- SmartcardServices-Dev - lists.macosforge.org

SmartCardServices in OSX 10.8
by Thomas Harning Jr. 17 Feb '12

17 Feb '12

I see that 10.7 has CDSA and SmartCardServices deprecated, meaning it is out the door for 10.8. How would one build TokenD implementations since CDSA is an integral dependency (TokenD directly exposes/consumes CSSM* types)? Is there a new pluggable-crypto system in the works? If so, hopefully it can support software-driven interfaces (ex: those that aren't PC/SC, perhaps direct USB tokens or network-based devices)... -- Thomas Harning Jr.

1 0

usb hid driver
by Priya 13 Dec '11

13 Dec '11

Hello, I am developping a driver for a usb hid device(smart card) using IOkit kext(driver from kernel side).I need to select a elementary file EF 0x100, to read the URL stored in it.The APDU command is 80 A4 00 00 02 01 00.I have overrided the methods of IOUSBHIDDriver, I have tried the methods like exchangeAPDU and Transmit, but these are not supported in the kernel. Can anyone please help me how to send this command to the device. thank you _______________________________________________ Priya TIROUNARAYANANE - Dévéloppeuse d'application iNet System Tel : 01 46 23 04 06 Fax : 01 46 23 06 32 Mailto:priya@inet-system.fr http://www.inet-system.fr Merci de penser à l'environnement avant d'imprimer ce courriel

1 0

making Oberthur ID One 128 v5.5 Dual work
by Nao Itoi 02 Sep '11

02 Sep '11

Hello, I am Nao Itoi from Centrify. Thank you very much for the great work on smart card. We at Centrify have found that we can support CACNG profile on Oberthur ID One 128 v5.5 Dual card by doing the following, on Mac OS 10.6 and 10.7. (You can do it on 10.5, too, but it's more work.) 1. Make PIV.tokend the "preferred" module for Oberthur 128. Before this fix, CAC or CACNG module took the card, and failed. We modified PIV.tokend source code for this. 2. Compile pcscd from the latest SmartCardServices-55000 from opensource.apple.com (or I think latest from MacOSForge would be fine, too). Previous build had this bug(http://smartcardservices.macosforge.org/trac/changeset/28 ), which caused a problem for this card. 3. Cache PIN for up to 60 seconds. Without this change, screen saver would try to launch a PIN prompt, and would freeze because it cannot pop up a window. If you would be interested in our diffs for 1 and 3, and consider submitting them to SmartCardServices SVN repository, we will be happy to post the diffs in this list. Implementation details: 1. Make PIV.tokend the "preferred" module for Oberthur 128. In probe(), we detect the Oberthur 128 card by examining the Answer To Reset. If found, probe() returns the score of 350, which makes the PIV module win over CAC or CACNG module. 2. pcscd shipped with Mac 10.6.8 or older have a bug relating to the card communication protocol (see http://smartcardservices.macosforge.org/trac/changeset/28) pcscd selects T=1 protocol to communicate with this card. However, the card seems to work only with T=0 protocol. After this fix, T=0 is selected, and it works fine. 3. After PIN is entered in verifyPIN(), it is cached for a certain period of time. If PIV.tokend needs to send the PIN again (this happens often because one of the keys on PIV has "PIN-always" policy), it will use the cached PIN instead of launching a PIN prompt. The time period is configurable: (1) cache for N seconds (by default, N = 60), (2) cache indefinitely, or (3) do not cache. Questions: * Configuration * Currently, configuration is done in Centrify configuration file. This is not desirable for a public tokend. We can make it configurable somewhere vendor neutral, or can get rid of the configuration. Could you advise? * Logging * As we were not able to figure out how to get messages from secdebug(), we write logs to syslog. If you prefer to use secdebug(), we can do that. * Generally speaking, if you have suggestions on improvement, we are eager to hear about them, and we will be happy to incorporate them. With best regards, Nao @ Centrify Mac Team

