August 2015 - Tokend-Dev - lists.macosforge.org

Beid SDK 3.5 & 4.0
by Maccampus 28 Aug '15

28 Aug '15

Hello, I just found out that there are SDK kits from the Belgian Government, maybe the changes they did to the Belpic.tokend (2.0-2.0.1) to create the Beid.tokend (2.0-2.0.1) can be found in there & added to the Belpic.tokend 3.0 & up (or the Beid.token 3.0 & up). here are the links to find out more eID Software Development Kit - Developing eID applications - eID <http://eid.belgium.be/en/developing_eid_applications/eid_software_developme…> Fedict · GitHub <https://github.com/Fedict>e <https://groups.google.com/forum/#!forum/eid-middleware-dev> ID Middleware Dev - Google Discussiegroepen <https://groups.google.com/forum/#!forum/eid-middleware-dev> I hope this can help you to help me & all other Belgian Mac users wo had their Belgian ID card replaced During & after May 2015. (I found out that during May 2015 the Beid Card changed their certificates from Rev. 2 to Rev.3 so all cards from then on contain only Rev.3 certificates) Thanks Maccampus

2 1

Re: [Tokend-Dev] Altered Security Tokend for Belpic/Beid
by Maccampus 25 Aug '15

25 Aug '15

I got a Reply From Ludovic Rousseau (is this your real name?) Telling me the Belpic Tokend is under Apple Public Source License Version 2.0. [1] & as long as the Belgian Government Agency respect the licence that is fine. However The Belgian Government doesn’t update the Tokend & The Mac OS Forge does. However the 3th generation of BEid Cards need the version of the Belgian Government because the Apple Tokend doesn’t contain the right encryption/decryption for that Generation of ID Cards. This is where trouble’s start. To be certain troubles start with the Tokend & the 3th Generation ID Card i did the following tests. There are 2 other methods to use the ID Card without the Tokend, -There’s a Java application (which still needs Apple’s Java 6, but if you get the Application.jar out of the application.app bunble it does run on newer Jave, so i run it on Java 8). This Java App can read my 3th generation ID Card & can test the pincode (password). Method 2 is using the Firefow Browser with an add on written by the Belgian Government, this also works fine, i can login & go to my personal dossiers at several government or government linked agency’s (tax, social security, pension, birth,…). Needles to say it also works for 2nd generation, ID Cards. -Then there is the Apple way, with this i mean Software that uses the Apple way of using Smartcards. (The tokend make the keychain from the Card available in Keychain & the Applications use Keychain to use the keys, Applications like Safari, Google chrome). For this test i use Safari & also Google chrome to double check. -First problem: The keychain should be added to keychain as soon as you connect the Smartcard Reader & insert a ID Card. This hardly works (So almost all the time the keychain is not added, seems like the tokens doesn’t see the smartcard reader while if i open the java application ID information gets instantly read). This is with any version of ID Card. You can keep trying & eventually get lucky, but if you connect the reader before boot it works. With that first problem out of the way, i see my 3th Gen ID Card in the Keychain, i open Safari, go to a protected Government website & try to login, This brings me to the BEid Login site & asks me to select the Certificate & then asks for my pincode which i give, it then again asks me for the right certificate, i am stuck in an infinite Loop. I now do the same with a 2nd Gen ID Card, after providing the pincode i go to the protected website with the personal information of a family member who still has a 2nd gen ID Card. As we see, it works if we avoid the tokend, if we use the tokens, it works with Gen 2 but not Gen 3 ID Cards, besides that, the reader needs to be connected before boot. We also know The Belgian Government written tokens is Version 2.0-2.0.1 which is certainly not written For Mac OS X 10.10. The MacOSForge tokens is version 3.0, supports Mac OS X 10.10 but doesn’t have the compatibility with Belgian Beid Cards version 3. The solutions are (imho). - Belgian Government fix their Tokend & during this fix update it to version 3.0. Also they keep it up to date from now on. - The Belgian Government gives the MacOSForge the needed code to make their Tokend BeID Card Version 3 compatible & let them keep the tokend up to date. If a future Generation 4 happens again, they work with the MacOSForge & let them have the new code. Also they supply the latest DMG of smartcardservices with every update of their software or provide a link to the MacOSForge to let the end user get the latest SmartCardServices themselves. > Op 24-aug.-2015, om 20:12 heeft tokend-dev-request(a)lists.macosforge.org het volgende geschreven: > > Date: Mon, 24 Aug 2015 20:07:47 +0200 > From: Maccampus <maccampus(a)gmail.com> > To: tokend-dev(a)lists.macosforge.org > Subject: [Tokend-Dev] Altered Security Tokend for Belpic/Beid > Message-ID: <D2362340-45CA-4B87-865A-F6848C08DEDA(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > > Hello, > > The Belgian Government Agency (Belpic) who is in charge of making software for the Belgian Electronic Identity Card (BEID) has altered the BelPic Tokend from this project. > They never have uploaded their changes to this project though. > > They seem to have taken the Apple Card Services 2.0bx or lower which contains Belpic.tokend 2.2.1 & 2.2. Maybe they took the source files & altered them or they took the Installable files & have hacked them, to add a higher encryption for Version 3 of the Beid Cards. > > They have not informed you of their changes & their changes are not added to the later versions of your versions of the Belpic.tokend. Rather they renamed the Belpic.tokent to Beid.tokend & even with their latest software they make us Belgian Apple using citizens to install an old version of the Belpic.tokend, instead of altering the later versions as one would atlas have expected. > > I want to inform you about these changes in hope that you can add them to the latest versions of the Belpic.tokend & inform them about their inappropriate behavior. Maybe also discuss the future name of the tokens to be Belpic or Beid. > > I have added their versions of the older Tokend which they are currently using, maybe you can extract the changes from those, if not you will need to ask them for the source. > > They are found here Home <http://eid.belgium.be/nl/> & have an online contactsheet for technical questions Contact - Home <http://eid.belgium.be/nl/contact/contactform.jsp>. They also use a 3th party to develop for them which is Zetes & can be found here, Zetes Industries - Supply Chain & Mobility Solutions | Auto-ID & Goods Identification | People ID Solutions - Zetes Europe, Middle-East & Africa <http://nl.zetes.be/>, or here Overzicht - Kaartlezers Belgische identiteitskaart <http://www.belgeid.be/>. Maybe you might find them to be the one?s that (once) altered & delived your software for the Belpic Agency. > > I hope you can make them in cooperation with you deliver the latest version of YOUR Belpic/Beid.tokend containing THEIR changes with their software, preferably by adding your complete software installer to their package or a link to your website rather then only the BELPIC/BEID.tokend. They can inform users to only install the Belpic/Beid Tokend. > > Thanks for making them setting things right. > > > >

