 16 e6 d6 bf 6b
+ 3f 9a 16 2a 1a 8c 2d c6 57 5a 48 3e 5a 43 96 19
+ a4 15 cf ef a5 be ab 48 97 09 e1 64 94 6e 88 c3
+ 04 cd c9 5b 54 b0 95 38 5a 4d 0b a6 86 70 5c 1d
+ 4c 6a 6e 78 0f 35 b1 bd 47 6e 75 6b 20 4b 45 59
+
+flash DO
+flash DO...done
+good
+GPG!: 20001284
+ - PSO: 20001264
+0101
+RSA decrypt:20001234
+00000100
+RSA decrypt ...done.
+PSO done.
+-- 

diff --git a/doc/note/DEMO-2 b/doc/note/DEMO-2
new file mode 100644 (file)
index 0000000..022e715
--- /dev/null
+++ b/doc/note/DEMO-2
@@ -0,0 +1,233 @@
+$ unset GPG_AGENT_INFO
+$ gpg --card-edit
+
+gpg: detected reader `FSIJ USB Token (20101023) 00 00'
+Application ID ...: D276000124010200F517000000010000
+Version ..........: 2.0
+Manufacturer .....: unknown
+Serial number ....: 00000001
+Name of cardholder: [not set]
+Language prefs ...: [not set]
+Sex ..............: unspecified
+URL of public key : [not set]
+Login data .......: [not set]
+Signature PIN ....: forced
+Key attributes ...: 2048R 2048R 2048R
+Max. PIN lengths .: 127 127 127
+PIN retry counter : 3 0 3
+Signature counter : 0
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+General key info..: [none]
+
+gpg/card> passwd
+gpg: OpenPGP card no. D276000124010200F517000000010000 detected
+gpg: gpg-agent is not available in this session
+
+Please enter the PIN
+Enter PIN: 123456
+           
+New PIN
+Enter New PIN: *************
+               
+New PIN
+Repeat this PIN: *************
+PIN changed.
+
+gpg/card> admin
+Admin commands are allowed
+
+gpg/card> sex
+Sex ((M)ale, (F)emale or space): m
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN: 12345678
+                 
+gpg/card> name
+Cardholder's surname: Niibe
+Cardholder's given name: Yutaka
+
+gpg/card> login
+Login data (account name): gniibe
+
+gpg/card> url
+URL to retrieve public key: http://www.gniibe.org/gniibe.asc
+
+gpg/card> lang
+Language preferences: ja
+
+gpg/card> passwd
+gpg: OpenPGP card no. D276000124010200F517000000010000 detected
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? 3
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN: 12345678
+                 
+New Admin PIN
+Enter New Admin PIN: ***************
+                     
+New Admin PIN
+Repeat this PIN: ***************
+PIN changed.
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? 4
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN: ***************
+                 
+New Reset Code
+Enter New PIN: ************
+               
+New Reset Code
+Repeat this PIN: ************
+Reset Code set.
+
+1 - change PIN
+2 - unblock PIN
+3 - change Admin PIN
+4 - set the Reset Code
+Q - quit
+
+Your selection? q
+
+gpg/card> quit
+$ gpg --edit-key 4CA7BABE
+gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+
+Secret key is available.
+
+pub  2048R/4CA7BABE  created: 2010-10-15  expires: never       usage: SC  
+                     trust: ultimate      validity: ultimate
+sub  2048R/084239CF  created: 2010-10-15  expires: never       usage: E   
+sub  2048R/5BB065DC  created: 2010-10-22  expires: never       usage: A   
+[ultimate] (1). NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> toggle
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+ssb  2048R/084239CF  created: 2010-10-15  expires: never     
+ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> keytocard
+Really move the primary key? (y/N) y
+gpg: detected reader `FSIJ USB Token (20101023) 00 00'
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+
+Please select where to store the key:
+   (1) Signature key
+   (3) Authentication key
+Your selection? 1
+
+You need a passphrase to unlock the secret key for
+user: "NIIBE Yutaka <gniibe@fsij.org>"
+2048-bit RSA key, ID 4CA7BABE, created 2010-10-15
+
+gpg: gpg-agent is not available in this session
+gpg: writing new key
+gpg: 3 Admin PIN attempts remaining before card is permanently locked
+
+Please enter the Admin PIN
+Enter Admin PIN: ***************
+                 
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/084239CF  created: 2010-10-15  expires: never     
+ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> key 1
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb* 2048R/084239CF  created: 2010-10-15  expires: never     
+ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> keytocard
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+
+Please select where to store the key:
+   (2) Encryption key
+Your selection? 2
+
+You need a passphrase to unlock the secret key for
+user: "NIIBE Yutaka <gniibe@fsij.org>"
+2048-bit RSA key, ID 084239CF, created 2010-10-15
+
+gpg: writing new key