1 0

Fw: How to get the log of tokend(secdebug)
by liurf 27 Jul '11

27 Jul '11

Hi,all How to get the log of tokend ? thanks 2011-07-27 liurf

1 0

Building using darwinbuild
by William Siegrist 23 Jan '10

23 Jan '10

I wanted to report on recent work done to make SmartCardServices buildable outside of Apple. You can now build the Tokend and SmartCardServices projects that shipped with 10.5.6 and 10.5.7 using darwinbuild. We had to add a patch that adds includes that were needed to build with CFLite, but otherwise the source is unmodified. Darwinbuild helps by automatically putting roots in a chroot that have the private headers you need. First, install darwinbuild ( http://darwinbuild.macosforge.org/ ), then: # create a build environment $ mkdir ~/9J61 && cd ~/9J61 $ sudo darwinbuild -init 9J61 # build stuff $ sudo darwinbuild SmartCardServices $ sudo darwinbuild Tokend That's it. In this example, everything is kept in a chroot under ~/ 9J61/BuildRoot/. You can use /usr/local/share/darwinbuild/ packageRoots to produce a tarball in ~/9J61/Packages/ of your build. You can use /usr/local/bin/darwinup to install it like so: $ sudo darwinup install ~/9J61/Packages/SmartCardServices.root.tar.gz ... and to uninstall $ sudo darwinup list $ sudo darwinup uninstall <uuid from the list output above> -Bill

3 5

Re: [SmartcardServices-Dev] How to use secdebug()
by Garth Cummings 05 Jan '10

05 Jan '10

Hi Ludovic, On Jan 5, 2010, at 7:00 AM, smartcardservices-dev-request(a)lists.macosforge.org wrote: > Hello, > > I am trying to debug Apple version of pcsc-lite. The code contains calls like: > secdebug("pcscd", "RFCheckSharing: sharing violation, dwLockId: > 0x%02X", rContext->dwLockId); > > I would like to know _where_ the debug messages are sent? > And how to activate them (if needed)? <snip> > > It looks like it is related to DTrace. And I am a very beginner at DTrace. > So any help is welcome. > > Thanks > > -- > Dr. Ludovic Rousseau I have some instructions and a couple of D scripts for setting this up. Send a request to <dts(a)apple.com> and I'll get them to you without billing for a DTS incident. Best regards, --gc ____________________________________________________________________ Garth Cummings gcummings(a)apple.com Sr. Software Engineer Apple Developer Technical Support <http://developer.apple.com/technicalsupport>

1 0

How to use secdebug()
by Ludovic Rousseau 05 Jan '10

05 Jan '10

Hello, I am trying to debug Apple version of pcsc-lite. The code contains calls like: secdebug("pcscd", "RFCheckSharing: sharing violation, dwLockId: 0x%02X", rContext->dwLockId); I would like to know _where_ the debug messages are sent? And how to activate them (if needed)? What I found for now: >From /usr/local/SecurityPieces/Frameworks/security_utilities.framework/Headers/debugging.h // // The debug-log macro is now unconditionally emitted as a DTrace static probe p oint. // #define secdebug(scope, format...) \ if (__builtin_expect(SECURITY_DEBUG_LOG_ENABLED(), 0)) { \ char __msg[500]; snprintf(__msg, sizeof(__msg), ## format); \ volatile char c __attribute__((unused)) = scope[0]; \ SECURITY_DEBUG_LOG((char *)(scope), (__msg)); \ } else /* nothing */ #define secdebugf(scope, __msg) SECURITY_DEBUG_LOG((char *)(scope), (__msg)) >From /usr/local/SecurityPieces/Frameworks/security_utilities.framework/Headers/utilities_dtrace.h #define SECURITY_DEBUG_LOG(arg0, arg1) \do { \ __asm__ volatile(".reference " SECURITY_DEBUG_TYPEDEFS); \ __dtrace_probe$security_debug$log$v1$63686172202a$63686172202a(arg0, arg 1); \ __asm__ volatile(".reference " SECURITY_DEBUG_STABILITY); \ } while (0) #define SECURITY_DEBUG_LOG_ENABLED() \ __dtrace_isenabled$security_debug$log$v1() It looks like it is related to DTrace. And I am a very beginner at DTrace. So any help is welcome. Thanks -- Dr. Ludovic Rousseau

