- SmartcardServices-Dev - lists.macosforge.org

New CCID smart card readers support
by Giuseppe Amato 14 Nov '13

14 Nov '13

Hello, with the introduction of the CCID driver package from the pcsc-lite project in OSX 10.5 the number of reader supported by OSX out-of-the-box has increased, since the new driver is more standard. But something has become worst: a list of VIDs/PIDs explicitly supported was introduced instead of using the "0x0b" CCID interface class to detect a CCID reader. Actually Apple didn't update anymore pcscd nor ccid ifd, so after many years OSX does not supports out-of-the-box many CCID readers, just very old models. I think that if Apple will in the future update that components in the official release of OSX the starting codebase should be the Smart Card Services project, so it make sense to me continuing to update and enhance it. My proposal is to get back the code from the old pcscd version, reintroducing the previous behavior: if there isn't a bundle explicitly supporting a VID/PID and the device supports "0x0b" class then pcscd loads the ifd-ccid.bundle as default driver. That avoids the need to continuously update the list of supported VIDs and PIDs. What do you think? -- Giuseppe Amato http://www.bit4id.com gam(a)bit4id.com

1 0

Re: [SmartcardServices-Dev] SmartCardServices in OSX 10.8
by Thomas Harning Jr. 15 Aug '13

15 Aug '13

Has Apple worked out the next generation USB Token / Network HSM system support yet? From what I'm seeing, all the interfaces I am developing against for Symantec are deprecated - which is an unpleasant situation to be in, since technically the interface can be swiped out from under us. Are there any plans on patching pcscd daemon or the ccid drivers? We are using Aladdin tokens and experience routine failures and "race conditions" between multiple applications using a device where even though transactions are properly used, hangs are encountered. This also bubbles up to SecurityD causing system hangs since it accesses pcscd as well. If a third party were to upgrade pcscd or the ccid driver to resolve problems with what is installed at the system level, what sort of issues would we encounter if Apple were to push an update these components (or is it planned to never update these)? - Would the apple update fail completely preventing further updates to the system? - Would the update ignore the update to a changed system component? - Would the update overwrite our changes? On Fri, Feb 17, 2012 at 12:09 PM, Shawn Geddis <geddis(a)me.com> wrote: > On Feb 17, 2012, at 11:52 AM, Thomas Harning Jr. wrote: > > I see that 10.7 has CDSA and SmartCardServices deprecated, meaning it > > is out the door for 10.8. > > > > How would one build TokenD implementations since CDSA is an integral > > dependency (TokenD directly exposes/consumes CSSM* types)? > > > > Is there a new pluggable-crypto system in the works? If so, hopefully > > it can support software-driven interfaces (ex: those that aren't > > PC/SC, perhaps direct USB tokens or network-based devices)... > > Thomas, > > Deprecation of CDSA is what prompted the removal of the Tokend modules > from OS X Lion. If you restore them on an OS X Lion system, you will have > capabilities restored. The Tokend modules have been based on CDSA in OS X > 10.4, 10.5, 10.6 and still can in 10.7. Deprecation of CDSA means that it > is no longer THE Crypto/PKI architecture to rely on and that it will be > gone in some future version of the OS - not exactly a guarantee it will be > gone, but you can’t count on it being there in a future release once it has > been publicly announced as deprecated. > > Apple has not made any announcements with respect to future frameworks to > provide the same or similar functionality. I can say that it is extremely > high on the customer request list for Token/SmartCard support on iOS & OSX. > Since CDSA is deprecated and was never going to make it to iOS > (size/age/functionality working against it), Apple was always faced with > looking at something new. > > As for the "software-driven interfaces”, Tokend has been used quite a bit > with USB Tokens and Network HSMs. The system-wide support for abstracting > Identities (of various types) for iOS / OSX is quite important. > > Stay tuned to this space for future information. > > -Shawn > __________________________________________________ > Shawn Geddis > geddis(a)me.com > Security Consulting Engineer geddis(a)apple.com > > MacOSForge Project Lead: Smart Card Services > Web: http://smartcardservices.macosforge.org/ > Lists: http://lists.macosforge.org/mailman/listinfo > __________________________________________________ > > > > > > > > > > -- Thomas Harning Jr. (http://about.me/harningt)