2 2

Altered Security Tokend for Belpic/Beid
by Maccampus 24 Aug '15

24 Aug '15

Hello, The Belgian Government Agency (Belpic) who is in charge of making software for the Belgian Electronic Identity Card (BEID) has altered the BelPic Tokend from this project. They never have uploaded their changes to this project though. They seem to have taken the Apple Card Services 2.0bx or lower which contains Belpic.tokend 2.2.1 & 2.2. Maybe they took the source files & altered them or they took the Installable files & have hacked them, to add a higher encryption for Version 3 of the Beid Cards. They have not informed you of their changes & their changes are not added to the later versions of your versions of the Belpic.tokend. Rather they renamed the Belpic.tokent to Beid.tokend & even with their latest software they make us Belgian Apple using citizens to install an old version of the Belpic.tokend, instead of altering the later versions as one would atlas have expected. I want to inform you about these changes in hope that you can add them to the latest versions of the Belpic.tokend & inform them about their inappropriate behavior. Maybe also discuss the future name of the tokens to be Belpic or Beid. I have added their versions of the older Tokend which they are currently using, maybe you can extract the changes from those, if not you will need to ask them for the source. They are found here Home <http://eid.belgium.be/nl/> & have an online contactsheet for technical questions Contact - Home <http://eid.belgium.be/nl/contact/contactform.jsp>. They also use a 3th party to develop for them which is Zetes & can be found here, Zetes Industries - Supply Chain & Mobility Solutions | Auto-ID & Goods Identification | People ID Solutions - Zetes Europe, Middle-East & Africa <http://nl.zetes.be/>, or here Overzicht - Kaartlezers Belgische identiteitskaart <http://www.belgeid.be/>. Maybe you might find them to be the one’s that (once) altered & delived your software for the Belpic Agency. I hope you can make them in cooperation with you deliver the latest version of YOUR Belpic/Beid.tokend containing THEIR changes with their software, preferably by adding your complete software installer to their package or a link to your website rather then only the BELPIC/BEID.tokend. They can inform users to only install the Belpic/Beid Tokend. Thanks for making them setting things right.

