January 2010 - SmartcardServices-Users

Warning: ccid-driver removed by cyberJack Driver V3.4
by Chris Hauser 16 Mar '10

16 Mar '10

Hello. Today I've installed the final Driver-Update (3.4) from ReinerSCT for their cyberJack Cardreader Series. <http://support.reiner-sct.de/downloads/cyberJack_Installer_3.4.dmg> The Surprise: All other Cardterminals were dead after Installation. The ReinerSCT-Installer removes the ifd-ccid.bundle of the Mac OS X System without a word. No Note, no warning, nothing. Chris -- This e-mail is digital signed. If your e-mail-application doesn't support the verification of digital signatures, just ignore the signature-file.

2 4

New CAC problems
by Evans, Paul CIV NAVAIR Bldg 1463 08 Feb '10

08 Feb '10

All, I just received a new CAC today and I'm having issues with it on my MacBook Pro running 10.5.8. The new card is apparently the dual applet type (CAC and PIV). I found a post on the fed-talk list from Shawn Geddis back in November pointing to the beta tokend and installed it but it still doesn't work. The card seems to be recognized by the keychain app but when I click on it it doesn't show any certs or other information. When I try to unlock it, it won't accept the PIN. Are there any work-arounds? Thanks, pe

6 19

Ref: CAC NG (PIV) for Mac SmartCard Services (Keychain)
by Courtney, Valencia V LCDR USA NORAD USNORTHCOM HQs J64 28 Jan '10

28 Jan '10

Classification: UNCLASSIFIED I'm a Mac user running OS 10.5.8 and using Safari 4.0.4. with 100% success in using a pre-DOD CAC NG issued card (issued in 2007) on a SCR 331 USB reader firmware v5.25 and ActivIdentity USB reader v2.0. I'm able to bind the CAC-Email cert to an https URL using the Keychain Access app. However, Keychain Access is unable to read the certs on my newly issued (2010) DOD CAC. Can you tell me if the CAC-NG (BETA v0.95) Leo <http://static.macosforge.org/smartcardservices/downloads/installers/CAC-NG-v 0.95-beta-leo.zip> (Jan 26, 2010) will resolve this problem? P.S. I tested Keychain Access ability to read a friends DOD CAC issued in late (Nov) 2008 and the certs were viewable and able to add Identity Preference (bind) to a CAC enabled URL with successful access after entering PIN. Also I tried the trail version of ActivClient CAC for Mac which was not able to read the certs from a pre or post DOD CAC NG. For the DOD CAC NG issued card, ActivClient displays message unable to read card message after 5 seconds of trying. For pre-DOD CAC NG issued card, ActivClient shows blue status bar in a loop as if trying to read the card but the app does not reach an end-state after a minute or more running, i.e. neither an error message for display of certs. The DOD CAC NG issued card works with problems on Win XP OS using ActivClient v6.1 via a SCR 331 or SCR 3310. V/r, LCDR Vee Courtney N-NC/J644 (719) 556-0889

1 0

Re: [SmartcardServices-Users] How can I specify alternate OCSP URL in OCS X?
by Beck, Keith M CDR ACNO NGEN, OPNAV N099 05 Jan '10

05 Jan '10

> Date: Mon, 04 Jan 2010 15:37:05 -0500 > From: "Shawn A. Geddis" <geddis(a)apple.com> > To: Paul Kwan <paul.kwan(a)centrify.com> > Cc: SmartcardServices-Users Group > <smartcardservices-users(a)lists.macosforge.org> > Subject: Re: [SmartcardServices-Users] How can I specify alternate > OCSP URL in OCS X? >Message-ID: <D79F1050-DA34-4F6C-8C8D-4CC4294D5B90(a)apple.com> >Content-Type: text/plain; charset="us-ascii" > ... > >Paul, > >No. Mac OS X enforces what is in the certificate, because that is what can >be absolutely validated. > >There are third-party products which have incorporated additional services >to rewrite/process the Cert Revocation URI found in the Cert to a >*configurable* URI -- allowing you to go from CRLDistribution Points to AIA >Extensions (for OCSP). >__________________________________________________ >Shawn Geddis geddis(a)mac.com >Security Consulting Engineer The certificate URI is fine for me. Is there a way to accept an OCSP reply when the responder is using a self-signed root and isn't in the chain of trust for the certificate/CA? There is probably a good reason to the DoD OCSP certificates, but OCSP always fails for me, causing the huge delays for CRL download. Keith

1 0

Question on the roadmap
by Thomas Åkesson 05 Jan '10

05 Jan '10

Hi Shawn et al, It is very encouraging to see activity on the project timeline! It would be very interesting to know what the expected outcome of the 2 milestones defined on the roadmap is. Are you planning to provide a binary release when completing the "Mac OS X 10.6.0" milestone? I opened a ticket (#8) a few months ago which depends on a more recent build of pcscd. Is there any chance of seeing a binary release with an updated pcscd in the near future? Thanks for your efforts, Thomas Å.

1 0

pcscd failing on osx 10.6.2?
by Fabrizio Rizzo 05 Jan '10

05 Jan '10

When I plug in my ActivIdentity smartcard reader, I see the following error in the console: 12/7/09 2:35:45 PM com.apple.securityd[25] /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ccid_usb.c:746:ccid_check_firmware() Firmware (2.02) is bogus! Upgrade the reader firmware or get a new reader. This very likely explains why I my CAC certs are not showing up in the keychain. Can anyone confirm functionality with an ActivIdentity USB 2.0 Smartcard Reader (P/N: ZFG-9800GAE) on Mac OS X 10.6.2? Will this reader work, and if so, what is the correct version of firmware? Thanks, -- -- Fabrizio

3 6