4 7

PKCS11 Support in Mt. Lion
by Henry B. Hotz 16 May '13

16 May '13

I know the pkcs11 shim isn't included in the Mountain Lion package. I was wondering what the issues were that prevented building it. (I've been told that simply copying the Lion shim over works, so I assume the issues are subtle.) Also, more generally, is there a current FAQ for how to build the stuff? I'd *like* to build the reverse shim to allow the keychain API to access a standard pkcs11 provider (though I probably won't have time to do so). ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz(a)jpl.nasa.gov, or hbhotz(a)oxy.edu

1 0

How to use secdebug()
by SOBCZYK Dominique (MORPHO) 28 Feb '13

28 Feb '13

Hello, I went on this mail about the way secdebug is working : https://lists.macosforge.org/pipermail/smartcardservices-dev/2010-January/0… I tried to send a mail to the developer technical support, but the way support is working has changed. I posted my question on the developer forum but since smartcard services and tokend are deprecated, I don't know if I will get an answer. So I post it there too : I would like to know where the debug messages are sent and how to activate them ? (not so far from the question asked by Ludovic Rousseau in the previous link) Regards, Dominique # " This e-mail and any attached documents may contain confidential or proprietary information. If you are not the intended recipient, you are notified that any dissemination, copying of this e-mail and any attachments thereto or use of their contents by any means whatsoever is strictly prohibited. If you have received this e-mail in error, please advise the sender immediately and delete this e-mail and all attached documents from your computer system." #

