May 2010 - SmartcardServices-Users - lists.macosforge.org

SetIdentityPreference on OSX 10.4 Tiger
by Dann, Geoff CIV NAVFAC ESC, PW 21 May '10

21 May '10

I've grabbed the SetIdentityPreference program from http://smartcardservices.macosforge.org/trac/wiki/installers , and have a couple of questions: (1) SetIdentityPreference returns an error if I enter a URL that is a directory, like the one for NMCI OWA, "http://webmail.west.nmci.navy.mil/". (2) When run, SetIdentityPreference lists two email certificates to choose from, but both are "usage: wrap", and the one needed for NMCI Outlook Web Access (OWA) is "usage: encrypt, verify, wrap, derive", far as I know. I did get SetIdentityPreference to work with the newly-enabled Defense Travel System (DTS). The DTS URL ends in a file name, not in a slash. DTS wants to see the Identity (non-email) certificate. Possibly related factor: I have NMCI OWA working by using the AFCCertificateControl preference pane that Paul Nelson of Thursby posted close to two years ago. It's supposed to hide the Identity (non-email) certificate from applications so they'll use an email certificate. It contains a check-box to allow the non-email cert to be seen or not seen. The check-box doesn't seem to have an effect, so the only way now to have the identity (non-email) certificate seen is to uninstall the software. So to switch between NMCI-OWA and DTS I'd need to go through several hoops. Any ideas what I might be missing? Anyone else using Tiger still? Geoffrey Dann geoff.dann(a)navy.mil NAVFAC Engineering Service Center, ESC231 1100 23rd Ave, Port Hueneme CA 93043-4370 805-982-1366 / DSN-551-1366 / fax 805-982-5388 cell 805-901-6777

1 0

tokendPKCS11 not working w/ Firefox (all versions)
by Miller, Timothy J. 21 May '10

21 May '10

Hints appreciated. The browser returns sec_error_pkcs11_function_failed, which is a non-specific error. I pulled down a nightly for the NSS debugging, and find the following PKCS11 debug (full debug avail on request): -1334726656[28e8ea0]: C_OpenSession -1334726656[28e8ea0]: slotID = 0x0 -1334726656[28e8ea0]: flags = 0x4 -1334726656[28e8ea0]: pApplication = 0x3130e00 -1334726656[28e8ea0]: Notify = 0x2533919 -1334726656[28e8ea0]: phSession = 0xb071aacc -1334726656[28e8ea0]: *phSession = 0x2 -1334726656[28e8ea0]: rv = CKR_OK -1334726656[28e8ea0]: C_SignInit -1334726656[28e8ea0]: hSession = 0x2 -1334726656[28e8ea0]: pMechanism = 0xb071ab1c -1334726656[28e8ea0]: hKey = 0x5 -1334726656[28e8ea0]: mechanism = CKM_RSA_PKCS -1334726656[28e8ea0]: rv = CKR_OK -1334726656[28e8ea0]: C_Sign -1334726656[28e8ea0]: hSession = 0x2 -1334726656[28e8ea0]: pData = 0xb071abdc -1334726656[28e8ea0]: ulDataLen = 36 -1334726656[28e8ea0]: pSignature = 0x188ccc00 -1334726656[28e8ea0]: pulSignatureLen = 0xb071ab28 -1334726656[28e8ea0]: *pulSignatureLen = 0x80 -1334726656[28e8ea0]: rv = CKR_FUNCTION_FAILED Since the module loads and does everything else correctly (near as I can tell) I'm not positive this is a FF bug. However, I don't know if it's an Apple bug either, so I haven't opened one against SmartCardServices ... yet. I know others are having the same problem, but with recent fixes in 10.6 and Safari the use of FF with smartcards has declined a bit (or alternative PKCS11 modules are being used). Anyone else have an idea? -- Tim

1 0

Re: [SmartcardServices-Users] CCID drivers auto-start issues on the Snow Leopard
by Paul Babick 14 May '10

14 May '10

So...what is the corrective action when the Smart Card doesn't appear in the keychain even though pcscd is running and pcsctest is successful? Reader is SCR 3310 Card is Gemalto Gemalto Mac library dated 22 April 2010 installed.

