- SmartcardServices-Users - lists.macosforge.org

Help loading certs... (somewhat off-topic)
by David Emery 19 Sep '11

19 Sep '11

I got Verisign individual identity PKI certs that I had loaded into Keychain.app, and they were picked up by Keychain as "My Certs" supporting signed/encrypted emails. Then I had to reload my home account, and I tried reloading those certs. They will not show up as "My Certs" in Keychain, and that means that I can't decrypt emails sent to me using that cert (nor sign emails.) Anyone got any ideas how to attack/address this problem? Apple Tech Support pretty much washed their hands of the problem. Thanks in advance! dave

2 1

Oberthur support
by Reese, Brian, CTR, Fort Meade-IRM 01 Sep '11

01 Sep '11

Hello, Are we ever going to see support added for the Oberthur ID One 128 v5.5 Dual on the CACNG tokend? These cards are becoming more popular in the DoD. Thursby's tokend breaks the ability to decrypt emails so there doesn't seem to be any alternatives for those with Oberthur cards. It feels like we've been waiting years for this. With Lion no longer shipping with any tokend files, I'm afraid this issue is not receiving any attention.

2 1

[Announce] OS X Lion SmartCardServices Installer v2.0b1 (beta)
by Shawn Geddis 19 Aug '11

19 Aug '11

[Announce] OS X Lion Installer Available OS X Lion SmartCardServices Installer v2.0b1 (beta) http://smartcardservices.macosforge.org/post/os-x-lion-smartcardservices-in… Installer for testing is located here: http://smartcardservices.macosforge.org/trac/wiki/installers -Shawn __________________________________________________ Shawn Geddis geddis(a)me.com Security Consulting Engineer geddis(a)apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________

1 0

Re: [SmartcardServices-Users] [Fed-Talk] Lion - CAC and other Smart Cards
by Bob Colbert 27 Jul '11

27 Jul '11

Shawn, I believe that the Cyberflex Acess 64k V2C Card (ORC-issued ECA Smart Card) is a Java-type card if this means anything. I believe the technical details are the following: memory 64KB EEPROM for applets and data Java Card Standard Global Platform ISO 2.1.1 (API, JCRE, JVM) 2.0.1 7816 (1,2,3), 7813, 7810 cryptographic algorithms RSA 1024, 2048 DES, 3DES (CBC EBC) SHA-1 hashing API for AES128 cryptographic features Global PIN Support Global Platform (mandadet) DAP Mutual Authentication through Global Platform Secure Channel evaluated FIPS 140-2 Level 3 Im not sure if this means anything to you or if the upcoming Tokends from the MacOSForge site will support these. Support of this card is important for DoD contractors that use the DISA-desiginated External Certificate Authority - http://iase.disa.mil/pki/eca/ ORC is one of the approved vendors for this program - http://eca.orc.com/ If not, I doubt Pkard would help either. Bob Colbert DE Technologies, Inc. 118 Sleepy Hollow Drive Suite 1 Middletown, DE 19709 302-285-0354 302-285-0357 fax colbert(a)detk.net From: Shawn Geddis <geddis(a)apple.com<mailto:geddis@apple.com>> Date: Wed, 20 Jul 2011 13:49:57 -0400 To: Bob Colbert <colbert(a)detk.net<mailto:colbert@detk.net>> Cc: "fed-talk(a)lists.apple.com<mailto:fed-talk@lists.apple.com>" <fed-talk(a)lists.apple.com<mailto:fed-talk@lists.apple.com>> Subject: Re: [Fed-Talk] Lion - CAC and other Smart Cards On Jul 20, 2011, at 11:23 AM, Bob Colbert wrote: Now the Lion has been released, can those of you that posted some additional information to the Developer Forums (because of the NDA) provide some of the info that is probably pertinent to those of us watching this list? Perhaps the most critical for those watching this list, is the purported non-support of CAC cards in Lion. The militarycac.com<http://militarycac.com> website is reporting that Pkard is the only option for CAC support for Lion. I swear I thought that Shawn Geddis has implied that the new CAC cards would be supported in Lion because the tokend was updated but not yet published to the Sourceforge site. Seems like a big disconnect. Maybe CAC support was pulled at the last minute? My ;articular interest is also in the support of the ECA-type of certificates for us contractor-folk. Currently Pkard does not support these cards. Although Im pretty sure that someone from Thursby follows this list. Can you support some of these cards? My ORC-issued ECA Smart Card is reported as a Gemalto Cyberflex Access 64k V2C. Bob Colbert DE Technologies, Inc. Bob, With respect to OS X Lion, please see my previous message. With respect to your "Gemalto Cyberflex Access 64k V2C". What Applet is loaded on the card ? On OS X, it is not actually the card per se that determines support or not, but rather what applet is loaded. OS X requires a Tokend for each Applet/Profile and if that is not recognized then OS X is unable to use the card. You would need to acquire a Tokend (open source or commercial) to support whatever applet is loaded on your Smart Card. - Shawn ________________________________________ Shawn Geddis Security Consulting Engineer Apple Enterprise Division

1 0

Lion release?
by Walls, Bryan K. (MSFC-EO50) 20 Jul '11

20 Jul '11

Is there an ETA on when there might be an installer package for Lion that will give a similar setup for smart cards as comes by default with 10.6.8?