1 0

Re: [SmartcardServices-Dev] Newbie build env help
by Frank Marien 20 Dec '12

20 Dec '12

Hi Shawn, Thanks for the complete reply. I'm about to travel for the holidays.. so I can't work on this now, but http://ludovicrousseau.blogspot.be/2012/08/mac-os-x-mountain-lion-and-smart… and http://code.google.com/p/eid-applet/issues/detail?id=80 After JRE update in OSX, Our Applet becomes unsuable (SEGV), collegues investigations find that everything points to the pcscd shipped, rather than the JRE itself.. We can simulate with minimal code.. Also, we're worried that Apple may simply stop shipping SmartCardServices, and we want to make sure we have a solution if and when that would happen. We're always using the most recent tools possible.. needs to build thus.. Don't worry about the license, we're GPL ourselves, we know and would be honoured to return the honours. I've copied colleague Frederik, in case he still has a few days to look at this, in 2013 :-) Otherwise, I'll be back around Jan 3rd 2013 Enjoy the holidays! -f On 12/18/2012 09:31 PM, Shawn Geddis wrote: > Frank, > > I would love to hear from other developers on this list, but I first > wanted to ask a few questions an comment on items within your message. > > On Dec 12, 2012, at 10:28 AM, Frank Marien <frank(a)apsu.be > <mailto:frank@apsu.be>> wrote: >> Greetings List, >> >> I'm a consultant, on a government project. So far we've been able >> to use >> Apple's shipped versions of SmartCardServices, but we've reached >> a point where >> this is too old, and now totally breaks functionality for many of >> our OSX users.. > > Since I have been officially leading this effort since 2009 > including those versions that shipped in OS X since v10.5.4, what > is it that is now "too old, and now totally breaks functionality > for many of our OS X users." > > SmartCardServices (pcscd, libccid, various Tokend modules, etc) > have all been provided since Mac OS X 10.4 and continue to work > thru OS X Mountain Lion v10.8 as provided on the Installer page > here in the same manner. > > So I am curious what has all of a sudden changed for your users > now as you indicate it is too old ? > >> I'm investigating how we can bundle our own SmartCardServices >> binaries >> to solve this.. > > You can always recompile the source code posted or just utilize > the installers containing compiled versions of the components. > >> To bundle we need to sign, and we obviously are not going to sign >> what >> we did not build from source.. let alone ship something we cannot >> fix, if needed.. > > - Obviously you could sign, but it is not a technical requirement > on OS X at this time. > - That is good practice not to sign what you have not built - I > applaud you! > -- Wish more folks would follow you sage advice. > - Since the source code to everything that ever shipped in OS X as > well as additional > components are available thru the project here, you would always > be able modify source, > recompile, and ship. you could, but of course you may not choose to. > > Keep in mind that under the licensing here, alterations you make > to existing resources / source code posted, must be submitted back > to the project. There are a few third-party SmartCard entities > that still have not complied with the licensing terms. > >> I've been using the instructions in >> http://smartcardservices.macosforge.org/trac/wiki/documentation/building >> but that's been dependency hell on my Lion 10.7.5 (11G63), XCode >> 4.5.2.. >> >> I've spent the last few days updating XCode, MacPorts, DarwinBuild, a >> true obstacle course by itself. >> >> This can't be right.. I'm missing something very simple and >> obvious, or >> the instructions are simply >> too old.. > > Those instructions are written for the last version of Mac OS X > (10.6.x) where the Tokend modules were included. Apple deprecated > SmartCardServices beginning in OS X Lion 10.7, so the source code > was no longer included in the open source postings [ > http://www.opensource.apple.com > <http://www.opensource.apple.com/>]. So admittedly they are old > if you are using the latest and greatest versions of XCode and > DarwinBuild - but that is of course not necessary to build/compile > the project / components. > >> Would really appreciate a URL or paste of how you folks set up >> dev and build env for SmartCardServices.. >> Since we would be happy to contribute, as well. Willing to >> scratch OSX and reinstall from zero, if necessary. > > For simplicity and rapid compiling, I actually build all of the > components while on a Mac OS X 10.6.x environment, darwinbuild and > of course the corresponding SDKs [10.6,10.7,10.8] with the > instructions you are referencing. Those instructions again are > reliant on the existence of the Project in the open Source Version > (e.g. 10J869) along with support under darwinbuild. > > XCode / darwinbuild has undergone significant changes since the > original builds days and re-doing all of the projects to keep up > with those changes has unfortunately, been lower on the priority > list. Desired, but lower on the list. > > Your unstated point is well taken and that is to provide an > updated version of the instructions, but since you asked what is > it we use, I state the above. > >> (My speciality is GNU/Linux, and we need to have this >> continuously-built so I need something that can be ran from the >> command-line, >> once set up, as well as from e.g. XCode, so I can step/debug etc..) > > I do all my Code Editing using the latest XCode and then submit to > my build environment. The project is not in a state where you > would be able to build the project under XCode without significant > alterations to the project files. There are even some of the > components (e.g. libccid) that were previously only developed > externally > [http://anonscm.debian.org/viewvc/pcsclite/trunk/Drivers/ccid/] > (led by Ludovic Rousseau) and built as part of the project here > during final project build time. > > I know overall this is not what you wanted to hear, but I would like > us to pursue this moving forward to make it easier for all developers. > > Interested in your feedback. > > - Shawn > ______________________________________________________ > Shawn Geddis geddis(a)me.com <mailto:geddis@me.com> > Enterprise Security Consulting Engineer, Apple geddis(a)apple.com > <mailto:geddis@apple.com> > > MacOSForge: Smart Card Services Project Lead: > > Web:http://smartcardservices.macosforge.org/ > Lists:http://lists.macosforge.org/mailman/listinfo > ______________________________________________________ > > > > > > > > > > > - Shawn > ________________________________________ > Shawn Geddis T (703) 264-5103 > Security Consulting Engineer C (703) 623-9329 > Apple Enterprise Division geddis(a)apple.com > <mailto:geddis@apple.com> > > 11921 Freedom Drive, Suite 600, Reston VA 20190-5634 >