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb* 2048R/084239CF  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> key 1
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/084239CF  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> key 2
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/084239CF  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb* 2048R/5BB065DC  created: 2010-10-22  expires: never     
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> keytocard
+Signature key ....: [none]
+Encryption key....: [none]
+Authentication key: [none]
+
+Please select where to store the key:
+   (3) Authentication key
+Your selection? 3
+
+You need a passphrase to unlock the secret key for
+user: "NIIBE Yutaka <gniibe@fsij.org>"
+2048-bit RSA key, ID 5BB065DC, created 2010-10-22
+
+gpg: writing new key
+
+sec  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb  2048R/084239CF  created: 2010-10-15  expires: never     
+                     card-no: F517 00000001
+ssb* 2048R/5BB065DC  created: 2010-10-22  expires: never     
+                     card-no: F517 00000001
+(1)  NIIBE Yutaka <gniibe@fsij.org>
+
+gpg> quit
+Save changes? (y/N) y
+$

diff --git a/doc/note/HACKING b/doc/note/HACKING
new file mode 100644 (file)
index 0000000..fc5be9a
--- /dev/null
+++ b/doc/note/HACKING
@@ -0,0 +1,53 @@
+* [DONE] Random Number Generator
+
+RNG is needed for Data Encryption Key to encrypt private key (P and Q).
+It is important to collect enough entropy.  Perhaps, it would
+be possible to get entropy from USB traffic (of other devices).
+
+
+* RSA
+
+It would be good not to use malloc.
+
+
+* Flash ROM recover from unexpected shutdown during write
+
+
+* [DONE] configure support
+
+configure script would be good to select a board and to generate
+random serial number.
+
+
+* [DONE] Random number update
+
+Implemented using SECECT_FILE and UPDATE_BINARY command, which is not
+in the OpenPGP card specification.
+
+Old description: Currently, Gnuk doesn't have random number generator,
+but use random bytes calculated by hosts.  After Gnuk uses random
+number, the entry in Flash ROM will be cleared.  Some scheme to update
+random number bytes is needed.  Possibly, private Data Objects, or by
+another SELECT FILE.
+
+
+* [DONE] Manufacture ID
+
+Get it from FSFE.
+
+
+* [DONE] Serial number
+
+The AID of the card contains serial number.  It should be unique.  USB
+serial number should be unique to identify different tokens, too.
+
+
+* [DONE] Flash ROM garbage collection
+
+
+* [DONE] Flash ROM protection
+
+Flash ROM can be protected with OpenOCD.  DfuSe users should know that
+the content can be accessible by DfuSe, even if we enable read
+protection of flash ROM.  For proper protection, don't use DfuSe but
+use OpenOCD to write and protect.

diff --git a/doc/note/NOTES b/doc/note/NOTES
new file mode 100644 (file)
index 0000000..7b4a052
--- /dev/null
+++ b/doc/note/NOTES
@@ -0,0 +1,89 @@
+USB communication (current)
+===========================
+
+* Get response, command chaining, short APDU only.
+
+
+If it were only for token and no smartcard:
+
+* Get response, command chaining and short APDU would be considered
+  useless.
+
+* It would be wise to use extended APDU and CCID/ICCD block chaining.
+
+The question would be: When lower layer (CCID/ICCD layer) support
+enough mechanism of block assembly, why not use one in the application
+layer (ISO 7816)?
+
+For token implementation, CCID/ICCD would be lower layer and ISO 7816
+would be higher layer, but it's different in fact.  The figure of
+communication is like::
+
+    host <-----------> reader <---------> smartcard
+           CCID/ICCD           ISO 7816
+    
+    host <--> token
+
+Given the situation host side (GnuPG) already has the features of
+handling get response, command chaining, and short APDU only, it is
+rather better to do that on token side too.
+
+Besides, supporting extended APDU on host side, it would be needed to
+prepare 64KB buffer (that's the maximum size), as there is no explicit
+limitation for buffer size.  64KB would be large, and this could be
+avoided when we use short APDU only.
+
+
+USB communication (second attempt)
+==================================
+
+* No get response, no command chaining, but extended APDU and extended
+  Lc and Le.  I think that this keep the code simple.
+
+* The value of dwMaxCCIDMessageLength is 320, that's the size
+  of header of ICC block plus size of maximum APDU (by 64
+  granularity).  Still, some ccid implementation (ccid 1.3.11, for
+  example) sends ICC block using chaining unfortunately, so we keep
+  the code of ICC block chaining.