1 0

Re: [SmartcardServices-Dev] Proposal for patching and maintaining the main source repository
by Garth Cummings 21 Oct '09

21 Oct '09

Hi, > And now darwinbuild can handle subversion working copies (as of rev > 544). I made the necessary modifications to the SmartcardCCID.plist > already, so now the entire workflow is down to: > > $ mkdir ~/ccid && cd ~/ccid > $ darwinbuild -init http://svn.macosforge.org/repository/smartcardservices/trunk/SmartcardCCID/… > $ darwinbuild SmartcardCCID This is great, but I get a build failure because there's apparently supposed to be a ccid/ccid directory: > Build log begins here: > > the proj is: ccid > (cd /SourceCache/SmartcardCCID/SmartcardCCID-1/ccid/ccid && ./MacOSX/ > configure --no-configure --disable-opensc ) > /bin/sh: line 0: cd: /SourceCache/SmartcardCCID/SmartcardCCID-1/ccid/ > ccid: No such file or directory > make: *** [install] Error 1 > +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > +++++++++++ > BUILD TIME: 0h 0m 0s > EXIT STATUS: 2 Maybe the install target should be dependent on the installsrc target in the Makefile? --gc ____________________________________________________________________ Garth Cummings gcummings(a)apple.com Sr. Software Engineer Apple Developer Technical Support <http://developer.apple.com/technicalsupport>

3 2

Proposal for patching and maintaining the main source repository
by William Siegrist 09 Aug '09

09 Aug '09

Getting the source in the subversion repo to build is a little trickier that just checking it out and using Xcode. It is basically identical to what was released with 9J61, which means it requires a lot of extra stuff that is not in your retail copy of Leopard. So what I am proposing is using darwinbuild to continue patching and building the source. I think it'll be the easiest way to take contributions back from the public and keep things building. If you have another suggestion, please let us know. The SmartCardServices project on Mac OS Forge would provide a plist, a set of patches, and (optionally) a tarball of source. A typical workflow that contributes back a patch for SmartCardServices would look like: # download the custom plist with curl or svn $ curl -LO http://svn.macosforge.org/repository/smartcardservices/trunk/plists/scs_leo… # make a new environment $ mkdir ~/scsleo && cd ~/scsleo $ sudo darwinbuild -init ~/scs_leopard.plist ... watch darwinbuild fetch the other plists you need ... $ sudo darwinbuild SmartCardServices ... watch it load all the roots you need ... ... watch it build ... # save the original source to diff later $ cd BuildRoot/SourceCache/SmartCardServices/ $ cp -R SmartCardServices-34733 SmartCardServices-34733.orig $ cd ../../.. # make your changes $ vi BuildRoot/SourceCache/SmartCardServices/SmartCardServices-34733/ path/to/file.c ... edit more files as needed ... # try to build your changes # using -nosource is important as it tells darwinbuild to not overwrite your changes to the source cache $ darwinbuild -nosource SmartCardServices ... watch it build your modified source ... ... edit more files, repeat as necessary ... # create your patchfile $ cd BuildRoot/SourceCache/SmartCardServices/SmartCardServices-34733/ $ diff -ru ../SmartCardServices-34733.orig ./ > ~/ SmartCardServices_MyFix.patch Then you submit the patch to the project. When accepted, the project committers would need to modify the plist to include that patch filename and commit the new plist plus patch to the subversion repository (perhaps under trunk/plists and trunk/patches). Then the next person to perform the above workflow gets the new plist which uses the new patch. Note that this method does not use the source in the subversion repo. What could happen periodically is all of the patches get applied to the subversion repo and a new tarball is generated. Then the plist is modified to point to the new tarball and no patches. If you have any suggestions or opinions about working on the source in this manner, let us know. Thanks -Bill

2 8

How to add/install a new header file in the PCSC Framework
by Ludovic Rousseau 31 Jul '09

31 Jul '09

Hello, I would like to install a new header file (reader.h) in /System/Library/Frameworks/PCSC.framework/Headers/ How do I do that with darwninbuild? I could not find where/how the other headers files were installed. Thanks -- Dr. Ludovic Rousseau

2 3