2 1

Re: [SmartcardServices-Dev] Newbie build env help
by Shawn Geddis 18 Dec '12

18 Dec '12

Frank, I would love to hear from other developers on this list, but I first wanted to ask a few questions an comment on items within your message. On Dec 12, 2012, at 10:28 AM, Frank Marien <frank(a)apsu.be> wrote: > Greetings List, > > I'm a consultant, on a government project. So far we've been able to use > Apple's shipped versions of SmartCardServices, but we've reached a point where > this is too old, and now totally breaks functionality for many of our OSX users.. Since I have been officially leading this effort since 2009 including those versions that shipped in OS X since v10.5.4, what is it that is now "too old, and now totally breaks functionality for many of our OS X users." SmartCardServices (pcscd, libccid, various Tokend modules, etc) have all been provided since Mac OS X 10.4 and continue to work thru OS X Mountain Lion v10.8 as provided on the Installer page here in the same manner. So I am curious what has all of a sudden changed for your users now as you indicate it is too old ? > I'm investigating how we can bundle our own SmartCardServices binaries > to solve this.. You can always recompile the source code posted or just utilize the installers containing compiled versions of the components. > To bundle we need to sign, and we obviously are not going to sign what > we did not build from source.. let alone ship something we cannot fix, if needed.. - Obviously you could sign, but it is not a technical requirement on OS X at this time. - That is good practice not to sign what you have not built - I applaud you! -- Wish more folks would follow you sage advice. - Since the source code to everything that ever shipped in OS X as well as additional components are available thru the project here, you would always be able modify source, recompile, and ship. you could, but of course you may not choose to. Keep in mind that under the licensing here, alterations you make to existing resources / source code posted, must be submitted back to the project. There are a few third-party SmartCard entities that still have not complied with the licensing terms. > I've been using the instructions in > http://smartcardservices.macosforge.org/trac/wiki/documentation/building > but that's been dependency hell on my Lion 10.7.5 (11G63), XCode 4.5.2.. > > I've spent the last few days updating XCode, MacPorts, DarwinBuild, a > true obstacle course by itself. > > This can't be right.. I'm missing something very simple and obvious, or > the instructions are simply > too old.. Those instructions are written for the last version of Mac OS X (10.6.x) where the Tokend modules were included. Apple deprecated SmartCardServices beginning in OS X Lion 10.7, so the source code was no longer included in the open source postings [ http://www.opensource.apple.com] So admittedly they are old if you are using the latest and greatest versions of XCode and DarwinBuild - but that is of course not necessary to build/compile the project / components. > Would really appreciate a URL or paste of how you folks set up dev and build env for SmartCardServices.. > Since we would be happy to contribute, as well. Willing to scratch OSX and reinstall from zero, if necessary. For simplicity and rapid compiling, I actually build all of the components while on a Mac OS X 10.6.x environment, darwinbuild and of course the corresponding SDKs [10.6,10.7,10.8] with the instructions you are referencing. Those instructions again are reliant on the existence of the Project in the open Source Version (e.g. 10J869) along with support under darwinbuild. XCode / darwinbuild has undergone significant changes since the original builds days and re-doing all of the projects to keep up with those changes has unfortunately, been lower on the priority list. Desired, but lower on the list. Your unstated point is well taken and that is to provide an updated version of the instructions, but since you asked what is it we use, I state the above. > (My speciality is GNU/Linux, and we need to have this continuously-built so I need something that can be ran from the command-line, > once set up, as well as from e.g. XCode, so I can step/debug etc..) I do all my Code Editing using the latest XCode and then submit to my build environment. The project is not in a state where you would be able to build the project under XCode without significant alterations to the project files. There are even some of the components (e.g. libccid) that were previously only developed externally [http://anonscm.debian.org/viewvc/pcsclite/trunk/Drivers/ccid/] (led by Ludovic Rousseau) and built as part of the project here during final project build time. I know overall this is not what you wanted to hear, but I would like us to pursue this moving forward to make it easier for all developers. Interested in your feedback. - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________