2 1

Support for Oberthur ID One 128 v5.5 Cards?
by Brandon Becker 18 Jul '11

18 Jul '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there any support for the Oberthur ID One 128 v5.5 cards on Mac OS X 10.6 yet? I know the latest blog entry specifically indicates this card is not supported, but I'm hoping there's been some work in that direction. We're being issued the Oberthur cards and are stuck until they're supported. Thanks, Brandon Becker ARSC, UAF -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.0.0 (Build 2732) Charset: us-ascii wj8DBQFOJIqzcxjLO/jYtPkRAmFrAJ9rGH+7Uu6LHU3z2f2GYH7NDQ07tQCdHR8m z0E/OmOALok8En2vyeaacDU= =QYNE -----END PGP SIGNATURE-----

2 1

Lion support
by Mickey Phelps 08 Jul '11

08 Jul '11

Is there a Beta build yet for Lion?

2 2

ECA Smart Card on Mac - Certificates not showing up
by Bob Colbert 12 May '11

12 May '11

I have posted to this list previously about the ORC-issued ECA certificates on a Actividentity USB token not showing up in the Mac keychain. This token works fine in Windows/ActivClient. I was reading on this list after that (about a year ago) and someone reported that the ORC-issued ECA certificates that are provided on a smart card, do in fact work and display properly in the Mac Keychain. My certificate was expiring soon so I took the opportunity to change from the USB token to the Smart Card. And of course, this Smart Card does not display the certificates in the Keychain. Why is this stuff so difficult? I did find out through the use of the Windows ActivClient, that the "info" about this card is that it is a Gemalto Cyberflex Access 64K v2c. Im not sure if this helps determine if there is something I can download (a new tokend perhaps?) in a similar manner in which the CACNG tokend is provided. Previous postings by Shawn Geddis implied that my old USB token driver parsing software (or something to that effect) needed to updated for these newer cards. Maybe the same holds true for this particular Smart Card? Can anyone offer any help/suggestions? Thanks, Bob Colbert DE Technologies, Inc.

1 0

Leopard with CACNG (UNCLASSIFIED)
by Shomo, Michelle L USA CTR (US) 25 Apr '11

25 Apr '11

Classification: UNCLASSIFIED Caveats: NONE I previously completed testing with Leopard and CACNG and it was working fine. However last week I had to download the CACNG drivers from the macosforge site again and now when trying to use a Gemalto 144k CAC with Safari I get prompted repeatedly to select a certificate, that the one presented is not accepted. The issue is being experienced with both Safari 4 and multiple versions of Safari 5. When using Chrome you receive an SSL Connection Error 107. The certificates are listed in a different order within Keychain Access as well. Also with Safari 5 I noticed that it doesn't prompt for a certificate unless you already have an ID Preference setup within Keychain Access (it isn't attempting to add ID Preferences unless one already exists). The correct certificate is being selected (verified using the serial number) based on what is displayed. The CAC works from the Snow Leopard and Windows systems, so the issue is not the CAC or the websites. I know that a previous version of the Leopard CACNG had the same symptoms, it appeared that is was sending the same wrong certificate every time no matter which certificate was selected, however when the last release came out this issue was fixed. Is there any way to verify I have the correct version? The issue is repeatable. I have at least one user with the issue and I have at least 2 systems in the lab with the same issue. Any ideas? Thanks, Michelle ~~~~~~~~~~~~~~~~~~~~~~~~~~ Michelle Shomo, CISSP michelle.l.shomo(a)us.army.mil ~~~~~~~~~~~~~~~~~~~~~~~~~~ Classification: UNCLASSIFIED Caveats: NONE

1 0

ECA Smart Cards on Snow Leopard
by Suzanne Stevens, Contractor, Code 5595 01 Apr '11

01 Apr '11

Has anyone made or heard of any progress with regards to ECA Smart Cards on Snow Leopard? The last update I can find is that the card shows up in Keychain Access but the certificates aren't available. Thanks for any info, Suzanne

6 6