+
+
+USB communication (initial attempt)
+===================================
+
+* Once in the past (version <= 0.4), the value of
+  dwMaxCCIDMessageLength was 64 and we supported CCID/ICCD block chaining,
+  so that we could not handle multple Bulk transactions.
+
+
+OpenPGP card protocol implementation
+====================================
+
+I try to follow "no clear password(s)" policy, even if it is on
+protected flash memory.  Further, keystrings for user and reset code
+are removed after key imports.  Because of this, replacing keys are
+not possible without password information.  (Thus, replacing existing
+keys are not supported.)
+
+Therefore, there is "no clear password" and "no keystrings" on flash
+ROM when Gnuk is used by admin-less mode.  When it is used with admin,
+the keystring of admin is on flash ROM.
+
+
+How a private key is stored
+===========================
+
+KEYPTR
+         ----> [   P   ][   Q   ][       N        ]
+               <---encrypted----><---  plain  ---->
+
+key_addr                       4-byte
+initial_vector (random)        16-byte
+checksum_encrypted             16-byte
+dek_encrypted_by_keystring_pw1 16-byte
+dek_encrypted_by_keystring_rc  16-byte
+dek_encrypted_by_keystring_pw3 16-byte
+
+... decrypted to
+
+[   P   ][   Q   ]
+checksum 16-byte

diff --git a/doc/note/firmware-update b/doc/note/firmware-update
new file mode 100644 (file)
index 0000000..52ff93f
--- /dev/null
+++ b/doc/note/firmware-update
@@ -0,0 +1,132 @@
+Firmware update feature
+=======================
+
+The firmware update feature of Gnuk is experimental.  Please be
+careful using that.
+
+Note that updating firmware, all data objects and keys will be
+removed.  There is _no way_ to preserve those data.
+
+
+Preparation
+===========
+
+In addition to settings of Gnuk, I create a file
+/etc/udev/rules.d/92-gnuk.rules::
+
+   # For updating firmware, permission settings are needed.
+   
+   SUBSYSTEMS=="usb", ATTRS{idVendor}=="234b", ATTRS{idProduct}=="0000", \
+       ENV{ID_USB_INTERFACES}=="*:ff0000:*", GROUP="pcscd"
+
+
+While I am a member of group "pcscd" in /etc/group.
+
+This is needed for reGNUal, the firmware update program.
+
+
+Registering a public key for firmware update
+============================================
+
+You need to register a public key to update the firmware.  It should
+be RSA 2048-bit.
+
+One way to extract public key data is by using "gpg-connect-agent"
+command connecting gpg-agent.
+
+We can examine key information of gpg-agent by "KEYINFO" command.
+Here is my example::
+
+   $ gpg-connect-agent "KEYINFO --list" /bye
+   S KEYINFO 4970A0D537CA2EF7CE6A106E47AD89B0EFB684C8 D - - - - -
+   S KEYINFO 65F67E742101C7FE6D5B33FCEFCF4F65EAF0688C T D276000124010200F517000000010000 OPENPGP.2 - - -
+   S KEYINFO 5D6C89682D07CCFC034AF508420BF2276D8018ED T D276000124010200F517000000010000 OPENPGP.3 - - -
+   S KEYINFO 7D180C0C2A991B25204110A92F5F92A5A509845B D - - - - -
+   S KEYINFO 101DE7B639FE29F4636BDEECF442A9273AFA6565 T D276000124010200F517000000010000 OPENPGP.1 - - -
+   OK
+
+I have two local keys (in my PC) and three keys in my token.
+
+With the script below, I extract public key of the keygrip
+5D6C89682D07CCFC034AF508420BF2276D8018ED into the file: 5D6C8968.bin::
+
+   $ ./get_public_key.py 5D6C89682D07CCFC034AF508420BF2276D8018ED
+
+Here is the script, get_public_key.py::
+
+   #! /usr/bin/python
+   
+   import sys, binascii
+   from subprocess import check_output
+   
+   def get_gpg_public_key(keygrip):
+       result = check_output(["gpg-connect-agent", "READKEY %s" % keygrip, "/bye"])
+       key = ""
+       while True:
+              i = result.find('%')
+           if i < 0:
+               key += result
+               break
+           hex_str = result[i+1:i+3]
+           key += result[0:i]
+           key += chr(int(hex_str,16))
+           result = result[i+3:]
+
+       pos = key.index("D (10:public-key(3:rsa(1:n257:") + 31 # skip NUL too
+       key = key[pos:-17]           # )(1:e3:XYZ)))\nOK\n
+       if len(key) != 256:
+           raise ValueError, binascii.hexlify(key)
+       return key
+
+   if __name__ == '__main__':
+       keygrip = sys.argv[1]
+       k = get_gpg_public_key(keygrip)
+       shorthand = keygrip[0:8] + ".bin"
+       f = open(shorthand,"w")
+       f.write(k)
+       f.close()
+
+
+Then, we can put the data of public key into token by::
+
+   $ tool/gnuk_put_binary_libusb.py -k 0 5D6C8968.bin
+
+
+Invoking firmware update
+========================
+
+We specify reGNUal binary and Gnuk binary.
