October 2009 - Tokend-Dev - lists.macosforge.org

Multiple PIN Handling/On-Access PIN in TokenD
by Thomas Harning Jr. 20 Nov '09

20 Nov '09

I'm working on writing a TokenD for a device with two applets on it. The share the same PIN, however there is an oddity that I'm trying to manage inside the TokenD. Applets A and B Select A, Verify PIN Authenticated to A until reset (even if select B) Select B, Verify PIN Authenticated to B until reset, or select anything else, including A I've tried using 2 PIN slots in the TokenD and assigning the relevant Records and KeyHandles to use slot 1 for applet A's items and slot 2 for applet B's items... and it seems to "get it" when it needs to authenticate for using applet B's items the first time... however when it goes and checks for pinStatus the second time around after it had authenticated once to B, it looks for the pinStatus on slot 1... not the slot 2 that is assigned as the owner and the necessary ACL authorizer for decrypt/sign... Is there some other place that needs to be setup to deal with 2 PIN slots properly? the Token class adds the PWSubject and PromptPWSubject to its list of pin types for both slot 1 and 2. the Record and KeyHandle objects put the PinSubject entries for sign/decrypt to slot 1 and 2 for the right handles/etc... the Record and KeyHandle objects also return that the owner is the relevant PinSubject (this wasn't required to get the 1st authorization to use the right slot, but as added in an attempt to get it working for subsequent auth) I've also tried to use the PromptPWSubject, and that brings up a prompt box, but passes an empty PIN back for authentication...... not so useful. Is there anything else I need to do? I've heard that Securityd does tons of caching.. but if requests for pinStatus multiple times for each authentication, so I'd expect that it should use the associated pin number when trying to authenticate for key usage... -- Thomas Harning Jr.

1 1

Keychain Access does not dynamically update the keychain list on Snow Leopard Mac OS X 10.6.1 (10B504)
by Ludovic Rousseau 23 Oct '09

23 Oct '09

Hello smart card users, I just reported problem ID 7329889 (copy bellow) I would like to know if it is a known problem or only in my configuration. Bye 23-Oct-2009 10:36 AM Ludovic Rousseau: Summary: When a smart card is inserted and a tokend is executed the new keychain does not appear in the Keychain Access application. I have to quit and restart Keychain Access to have my new keychain displayed. Steps to Reproduce: 1. start Keychain Access 2. insert a supported smart card 3. wait, wait, wait. no new keychain displayed in the application 4. quit Keychain Access 5. start Keychain Access 6. a new keychain corresponding to the smart card is displayed Expected Results: 1. start Keychain Access 2. insert a supported smart card 3. a new keychain corresponding to the smart card is displayed Actual Results: The new keychain is displayed only after the Keychain Access application is restarted. The same problem is also present when removing the smart card. The keychain corresponding to the smart card is still displayed after the card removal. The list is only updated after restarting Keychain Access. Regression: Yes. This problem was not present in Leopard. It is new in Snow Leopard. -- Dr. Ludovic Rousseau

1 0

error: dlfcn.h: No such file or directory
by Ludovic Rousseau 21 Oct '09

21 Oct '09

Hello, I am trying to add a tokend to the existing tokend from Apple. The goal is to upload it on macosforge.org. My tokend uses dlopen() and so #includes dlfcn.h. My problem is that this header is not found: /Volumes/BuildRoot_10B504_20091012115357/SourceCache/Tokend/Tokend-36720/PKCS11/FooToken.cpp:15:19: error: dlfcn.h: No such file or directory I guess I need to add a dependency on dyld by creating an Info.plits like the one for SmartcardCCID [1]. Is that correct? Where should I put the Info.plist file and what to put inside? Thanks [1] http://svn.macosforge.org/repository/smartcardservices/trunk/SmartcardCCID/… -- Dr. Ludovic Rousseau

2 1