2 1

how to monitor smart card reader's hot plug event?
by liuddd 18 Aug '15

18 Aug '15

Hello! I wan't to use PC/SC API to monitor a USB smartcard reader's plug event, but after I plug out the reader and wait for a while, the pcscd will exit, and if I continue to call PCSC functions, some functions will cause segment fault. Can I get a message when a reader is plugged out, or can I configure pcscd so that it won't exit until system restart? Thank you !

2 1

Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 3
by liuddd 14 Aug '15

14 Aug '15

Hello! Thank you! I can insall a pc/sc driver to get my tokend loaded, but only on MacOSX 10.10。 On MacOSX 10.9, it doesn't work, It seems that only CCID device can do it. The question is : Can I create a Keychain when my USB device plugged in, then add certificate and public keypair items, and then bowsers such as Safari will use my Tokend to do cryptograhic operation such as doing SSL handshakes. But I can't find any materials about how Tokend and Keychain is related, and which API can I use to create a keychain for Tokend, and add other items under the new created keychain. Thanks a lot ! At 2015-08-14 03:00:01, tokend-dev-request(a)lists.macosforge.org wrote: >Send Tokend-Dev mailing list submissions to > tokend-dev(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/tokend-dev >or, via email, send a message with subject or body 'help' to > tokend-dev-request(a)lists.macosforge.org > >You can reach the person managing the list at > tokend-dev-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Tokend-Dev digest..." > > >Today's Topics: > > 1. Re: Tokend-Dev Digest, Vol 31, Issue 1 (Ludovic Rousseau) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 13 Aug 2015 13:59:38 +0200 >From: Ludovic Rousseau <ludovic.rousseau(a)gmail.com> >To: "tokend-dev(a)lists.macosforge.org" > <tokend-dev(a)lists.macosforge.org> >Subject: Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 1 >Message-ID: > <CAGstE8ApeajcyawzefV7OEON=WK-whVF1BvFEE82c9ikfdSOmQ(a)mail.gmail.com> >Content-Type: text/plain; charset=UTF-8 > >Hello, > >2015-08-12 9:14 GMT+02:00 liuddd <liudy75(a)163.com>: >> Thanks for the reply. In my situation, I have a reader using only USB >> HID(Human Interface Device) protocol to communicate with MacOS, It is not a >> CCID reader, but I can write a PCSC driver for the reader under Windows and >> then use PCSC API to communicate with it, can I also write a PCSC driver to >> do that under MacOSX? If I can, What should I do to achieve that? >> Is that only CCID reader can initiate the loading of TokenD? I would >> like to know how securityd, pcscd and tokend interact, and what happened >> from when a USB reader plugin into the system to when the corresponding >> Tokend is loaded. > > >Yes, you will have to write a PC/SC driver for Mac OS X. > >The system will detect when you insert your USB device and start the >PC/SC driver and the different tokend. > >Maybe you can write a fake/limited PC/SC driver and use HID directly >(instead of PC/SC) in your tokend. > >Bye > >-- > Dr. Ludovic Rousseau > > >------------------------------ > >_______________________________________________ >Tokend-Dev mailing list >Tokend-Dev(a)lists.macosforge.org >https://lists.macosforge.org/mailman/listinfo/tokend-dev > > >End of Tokend-Dev Digest, Vol 31, Issue 3 >*****************************************

