Resetting OpenPGP Applet on Token2 smartcard throws error on non-Token2 readers

[alphazo]

When using Keyroost, I can succesfully reset the OpenPGP applet on a Token2 smartcard when using the Token2 desktop dual interface reader (349e:0430) with a a green successful message Applet reset.

When using other smart cards readers such as Alcor Micro Corp. AU9540 smart card reader (058f:9540), external SCM Micro SCR-3500 USB reader (04e6:5814) and Realtek Semiconductor reader (0bda:0165) I get an error message after pressing the Reset Applet button: device rejected get application related data: SW=6CFF

The error message is misleading since the applet seems to be in full factory reset mode after issuing the command.

I also tried the factory-reset command under gpp --card-edit / admin and no error has been reported.

[framefilter]

Hello @alphazo, as I said in the other issue thanks for taking time to report the issues you’re having. I’ll take a look and see if I can’t get a fix pushed out quickly.

[alphazo]

I tried v0.7.7, but I can no longer reset a Token2 smartcard using either a non-Token2 reader but also using an official Token2 reader. I started with the FIDO bridge disabled.

When I click Reset, I get a comprehensive warning about what is going to be reset, which is nice. Then I get a prompt to type the word “reset” within 10 seconds, but after doing it, the popup window stays open and doesn’t close.

The status window says:

Factory reset

Resets every applet on this key (OpenPGP, PIV, OTP, FIDO2) to factory state. Each step reports on its own — anything that doesn't complete is listed below.

OpenPGP  wiped
PIV  wiped
OTP  wiped
FIDO2  not wiped yet — waiting for the unplug, replug, and touch

And the popup window says:

This wipes ALL credentials and the PIN on Token2 Alcor Micro AU9540.
This cannot be undone.

Note: a reset does not erase large-blob storage. Open the Storage tab
and use “Clear all storage” to wipe every entry there.

Now unplug the key, then plug it back in.
The reset is sent the instant it reconnects — then the
key will blink. Touch it to finish the wipe.

I then cancelled the operation and the status windows reports:

Factory reset

Resets every applet on this key (OpenPGP, PIV, OTP, FIDO2) to factory state. Each step reports on its own — anything that doesn't complete is listed below.

OpenPGP  wiped
PIV  wiped
OTP  wiped
FIDO2  failed: cancelled — the passkeys and PIN are still on this key

The problem is that there is no switch to touch on the smart card.

I then realized that maybe I had to enable the FIDO bridge to reset the FIDO2 credentials but when using the virtuald device, Keyroost shows no serial number at all and when clicking Reset I get the following error message:

Factory reset

Resets every applet on this key (OTP, FIDO2) to factory state. Each step reports on its own — anything that doesn't complete is listed below.

OTP  failed: unexpected status word 0x0101
FIDO2  failed: not armed — this key exposes no serial to re-identify it by after a replug, so the armed reset can't safely target it. Run `keyroostctl fido reset --yes` within ~10 s of plugging the key in instead.

I'm using the official Keyroost Appimage so I don't seem to have the keyroostctl utility handy.

The only way for me to reset the FIOD2 credentials was to use Android Token2 Companion app or Libre Key Companion App over NFC (both worked).