Strange EC key card

[msetina]

I am trying get public key from a card. pkcs11-tool -O list a public key, but when I run pkcs15-tool --list-public-keys it states that the card has no public keys. verbose call to last command says:
Using reader with a card: Alcor Micro AU9540 00 00
Connecting to card in reader Alcor Micro AU9540 00 00...
Using card driver eOI (Slovenian eID card).
Trying to find a PKCS#15 compatible card...
P:6609; T:0x140523471700928 07:24:06.980 [pkcs15-tool] pkcs15-din-66291.c:208:sc_pkcs15emu_din_66291_init_ex: called
Found Prijava brez PIN-a!
Card has 0 Public key(s).

Where should I look for a reason?

[metsma]

There is probably no PKCS15 interface on card to give public key.
PKCS11 emulates this probably and takes public key from certificate.

[msetina]

I will try to validate this. pkcs15-tool lists private keys and certificates.

[msetina]

@llogar is this expected for EOI?

[llogar]

I don't have my eOI card at hand right now, but as far as I remember, there are no public keys stored on the card (just private keys and certificates, as you have found out), so you can't use the low-level pkcs15-tool to show/extract them. However OpenSC creates a corresponding CKO_PUBLIC_KEY object for every certificate found on the card. See

OpenSC/src/pkcs11/framework-pkcs15.c

Lines 698 to 702 in 993e646

	/* Corresponding public key */
	rv = public_key_created(fw_data, &p15_info->id, &any_object2);
	if (rv != SC_SUCCESS)
	rv = __pkcs15_create_object(fw_data, &any_object2,
	NULL, &pkcs15_pubkey_ops, sizeof(struct pkcs15_pubkey_object));

[Jakuje]

You can read the public keys also using the pkcs11-tool as described here (or convert it from the certificate -- described there too):

https://github.com/OpenSC/OpenSC/wiki/Using-pkcs11-tool-and-OpenSSL#signverify-using-private-keycertificate