Issue metadata
Sign in to add a comment
|
FIPS 201 smartcards / PIV no longer work in Chrome 61+ using CrypTokenKit.
Reported by
tony.r...@gmail.com,
Feb 8 2018
|
||||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Example URL: Any smartcard enforced site, but https://piv.max.gov/ and https://auth.launchpad.nasa.gov/ can be used as examples. Steps to reproduce the problem: 1. Don't install tokend (use native CrypTokenKit) 2. Enter URL for smartcard enabled website 3. Select option to authenticate with smartcard 4. After no duration no certificates are presented 5. Chrome never instigates prompt for Certificate Selection or PIN 6. Authentication fails What is the expected behavior? What is the expected behavior? 1. Enter URL for smartcard enabled website 2. Attempt to authenticate with smartcard 3. After a **short** duration certificates are presented 4. Select proper certificate 5. Chrome instigates prompt for PIN 6. Authentication succeeds What went wrong? It appears that Chrome, starting with approximately Chrome 61 may have reverted to requiring PIV.Tokend / CDSA in lieu of CrypTokenKit. Installation of PIV.Tokend does allow intermittently proper behavior; however, Apple has deprecated CDSA / Tokend. Did this work before? Yes Pre-61, macOS 10.12 Chrome version: 64.0.3282.140 Channel: stable OS Version: OS X 10.13.3 Flash Version: Related ticket where CrypTokenKit was first fixed: https://bugs.chromium.org/p/chromium/issues/detail?id=666796
,
Feb 8 2018
Can you please attempt with Chrome 65 and see if Issue 769699 resolves your issue?
,
Feb 8 2018
Specifically, the NetLog shows this is a completely different issue from #666796. Rather than failing to sign anything with the key, we don't seem to be attempting to provide a client certificate in the first place. So something around certificate lookup seems to be going wrong. macOS 10.13 changed some stuff around there, which broke Chrome. The fix for that will be in Chrome 65.
,
Feb 8 2018
,
Feb 8 2018
Dev - 65.0.3325.51
-Resolves the issue (certificate dialog is presented, PIN using piv.token dialog is presented, authentication is accepted)
Canary - 66.0.3343.0
-Same as above
Thanks for the quick response guys, sorry I didn't test Dev/Canary prior to bug submittal.
,
Feb 8 2018
Thank you for providing more feedback. Adding requester "davidben@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Feb 8 2018
Thanks for confirming! This is related to the 10.13 upgrade, rather than 61<->64. I'm glad 65 resolves this issue for you.
,
Feb 8 2018
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by davidben@chromium.org
, Feb 8 2018