+
+  $ ../tool/gnuk_upgrade.py ../regnual/regnual.bin gnuk.bin 
+
+
+Two or more tokens
+==================
+
+Currently, GnuPG doesn't support multiple devices connected to the
+host.
+
+In order to update the firmware of a TARGET token, we use GnuPG to
+authenticate with public key.  It is assumed that you have another
+AUTH token for this.  This situation is somewhat complicated.
+
+What I do is:
+(1) Don't run PC/SC daemon::
+
+  # /etc/init.d/pcscd stop
+
+(2) To make sure, kill scdaemon::
+
+  $ killall -9 scdaemon
+
+(3) Insert the AUTH token to USB, and use it::
+
+  $ gpg --card-status
+
+(4) Insert the TARGET token to USB (after scdaemon communicates AUTH
+    token), and invoke gnuk_upgrade.py.
+    In this situation, gnuk_upgrade.py tries to connect one of tokens,
+    but a connection to the AUTH token will fail because scdaemon is
+    connecting to that device, and will be expected to connect to the
+    TARGET token succesufully, instead.
+-- 

diff --git a/doc/note/settings-for-DnDpinentry b/doc/note/settings-for-DnDpinentry
new file mode 100644 (file)
index 0000000..c0c52ad
--- /dev/null
+++ b/doc/note/settings-for-DnDpinentry
@@ -0,0 +1,34 @@
+On GNU/Linux Desktop, I use udisks-glue so that DnDpinentry folder can
+be mounted with sync and noatime options.
+
+After installing udisks-glue, I invoke gnome-session-properties to
+add udisks-glue to "Startup Program".
+
+Then, I have two files to configure udisks (disable udisks for
+DnDpinentry) and udisks-glue (enable and specify options for DnDpinentry).
+
+/etc/udev/rules.d/88-udisks.rules
+---------------
+ENV{ID_VENDOR}=="FSIJ", ENV{DEVTYPE}=="disk", ENV{ID_FS_LABEL}=="DnDpinentry", ENV{UDISKS_PRESENTATION_NOPOLICY}="1"
+---------------
+
+~/.udisks-glue.conf
+---------------
+filter gone {
+    label = "DnDpinentry"
+    optical = false
+}
+
+match gone {
+    automount = true
+    automount_options = { sync, noatime }
+}
+---------------
+
+We need following setting for pinentry.  Or else, you can't do
+anything when pinentry grabs mouse focus.
+
+~/.gnupg/gpg-agent.conf
+---------------
+no-grab
+---------------

diff --git a/doc/settings-for-DnDpinentry b/doc/settings-for-DnDpinentry
deleted file mode 100644 (file)
index c0c52ad..0000000
--- a/doc/settings-for-DnDpinentry
+++ /dev/null
@@ -1,34 +0,0 @@
-On GNU/Linux Desktop, I use udisks-glue so that DnDpinentry folder can
-be mounted with sync and noatime options.
-
-After installing udisks-glue, I invoke gnome-session-properties to
-add udisks-glue to "Startup Program".
-
-Then, I have two files to configure udisks (disable udisks for
-DnDpinentry) and udisks-glue (enable and specify options for DnDpinentry).
-
-/etc/udev/rules.d/88-udisks.rules
----------------
-ENV{ID_VENDOR}=="FSIJ", ENV{DEVTYPE}=="disk", ENV{ID_FS_LABEL}=="DnDpinentry", ENV{UDISKS_PRESENTATION_NOPOLICY}="1"
----------------
-
-~/.udisks-glue.conf
----------------
-filter gone {
-    label = "DnDpinentry"
-    optical = false
-}
-
-match gone {
-    automount = true
-    automount_options = { sync, noatime }
-}
----------------
-
-We need following setting for pinentry.  Or else, you can't do
-anything when pinentry grabs mouse focus.
-
-~/.gnupg/gpg-agent.conf
----------------
-no-grab
----------------