- Tokend-Dev - lists.macosforge.org

Re: [Tokend-Dev] [SmartcardServices-Dev] Signed Installer posted for OS X El Capitan v10.11
by Shawn Geddis 02 Oct '15

02 Oct '15

On Oct 1, 2015, at 11:44 AM, Thomas Harning Jr. <harningt(a)gmail.com> wrote: > > Thanks. Is there any documentation available that shows where the new tokend installations should go? > > Does this installation location happen to work for older OSX versions, or is the location only scanned by OSX 10.11? If this location is only for newer versions of OSX, this complicates things for users that install an application on 10.10 or earlier and come to OSX 10.11 to discover their TokenD was obliterated. > > Smart card development for OSX seems to be a particularly dark art. By chance are there any samples of TokenD modules written using Apple's new blessed token API - the asynchronous nature of the new API seems to be in conflict with TokenD API specifications. Thomas, • The Installer Download Page, the Installer and the man page for SmartCardServices notes the new tokend installation path for OS X El Capitan v10.11. • The Path [/Library/Security/tokend/ ] is new for OS X El Capitan v10.11 and higher and is not supported on older versions of OS X v10.x. • Location of Tokend bundles does not affect use by Applications, since this is completely abstracted away. • There currently is no code samples or reference implementations for CryptoTokenKit Clients from Apple nor yet from the project here. • TokenD API specifications ? There never was any API specification to Apple’s knowledge. What reference are you making ? See man page for SmartCardServices…. $ man SmartCardServices SMARTCARDSERVICES(7) BSD Miscellaneous Information Manual SMARTCARDSERVICES(7) NAME SmartCardServices -- overview of smart card support DESCRIPTION SmartCardServices is a set of components which add native support for smart cards to OS X. Supported smart cards appear as separate keychains. A Tokend module for each smart card you wish to use must be installed in /Library/Security/tokend USB SMART CARD READER DRIVERS OS X has built-in support for USB CCID class-compliant smart card read- ers. For other readers, install the reader driver in /usr/local/libexec/SmartCardServices/drivers. Each driver is a bundle. The bundle contains an XML file Info.plist which contains the device's USB vendor ID and product ID. For detailed description of the plist for- mat and how to write a reader driver, see http://pcsclite.alioth.debian.org/api/group__IFDHandler.html SMART CARD APDU LOGGING It is possible to turn on logging for smart cards. Logging is turned on by setting the global preference: sudo defaults write /Library/Preferences/com.apple.security.smartcard Logging -bool yes After a smart card reader is connected (or after reboot) all operations including contents of sent and received APDU messages are then logged into the system log. Logging uses the facility com.apple.security.smart- card.log so it is possible to set up filtering of these logs into custom targets (see asl.conf(5)) To avoid security risks that could occur if logging is turned on indefi- nitely, the logging setting is one-shot - it must be turned on by the command above to start logging again with a new reader. This includes unplugging and replugging the same reader. SEE ALSO sc_auth(8), defaults(1), asl.conf(5), ssh-keychain(8) Mac OS X August 5, 2014 Mac OS X - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

2 1

Signed Installer posted for OS X El Capitan v10.11
by Shawn A. Geddis 01 Oct '15

01 Oct '15

Signed Installer posted for OS X El Capitan v10.11 <https://smartcardservices.macosforge.org/post/signed-installer-posted-for-o…>2015-10-01 Installer posted for OS X El Capitan v10.11. This SmartCardServices Installer provides the Tokend bundles and cacloginconfig.plist for installation on your OS X El Capitan systems. Starting with today's (1 Oct 2015) release of the installer for OS X El Capitan v10.11, we are digitally signing the Installer and Tokend bundles for integrity assurance. The installer will be recognized and install properly with Gatekeeper set to default or higher and, on El Capitan, are installed in a new location "/ Library / Security / tokend" to work with System Integrity Protection (SIP) enabled. ____________________________________________________________________________________ NOTE: Installer and Tokend bundles from this project are now digitally signed. Older installers (ie. for v10.10, v10.9, ...) will be re-posted, incremented to v2.1, and digitally signed. The installation location will remain as they were on the respective OS releases. ____________________________________________________________________________________ You should verify the integrity of the Tokend(s) you have installed by verifying the digital signature using the following command in Terminal: $ codesign -dvvvv /Library/Security/tokend/<nameoftoken>.tokend for example: $ codesign -dvvvv /Library/Security/tokend/PIV.tokend Your results should be similar to the following: $ codesign -dvvvv /Library/Security/tokend/PIV.tokend/ Executable=/Library/Security/tokend/PIV.tokend/Contents/MacOS/PIV Identifier=org.macosforge.smartcardservices.tokend.piv Format=bundle with Mach-O thin (x86_64) CodeDirectory v=20200 size=1307 flags=0x0(none) hashes=57+3 location=embedded Hash type=sha1 size=20 CDHash=9211409073a5f9034a523b891918cbf8030a6b84 Signature size=4349 Authority=Mac Developer: Shawn Geddis (6NSF8PH78P) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Sep 29, 2015, 9:06:58 PM Info.plist entries=9 TeamIdentifier=L2L8FX9AEK Sealed Resources version=2 rules=12 files=5 Internal requirements count=1 size=92 To ensure you have the original installer posted here and not one that has been modified, please also verify the SHA-256 hash of the .zip you download against the hash posted for the corresponding installer from the installers download page. http://smartcardservices.macosforge.org/trac/wiki/installers/ <https://smartcardservices.macosforge.org/trac/wiki/installers> Recall, we also post installers under a “Current” Static URL as well. SmartCard Services "Current" - Most recent Installer (i.e v2.1.0 for OS X El Capitan v10.11) http://smartcardservices.macosforge.org/files/installers/SCS-Current.zip <https://smartcardservices.macosforge.org/files/installers/SCS-Current.zip> The static URL for the most recent installer versions corresponding to each major release of OS X follows the format: http://smartcardservices.macosforge.org/files/installers/SCS-XX.YY-Current.… XX - 10 YY - Major Release (i.e '09' for OS X Mavericks v10.9) "Current - OS X El Capitan v10.11 <https://smartcardservices.macosforge.org/files/installers/SCS-10.11-Current…>” "Current - OS X Yosemite v10.10 <https://smartcardservices.macosforge.org/files/installers/SCS-10.10-Current…>” "Current - OS X Mavericks v10.9 <https://smartcardservices.macosforge.org/files/installers/SCS-10.09-Current…>” "Current - OS X Mountain Lion v10.8 <https://smartcardservices.macosforge.org/files/installers/SCS-10.08-Current…>” "Current - OS X Lion v10.7 <https://smartcardservices.macosforge.org/files/installers/SCS-10.07-Current…>” "Current - OS X Snow Leopard v10.6" <https://smartcardservices.macosforge.org/files/installers/SCS-10.06-Current…> - Shawn _____________________________________________________________________ Shawn Geddis geddis at {Mac | Me | iCloud} dot com Security and Certifications Engineer, Apple geddis at {apple} dot com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