1 0

Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 1
by liuddd 13 Aug '15

13 Aug '15

Thanks for the reply. In my situation, I have a reader using only USB HID(Human Interface Device) protocol to communicate with MacOS, It is not a CCID reader, but I can write a PCSC driver for the reader under Windows and then use PCSC API to communicate with it, can I also write a PCSC driver to do that under MacOSX? If I can, What should I do to achieve that? Is that only CCID reader can initiate the loading of TokenD? I would like to know how securityd, pcscd and tokend interact, and what happened from when a USB reader plugin into the system to when the corresponding Tokend is loaded. At 2015-08-11 03:00:01, tokend-dev-request(a)lists.macosforge.org wrote: >Send Tokend-Dev mailing list submissions to > tokend-dev(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/tokend-dev >or, via email, send a message with subject or body 'help' to > tokend-dev-request(a)lists.macosforge.org > >You can reach the person managing the list at > tokend-dev-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Tokend-Dev digest..." > > >Today's Topics: > > 1. Re: Tokend-Dev post from liudy75(a)163.com requires approval > (Shawn A. Geddis) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Sun, 09 Aug 2015 14:32:07 -0700 >From: "Shawn A. Geddis" <geddis(a)apple.com> >To: liuddd <liudy75(a)163.com> >Cc: Tokend-Dev <tokend-dev(a)lists.macosforge.org> >Subject: Re: [Tokend-Dev] Tokend-Dev post from liudy75(a)163.com > requires approval >Message-ID: <1216EAFC-0357-411E-AB3F-2FF2F7995A53(a)apple.com> >Content-Type: text/plain; charset="utf-8" > >> From: liuddd <liudy75(a)163.com> >> Date: August 6, 2015 at 2:34:38 AM PDT >> To: tokend-dev(a)lists.macosforge.org >> Subject: get tokend loaded for USB HID device >> >> Hi ! >> I wan't to get my own tokend get loaded, but my device is a USB HID device. Is there any way to do it? Can I just send some message to securityd to accomplish it? Thanks for some advices. > >You have provided very little information for anyone to be able to help. You will need to provide much more for us to know exactly what you need for direction. > >A Tokend is for communication usually to an Applet on the card and not to the device ? USB devices actually play the role of both reader and token in one. Devices are required to be supported first by a reader driver ? default driver included in OS X is a CCID driver which supports hundreds of readers ? may or may not supports yours - can?t tell since we do not know what reader and token type you are using. > >When you insert a token (ie. provisioned Smart Card into a reader or a USB Composite Token), all of the installed Tokend modules will be launched by the OS with each performing their own probing of the card to determine what it is (ie. BELPIC, CAC, CACNG, JPKI, PIV, etc?) and determining whether it knows and can communicate with that card type. Scoring takes place and the Tokend with the highest score remains live and associated with that card for this session. You can execute the command ?top? in Terminal prior to inserting your token. If you do not see the tokend names I listed above appear or remain after probing (or one that may correspond to a tokend you installed) then there is no currently supported tokend for the token you have inserted. > >If you can provide more, we can give more/better guidance. > >- Shawn >_____________________________________________________________________ >Shawn Geddis geddis@{Mac | Me | iCloud}.com >Security and Certifications Engineer, Apple geddis(a)apple.com > >Smart Card Services Project/Dev Lead: > Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] > Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] > SCS Contact: [scs-contact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] > SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] >_____________________________________________________________________ >

2 1

Re: [Tokend-Dev] Tokend-Dev post from liudy75@163.com requires approval
by Shawn A. Geddis 09 Aug '15

09 Aug '15

> From: liuddd <liudy75(a)163.com> > Date: August 6, 2015 at 2:34:38 AM PDT > To: tokend-dev(a)lists.macosforge.org > Subject: get tokend loaded for USB HID device > > Hi ! > I wan't to get my own tokend get loaded, but my device is a USB HID device. Is there any way to do it? Can I just send some message to securityd to accomplish it? Thanks for some advices. You have provided very little information for anyone to be able to help. You will need to provide much more for us to know exactly what you need for direction. A Tokend is for communication usually to an Applet on the card and not to the device — USB devices actually play the role of both reader and token in one. Devices are required to be supported first by a reader driver — default driver included in OS X is a CCID driver which supports hundreds of readers — may or may not supports yours - can’t tell since we do not know what reader and token type you are using. When you insert a token (ie. provisioned Smart Card into a reader or a USB Composite Token), all of the installed Tokend modules will be launched by the OS with each performing their own probing of the card to determine what it is (ie. BELPIC, CAC, CACNG, JPKI, PIV, etc…) and determining whether it knows and can communicate with that card type. Scoring takes place and the Tokend with the highest score remains live and associated with that card for this session. You can execute the command ‘top’ in Terminal prior to inserting your token. If you do not see the tokend names I listed above appear or remain after probing (or one that may correspond to a tokend you installed) then there is no currently supported tokend for the token you have inserted. If you can provide more, we can give more/better guidance. - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-contact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0