- SmartcardServices-Dev - lists.macosforge.org

[SCSSU-201801] Addresses CVE-2018-4300 & CVE-2018-4301 in Project
by Shawn A. Geddis 31 Jul '18

31 Jul '18

SmartCardServices Community, I wanted to highlight that a security fix [SCSSU-201801] <http://smartcardservices.macosforge.org/trac/wiki/security> for addressing the following CVEs was merged into the project on May 28, 2018. They will be included in the next release of installers. However, each one of you that has developed your own Tokend for macOS, will want to ensure you pickup the changes. The fix was noted in PR-155 <https://github.com/smartcardservices/smartcardservices/pull/155> And the source code diffs are at Files Changed <https://github.com/smartcardservices/smartcardservices/pull/155/files> if any of you have any questions, fire away here on the list. - Shawn _____________________________________________________________________ Shawn Geddis geddis @ {icloud, me, mac} . com Security and Certifications Engineer geddis @ {apple} . com  Platform Security / SEAR Apple Inc. Smart Card Services Project/Dev Lead: Project Wiki: [https://smartcardservices.github.io <https://smartcardservices.github.io/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

Mac OS High Sierra Version 10.13..5
by James Wathen 07 Jul '18

07 Jul '18

To whom, Good afternoon! When will the Smart Card Services Installer for the new Mac OS High Sierra Version 10.13.5 be available? Very respectfully, James W. Hawaii

1 0

Smartcard Service Installer (MacOS Sierra v10.12) Corrupted
by Harvey Catchings 29 Mar '18

29 Mar '18

Hello, Request your assistance with the Smartcard service release for the macOS Sierra v10.12. The zip file made available on your website is corrupt and will not open on the MAC when downloaded. Is it possible you can update the zip file or send me another zip file for the macOS Sierra I can download in order to use my CAC on my Mac. Thank you, -v/r, Angela Catchings

1 0

ScardEndTransaction ends all the transactions on the card
by Логачев Антон 17 Aug '17

17 Aug '17

Hello! There is a bug in OsX implementation of PCSC standard that makes smartcard synchronization not available via the PSCS functions. If we start 2 transcations (SCardBeginTransaction) on a specific card only one call to SCardEndTransaction makes the card available to all the processes, though it is supposed to be available only after the second matching call to SCardEndTransaction (that's the way it behaves on linux and windows). In the attachment you can find a simple code that demonstrates this behavior. You can use this command line to build it: "g++ -framework PCSC -std=c++11 scardTest.cpp". Launch it in two terminals simultaneously. On OsX both processes will reach the "Start me again" output, but on Linux and Windows the second process will wait on ScardConnect function until all the transactions are closed. Best regards Anton Logachev mailto:ALogachev@aktiv-company.ru | www.aktiv-company.ru<http://www.aktiv-company.ru/>

2 1

Is there an updated Installer for Card Services?
by James Caudill 14 Nov '16

14 Nov '16

Hello everyone, I was hoping to find an updated installer that contains the fix referenced here: https://github.com/smartcardservices/smartcardservices/commit/51ab9e61bfb73… Is that fix contained in the 2.1.2 installer? Thanks, -James

1 0

SmartCardServices 2.1.x (beta) for macOS 10.12 a.k.a. Sierra
by Roy Verrips 02 Aug '16

02 Aug '16

1 0

Smart Card and Smart Card Reader manufacturer
by Sergey Panov 06 Jul '16

06 Jul '16

Hello, How can I notify the Project Administrator(s)? We are a Smart Card and Smart Card Reader manufacturer and wish to submit samples of our hardware for ongoingtesting and validation. How can we do this? Thank you! -- Sergey Panov CTO, ISBC Group. Direct: +7 (967) 04-13-211 Phone: +7 (495) 739-8699 #211 Email:panov@isbc.ru <mailto:panov@isbc.ru> www.isbc.ru <http://www.isbc.ru>

2 1

Re: [SmartcardServices-Dev] [SmartcardServices-Users] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 29 Mar '16

29 Mar '16

I don’t know about OpenSC.tokend, but i’ll give it a look & test. I doubt it will work tough because the Belgian Identity Cards Encryption. If it works, why wouldn’t MacOSforge’s Belpic.tokend, only Beid.tokend seems to be able to decrypt my identity information but has the explained trouble. Apple used to create the Belpic.tokend in collaboration with the Belgian Federal ICT (edict) & Fedict included encryption version 1 & 2 in this version. The collaboration has stopped however, MacOSforge still update’s the Belpic.tokend for new OS X versions but does not change it further, Fedict has renamed the Belpic.tokend to Beid.tokend & has added encryption version 3 & 4 to it, however their new builds are buggy & seems to have earlier explained symptoms on my Mac. So i think in my case the Beid.tokend is the only one that will actually work with the encrypted data on my/the new issued Belgian Identity Cards (3th version of the Encryption) (For my earlier but now replaced ID card i used the Belpic.tokend from Apple/MacOSForge, this ID card had the 2nd version of encryption). I think, but i am not a developer, with the earlier linked source code/Development kit on Github the Belpic.tokend could be updated to work on the newer Belgian ID cards by the developers at MacOSForge. As mentioned earlier i read a post on this Lists that explained with CAC cards and CAC.tokend it was possible to login on OS X by inserting the CAC card & logout, go back to login screen or bring up a screensaver when the card is pulled out until it’s inserted again. I would like to have this possible swell for the Belgian ID card. How is this functionality implanted ? Is this included in the tokend ? > Op 29-mrt.-2016, om 20:57 heeft Uri Blumenthal <uri(a)mit.edu> het volgende geschreven: > > Since you probably have to use OpenSC anyway, why not try OpenSC.tokend? (Also, see other posts in SmartCardServices-Users regarding OpenSC.tokend forks) > >> On Mar 28, 2016, at 4:48 , Maccampus <maccampus(a)gmail.com> wrote: >> >> Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, >> >> A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. >> >> Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. >> >> The facts: >> >> • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. >> • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. >> • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. >> • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. >> • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. >> >> So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. >> >> Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. >> >> To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. >> >> The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. >> >> I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? >> >> You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. >> >> I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) >> >> Yours sincerely >> >> Maccampus >> >> Belgian Mac OS X User >> >> >> _______________________________________________ >> SmartcardServices-Users mailing list >> SmartcardServices-Users(a)lists.macosforge.org >> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users > > -- > Uri the Great > uri(a)mit.edu > > > > > _______________________________________________ > SmartcardServices-Users mailing list > SmartcardServices-Users(a)lists.macosforge.org > https://lists.macosforge.org/mailman/listinfo/smartcardservices-users

1 0

Re: [SmartcardServices-Dev] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, I have found another link. Instead of looking for information in the source for the linux version which obviously won’t have source for the tokend which is OS X technology, you might have a look at folowing github page. https://github.com/Fedict/eid-mw On this page is an xcode project for the tokend. I think this could be very useful. Yours sincerely Maccampus Belgian Mac OS X User

1 0

Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. The facts: • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) Yours sincerely Maccampus Belgian Mac OS X User

1 0