1 0

Newbie build env help
by Frank Marien 12 Dec '12

12 Dec '12

Greetings List, I'm a consultant, on a government project. So far we've been able to use Apple's shipped versions of SmartCardServices, but we've reached a point where this is too old, and now totally breaks functionality for many of our OSX users.. I'm investigating how we can bundle our own SmartCardServices binaries to solve this.. To bundle we need to sign, and we obviously are not going to sign what we did not build from source.. let alone ship something we cannot fix, if needed.. I've been using the instructions in http://smartcardservices.macosforge.org/trac/wiki/documentation/building but that's been dependency hell on my Lion 10.7.5 (11G63), XCode 4.5.2.. I've spent the last few days updating XCode, MacPorts, DarwinBuild, a true obstacle course by itself. This can't be right.. I'm missing something very simple and obvious, or the instructions are simply too old.. Would really appreciate a URL or paste of how you folks set up dev and build env for SmartCardServices.. Since we would be happy to contribute, as well. Willing to scratch OSX and reinstall from zero, if necessary. (My speciality is GNU/Linux, and we need to have this continuously-built so I need something that can be ran from the command-line, once set up, as well as from e.g. XCode, so I can step/debug etc..) WKR, -f

1 0

OSX 10.8 pcscd only in 64 bit
by Frank Neuber 15 Jun '12

15 Jun '12

Hi, on osx 10.8 beta3 the delivered ifd drivers are only in 32 bit but the pcscd is in 64 bit. This can never work together. I informed Apple about this issue. If I have news from apple I will post it here. Regards, Frank

2 1

OSX 10.8 pcscd
by Thomas Harning Jr. 30 Mar '12

30 Mar '12

If OSX 10.8 were to not include pcscd and its necessary support libraries, would using either sources or binaries from 10.7 work? Is there any information for OSX 10.8 supporting pcscd when it is released? I understand that Smart Card support in future OSX releases is being relegated to 3rd party support, but if every 3rd party needs to put in pcscd, it could be a mess and easily cause conflicts to occur if a patch were put in pcscd to 'lock out' 3rd party competitors. -- Thomas Harning Jr.

2 1

Re: [SmartcardServices-Dev] SmartCardServices in OSX 10.8
by Shawn Geddis 17 Feb '12

17 Feb '12

On Feb 17, 2012, at 11:52 AM, Thomas Harning Jr. wrote: > I see that 10.7 has CDSA and SmartCardServices deprecated, meaning it > is out the door for 10.8. > > How would one build TokenD implementations since CDSA is an integral > dependency (TokenD directly exposes/consumes CSSM* types)? > > Is there a new pluggable-crypto system in the works? If so, hopefully > it can support software-driven interfaces (ex: those that aren't > PC/SC, perhaps direct USB tokens or network-based devices)... Thomas, Deprecation of CDSA is what prompted the removal of the Tokend modules from OS X Lion. If you restore them on an OS X Lion system, you will have capabilities restored. The Tokend modules have been based on CDSA in OS X 10.4, 10.5, 10.6 and still can in 10.7. Deprecation of CDSA means that it is no longer THE Crypto/PKI architecture to rely on and that it will be gone in some future version of the OS - not exactly a guarantee it will be gone, but you can’t count on it being there in a future release once it has been publicly announced as deprecated. Apple has not made any announcements with respect to future frameworks to provide the same or similar functionality. I can say that it is extremely high on the customer request list for Token/SmartCard support on iOS & OSX. Since CDSA is deprecated and was never going to make it to iOS (size/age/functionality working against it), Apple was always faced with looking at something new. As for the "software-driven interfaces”, Tokend has been used quite a bit with USB Tokens and Network HSMs. The system-wide support for abstracting Identities (of various types) for iOS / OSX is quite important. Stay tuned to this space for future information. -Shawn __________________________________________________ Shawn Geddis geddis(a)me.com Security Consulting Engineer geddis(a)apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________

1 0