title: What is CAN and how to provide it
body: <p>I'm working on Polish e-identity card which is protected by CAN code. It is required to provide this code to unlock the card and be able to list the tokens.</p>
  
  <p>I'm not able to find any information about it.</p>
  
  <p>When using official app <a href="https://www.gov.pl/web/e-dowod" rel="noreferrer">https://www.gov.pl/web/e-dowod</a> you are prompted for this number after inserting the card.</p>
  
  <p>According to logs, mysterious function <code>C_SetCAN</code> from <code>e-dowod-pkcs11-64.so</code> is invoked. It is not documented in <a href="http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html" rel="noreferrer">http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html</a> and also not present in <a href="https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/pkcs11-global.c#L320" rel="noreferrer">https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/pkcs11-global.c#L320</a> where it should be according to the logs</p>
  
  <pre><code>0x7f9bca95c700 23:18:32.251 [opensc-pkcs11] pkcs11-global.c:320:C_SetCAN: C_SetCAN(0x5)
  0x7f9bca95c700 23:18:32.251 [opensc-pkcs11] pkcs11-global.c:329:C_SetCAN: C_SetCAN() get slot rv 0
  </code></pre>
  
  <p><strong>It make me thing that it might be some custom extension, but as opensc is on LGPL, sources of it should also be provided, right?</strong></p>
  
  <p>When I've tried to break on it with <code>gdb</code>, but I've landed in:</p>
  
  <pre><code>#0  0x00007fffeadd5b70 in C_SetCAN () from /opt/e-dowod/e-dowod-pkcs11-64.so
  #1  0x000000000041d49c in ?? ()
  #2  0x0000000000418907 in ?? ()
  #3  0x00000000004199bc in ?? ()
  #4  0x000000000041ed58 in ?? ()
  #5  0x00007ffff686e0e1 in QObject::event(QEvent*) () from /opt/e-dowod/./libQt5Core.so.5
  #6  0x00007ffff7691e2c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /opt/e-dowod/./libQt5Widgets.so.5
  </code></pre>
  
  <p><strong>Why there is no caller and arguments information?</strong></p>
  
  <p>I've also tried to use <a href="https://github.com/OpenSC/OpenSC/blob/master/src/tools/npa-tool.c" rel="noreferrer">https://github.com/OpenSC/OpenSC/blob/master/src/tools/npa-tool.c</a> which seems to have desired functionality, but quite probably without success.</p>
  
  <pre><code>P:91478; T:0x140627504822080 17:59:48.916 [npa-tool] sm-eac.c:643:eac_gen_auth_1_encrypted_nonce: 
  General authenticate (Encrypted Nonce) response data (20 bytes):
  00 02 7C 12 80 10 D1 0A 98 E5 3B DC 7C F5 DC FA ..|.......;.|...
  58 60 24 BA                                     X`$.
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:647:eac_gen_auth_1_encrypted_nonce: Could not parse general authenticate response data.
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:648:eac_gen_auth_1_encrypted_nonce: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:648:eac_gen_auth_1_encrypted_nonce: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:648:eac_gen_auth_1_encrypted_nonce: error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:1176:perform_pace: Could not get encrypted nonce from card (General Authenticate step 1 failed).
  P:91478; T:0x140627504822080 17:59:48.917 [npa-tool] sm-eac.c:1364:perform_pace: returning with: -1400 (Internal error)
  </code></pre>