2 1

Re: [SmartcardServices-Users] [Fed-Talk] DoD ECA Certificates - Hardware vs Software with the Mac
by Shawn A. Geddis 10 May '10

10 May '10

Bob, to add clarity to other comments made already.. All Smart Card questions, comments, feedback go to http://SmartCardServices.MacOSFOrge.Org/ mailing lists... On May 10, 2010, at 9:38 AM, Bob Colbert wrote: ... > Particulary, I am trying to understand the ECA certificate program for DoD contractors. I currently have a “software” certificate. All applications on Mac OS X interface to credential stores as "Keychains" (except legacy apps using PKCS#11). A Smart Card is simply a "Dynamic Keychain" - available only while the Smart Card is inserted. > I was looking to convert it to either USB or SmartCard. You would not exactly convert the Identity (Certificate / Private Key), but change the storage medium from File-based Keychain to a Hardware Token-based Keychain (Smart Card). It would be a "smart card" whether it was a plastic card or USB form factor -- Smart Card simply refers to the chip-based technology (referred to as "CHIP and PIN" in Europe). > The ECA program defines this as Medium Hardware Assurance or Token Hardware Assurance. The Medium one is supposedly the ECA equivalent of a CAC card, however I havent had any problems thus far just using my software certificates. But I really don’t fully understand the technical/everyday usage difference between Medium Hardware vs Token Hardware levels. Tim properly noted that the issue for you is not the device (smart card), but rather what profile (applet) is loaded onto the device. PIV & CAC are already there in Mac OS X (have been for years) and CACNG is currently in beta via MacOSForge. If you want the easiest path forward, your organization would pick a PIV-compliant smart card and hence would have out of the box support on both Mac OS X and Windows 7. > While contacting one of the 3 vendors approved for ECA certificate issuance, it was brought up that there is a “middleware” client required for use with either a USB-based or SmartCard device for either Medium Hardware or Token Hardware levels. I believe the client is ActivClient. I am not sure if this middleware is required for all 3 vendors or just this one and is the middleware client the same for all three vendors. "Middleware" is not required on Mac OS X for Smart Cards - it is built into the OS, however, your system needs a corresponding "Tokend" for each Smart Card "type". Apple provides CAC tokend / PIV tokend(among others) and many of the Smart Card vendors make a tokend available for their proprietary cards when needed by their customers. Again, this is specific to the card profile (applet) loaded onto the device. > My basic questions about the middleware are the following: > Is this middleware still required using Mac 10.6.3? Previous posts by Shawn Geddis from Apple seem to apply that everything is provided for within the Mac OS. see comments above. > The ECA vendor seemed to imply that the current version of ActivClient is not ready for Snow Leopard. I do not believe you will see a SL version of ActivClient > Does this middleware impact the logon process or just when I want to sign/encrypt emails? My understanding of its usage is that it is a holder of the 2 certificates that I currently have in a software-version. That I just have to inserted/authenticated during the creation/sending/reading of the emails. We have a mixed Mac/PC environment and I am not fully ready to implement that type of signon environment currently required with government CAC usage. I just want to use the certs for email encryption. As Time noted, what you want to use your Smart Card for is up to you. > Does this middleware interface properly with either Mac Mail or Microsoft Entourage or again, is this middleware redundant? Mail.app and Entourage properly interface via Keychains and hence any valid credentials available to your system -- File-based, Smart Card-based, Director Server-based, etc. Again, All Smart Card questions, comments, feedback go to http://SmartCardServices.MacOSFOrge.Org/ mailing lists... - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise

1 0

JITC CAC card gets " An untrusted certificate authority was detected while processing the smart card certificate used for authentication" login error...
by Paul Kwan 01 May '10

01 May '10

Hi All, I posted this message in the Fed-Talk forum accidentally. I should post it here. Here's my message: I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again: 1) From the Windows login screen, it pops up this error message: The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication 2) On the Mac, secure.log shows similar error message complaining on "An untrusted CA..." The JITC CAC card is valid until next year. And the DoD certs on AD are also valid: 2.1) "DOD OM CA-20": Valid from 8/3/2007 to 8/1/2013 2.2) "DOD OM EMAIL CA-20": Valid from 8/2/2007 to 4/1/2013 2.3) "DoD JITC Root CA 2": Valid from 7/14/2005 to 7/2/2030 3) I can access and download the CRL files without any problem: 3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20 Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance. PSK

2 3