unexpected status word 0x0105

[sanderDijkxhoorn]

Hi there,

This error occurs on the on device OTP page, with a Token2 3 Dual (FIDO + PGP).

Other tabs seem to function fine with this key.

Arch linux aur package.

[framefilter]

Hello @sanderDijkxhoorn and thank you for taking the time to report this issue! This is the same defect as #82. That fix only covers the case where opening the USB-HID path fails. Yours gets further, so it isn't catching.

Could you please post the output of:

keyroostctl --version
keyroostctl list
keyroostctl otp config --debug

[sanderDijkxhoorn]

❯ keyroostctl --version

keyroostctl 0.7.6

~
❯ keyroostctl list

PC/SC readers:
  (unavailable: PC/SC service is unavailable (The Smart card resource manager is not running). Make sure the smart-card service is running (pcscd on Linux; built in on macOS; the Smart Card service on Windows).)

Applet probe (per reader):
  (unavailable: PC/SC service is unavailable (The Smart card resource manager is not running). Make sure the smart-card service is running (pcscd on Linux; built in on macOS; the Smart Card service on Windows).)

FIDO HID devices:
  /dev/hidraw8 349e:0204 usage=f1d0:0001 TOKEN2 FIDO2 Security Key(0204) [Bio3 Dual (FIDO + PGP)] [FIDO]

Correlated devices (what keyroost sees):
  Key    Token2 Bio3 Dual (FIDO + PGP)  FIDO2 · OTP  /dev/hidraw8

~
❯ keyroostctl otp config --debug

[token2otp HID send] 80c5010000
[token2otp HID raw-frame] 21000580bf0001050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
[token2otp HID parsed sw=0x0105] 80bf00
[token2otp HID recv] 80bf00
error: the OTP applet is not reachable over HID or CCID — HID may be disabled on the key; enable it, or use a contact/NFC reader

[sanderDijkxhoorn]

I have some other features based keys too Token2/Yubikey, but this key is the one I tested when I created the issue.

[token2]

I have some other features based keys too Token2/Yubikey, but this key is the one I tested when I created the issue.

Bio3 does not have HID transport at all (there is no HOTP).

Try
keyroostctl otp config --transport ccid

you can force in the GUI as well (although in my tests, automatic works perfectly fine)

[sanderDijkxhoorn]

I am pretty sure I have tried all those options but I can try again when I am at my desktop (presumably tomorrow morning)

The keys do support on device OTP, just not HID-HOTP, yes.

[token2]

I am pretty sure I have tried all those options but I can try again when I am at my desktop (presumably tomorrow morning)

The keys do support on device OTP, just not HID-HOTP, yes.

Exactly, there is no HID-HOTP, and therefore HID as a channel is disabled by default (and you dont need to enable it - no reason).
CCID should work

[framefilter]

Thanks @sanderDijkxhoorn, that trace was really helpful. Two bugs on my side. v0.7.7 (just released*) stops list falsely showing OTP if its not present. The error message is still wrong and will be fixed next: HID wasn't disabled. Your key answered fine, returning 0x0105. Keyroost discards that and blame the transport. Leaving this open for that.

*AUR currently has pushes/updates disabled due to yet another supply chain attack, so you'd need to update via a different mechanism if you wanted that issue fixed today. I don't know when they'll reenable pushes, but I'll push the update as soon as they do.

[token2]

Your key (PID 0204, Bio3 Dual FIDO + PGP) doesn't include the OTP function; it's a separate product configuration

Negative. Bio3 has OTP. It works fine in my test with 0.7.7:

[framefilter]

v0.7.7 has a regression then, my apologies. It stopped showing the OTP capability for Token2 PIDs whose function set omits OTP: 0010, 0014, 0015, 0020, 0024, 0025, 0200, 0204, 0205. On those keys v0.7.7 hides the OTP tab in the GUI and makes --key fail to find the device. If any of those configurations do have OTP, v0.7.7 took the feature away.

I've backed that out and every Token2 key will get the OTP surface again. Not released yet — it'll be in the next version. Anyone affected should stay on v0.7.6 or wait until I can patch this, hopefully in the next 24 hours.

The reported error message is also fixed, and also not yet released. @sanderDijkxhoorn, your key answered 0105, so HID was working and "HID may be disabled" was wrong advice. Your list output also shows the smart-card service wasn't running, which is why the CCID fallback had nothing to fall back to — that's the real cause, and it's what the message now says.

Three questions:

1. 0105 isn't in the spec, token2-otp-cli, or token2-otp-applet, and every status word in the applet source is 6xxx/9000. Did it come from a layer in front of the applet, i.e. the disabled HID channel? Is it documented anywhere? -- edit - nevermind, I already addressed this.
2. errors.py handles 6A81, 6985, 6982, 6983 but spec §3.1 omits them — worth adding to the table? I'd been showing a wrong PIN and a locked PIN as "unexpected status word". Fixed now.
3. The PID matrix lists Bio3 0204 as FIDO + PGP, with OTP on 0202/0203/0206. @sanderDijkxhoorn's key is 0204. @token2, was your working test a 0204 unit or a different PID? That decides whether the matrix needs correcting or my original change was right after all.

[token2]

v0.7.7 has a regression
3. The PID matrix lists Bio3 0204 as FIDO + PGP, with OTP on 0202/0203/0206. @sanderDijkxhoorn's key is 0204. @token2, was your working test a 0204 unit or a different PID? That decides whether the matrix needs correcting or my original change was right after all.

I tested with exactly the same key, and it is with v0.7.7. So it works under the same conditions. Also, the original report was not with 0.7.7 (issue created yesterday, when we were still on v0.7.6)

--Update : and in my test v0.7.6 works as well

[framefilter]

Correction — no regression in v0.7.7, ignore my last message. Sorry for the noise. Holiday brain.

Still fixing the misleading error message, but nothing urgent.