- Tokend-Dev - lists.macosforge.org

[SCSSU-201801] Addresses CVE-2018-4300 & CVE-2018-4301 in Project
by Shawn A. Geddis 31 Jul '18

31 Jul '18

SmartCardServices Community, I wanted to highlight that a security fix [SCSSU-201801] <http://smartcardservices.macosforge.org/trac/wiki/security> for addressing the following CVEs was merged into the project on May 28, 2018. They will be included in the next release of installers. However, each one of you that has developed your own Tokend for macOS, will want to ensure you pickup the changes. The fix was noted in PR-155 <https://github.com/smartcardservices/smartcardservices/pull/155> And the source code diffs are at Files Changed <https://github.com/smartcardservices/smartcardservices/pull/155/files> if any of you have any questions, fire away here on the list. - Shawn _____________________________________________________________________ Shawn Geddis geddis @ {icloud, me, mac} . com Security and Certifications Engineer geddis @ {apple} . com  Platform Security / SEAR Apple Inc. Smart Card Services Project/Dev Lead: Project Wiki: [https://smartcardservices.github.io <https://smartcardservices.github.io/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

Question about the SmartCardServices(JPKItokenD）for Sierra
by 石井　晶一 22 Feb '17

22 Feb '17

Dear Mr.Geddis I am ishii and I am an engineer at Japan Agency for Local Authority Information Systems. Thank you for your updating JPKI.tokenD for El Capitan. If you have a plan for the development of JPKI.tokenD for Sierra, please let us know when will it be completed by arround. Shoichi Ishii Department of Public Certification Service for Indivisuals Center of Personal Number, Japan Agency for Local Authority Information Systems

2 4

Update...
by Shawn A. Geddis 17 Feb '17

17 Feb '17

Torben, Just to keep you in the loop. I have been following up with Jennifer about the coordination with ApplePay folks in Europe and a followup discussion with BSI. She is indicating that her contact needed for this is currently on vacation > From: Jennifer Bailey <jbailey(a)apple.com> > Subject: Re: Checking in ... > Date: February 16, 2017 at 5:58:40 PM PST > To: "Shawn A. Geddis" <geddis(a)apple.com> > > Hi Shawn, > > The person who leads Apple Pay for me in Europe is on vacation this week and I’d like to run this by him before proceeding. We are happy to proceed quickly though once he’s back and we can coordinate the right folks. Thanks for the follow up ! > > Jennifer I hope I have followup from Jennifer before our call next Wednesday or we may need to push that call out until I do. - Shawn _____________________________ Shawn Geddis Security and Certifications Engineer  Platform Security / SEAR

1 0

return what error code from tokend when verify PIN error
by liuddd 10 Oct '16

10 Oct '16

Hi， everyone！ I have written a tokend, when user input the wrong PIN, Safari or KeyChain will not prompt user to input password again, how to inform Safari or Keychain that user should input PIN again, what error code should I return from tokend? Is there any document about this situation? thanks !

1 0

Tokend support in Sierra
by Guyomarch, Francois-Eric 01 Sep '16

01 Sep '16

Hi Tokend team, 1) With the introduction of the new CryptoTokenKit framework will tokend stil be supported in Sierra ? Any limitations ? 2) We have specific questions on the CryptoTokenKit framework, which is currently minimally documented, is this the right mailing list to ask question about that ? if not were to send questions to Thanks Regards

1 0

Re: [Tokend-Dev] [SmartcardServices-Users] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 30 Mar '16

30 Mar '16

I don’t know about OpenSC.tokend, but i’ll give it a look & test. I doubt it will work tough because the Belgian Identity Cards Encryption. If it works, why wouldn’t MacOSforge’s Belpic.tokend, only Beid.tokend seems to be able to decrypt my identity information but has the explained trouble. Apple used to create the Belpic.tokend in collaboration with the Belgian Federal ICT (edict) & Fedict included encryption version 1 & 2 in this version. The collaboration has stopped however, MacOSforge still update’s the Belpic.tokend for new OS X versions but does not change it further, Fedict has renamed the Belpic.tokend to Beid.tokend & has added encryption version 3 & 4 to it, however their new builds are buggy & seems to have earlier explained symptoms on my Mac. So i think in my case the Beid.tokend is the only one that will actually work with the encrypted data on my/the new issued Belgian Identity Cards (3th version of the Encryption) (For my earlier but now replaced ID card i used the Belpic.tokend from Apple/MacOSForge, this ID card had the 2nd version of encryption). I think, but i am not a developer, with the earlier linked source code/Development kit on Github the Belpic.tokend could be updated to work on the newer Belgian ID cards by the developers at MacOSForge. As mentioned earlier i read a post on this Lists that explained with CAC cards and CAC.tokend it was possible to login on OS X by inserting the CAC card & logout, go back to login screen or bring up a screensaver when the card is pulled out until it’s inserted again. I would like to have this possible swell for the Belgian ID card. How is this functionality implanted ? Is this included in the tokend ? > Op 29-mrt.-2016, om 20:57 heeft Uri Blumenthal <uri(a)mit.edu> het volgende geschreven: > > Since you probably have to use OpenSC anyway, why not try OpenSC.tokend? (Also, see other posts in SmartCardServices-Users regarding OpenSC.tokend forks) > >> On Mar 28, 2016, at 4:48 , Maccampus <maccampus(a)gmail.com> wrote: >> >> Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, >> >> A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. >> >> Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. >> >> The facts: >> >> • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. >> • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. >> • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. >> • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. >> • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. >> >> So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. >> >> Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. >> >> To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. >> >> The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. >> >> I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? >> >> You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. >> >> I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) >> >> Yours sincerely >> >> Maccampus >> >> Belgian Mac OS X User >> >> >> _______________________________________________ >> SmartcardServices-Users mailing list >> SmartcardServices-Users(a)lists.macosforge.org >> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users > > -- > Uri the Great > uri(a)mit.edu > > > > > _______________________________________________ > SmartcardServices-Users mailing list > SmartcardServices-Users(a)lists.macosforge.org > https://lists.macosforge.org/mailman/listinfo/smartcardservices-users

2 2

Re: [Tokend-Dev] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, I have found another link. Instead of looking for information in the source for the linux version which obviously won’t have source for the tokend which is OS X technology, you might have a look at folowing github page. https://github.com/Fedict/eid-mw On this page is an xcode project for the tokend. I think this could be very useful. Yours sincerely Maccampus Belgian Mac OS X User

1 0

Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. The facts: • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) Yours sincerely Maccampus Belgian Mac OS X User

1 0

How to display UI in tokend
by liuddd 02 Mar '16

02 Mar '16

Hi，everyone! I found that when I unlock tokend keychain in keychain access, if I input the wrong password, there's no promotion that my password is error. So I display an dialog in tokend to tell that the input password is error, but when I click the OK button, it becomes not responsive. tokend is owned by user _tokend, and keychain access is running as another user. How to solve this problem ?

1 0

How to clear Safari SSL cache
by liuddd 14 Oct '15

14 Oct '15

Hi, everyone! I found after I plug out my ccid reader and after my tokend process exits normally, I can still visit the SSL web page. How can I clear the SSL login cache after plug out the reader or smardcard? I found there's a certificate identity preference item left in the Keychain, how can I delete the certificate identity preference item using Keychain API or some shell scripts. Thank you!

1 0