Should I reboot system after install tokend
by liuddd 07 Sep '15

07 Sep '15

hello! Should I reboot system after install my tokend? In Macosx 10.10, after install my tokend, I found that I have to reboot my system to get it loaded. How to make my tokend take effect without reboot system? Which service should I restart and how ? Thank you !

1 0

Beid SDK 3.5 & 4.0
by Maccampus 28 Aug '15

28 Aug '15

Hello, I just found out that there are SDK kits from the Belgian Government, maybe the changes they did to the Belpic.tokend (2.0-2.0.1) to create the Beid.tokend (2.0-2.0.1) can be found in there & added to the Belpic.tokend 3.0 & up (or the Beid.token 3.0 & up). here are the links to find out more eID Software Development Kit - Developing eID applications - eID <http://eid.belgium.be/en/developing_eid_applications/eid_software_developme…> Fedict · GitHub <https://github.com/Fedict>e <https://groups.google.com/forum/#!forum/eid-middleware-dev> ID Middleware Dev - Google Discussiegroepen <https://groups.google.com/forum/#!forum/eid-middleware-dev> I hope this can help you to help me & all other Belgian Mac users wo had their Belgian ID card replaced During & after May 2015. (I found out that during May 2015 the Beid Card changed their certificates from Rev. 2 to Rev.3 so all cards from then on contain only Rev.3 certificates) Thanks Maccampus

2 1

Re: [Tokend-Dev] Altered Security Tokend for Belpic/Beid
by Maccampus 25 Aug '15

25 Aug '15

I got a Reply From Ludovic Rousseau (is this your real name?) Telling me the Belpic Tokend is under Apple Public Source License Version 2.0. [1] & as long as the Belgian Government Agency respect the licence that is fine. However The Belgian Government doesn’t update the Tokend & The Mac OS Forge does. However the 3th generation of BEid Cards need the version of the Belgian Government because the Apple Tokend doesn’t contain the right encryption/decryption for that Generation of ID Cards. This is where trouble’s start. To be certain troubles start with the Tokend & the 3th Generation ID Card i did the following tests. There are 2 other methods to use the ID Card without the Tokend, -There’s a Java application (which still needs Apple’s Java 6, but if you get the Application.jar out of the application.app bunble it does run on newer Jave, so i run it on Java 8). This Java App can read my 3th generation ID Card & can test the pincode (password). Method 2 is using the Firefow Browser with an add on written by the Belgian Government, this also works fine, i can login & go to my personal dossiers at several government or government linked agency’s (tax, social security, pension, birth,…). Needles to say it also works for 2nd generation, ID Cards. -Then there is the Apple way, with this i mean Software that uses the Apple way of using Smartcards. (The tokend make the keychain from the Card available in Keychain & the Applications use Keychain to use the keys, Applications like Safari, Google chrome). For this test i use Safari & also Google chrome to double check. -First problem: The keychain should be added to keychain as soon as you connect the Smartcard Reader & insert a ID Card. This hardly works (So almost all the time the keychain is not added, seems like the tokens doesn’t see the smartcard reader while if i open the java application ID information gets instantly read). This is with any version of ID Card. You can keep trying & eventually get lucky, but if you connect the reader before boot it works. With that first problem out of the way, i see my 3th Gen ID Card in the Keychain, i open Safari, go to a protected Government website & try to login, This brings me to the BEid Login site & asks me to select the Certificate & then asks for my pincode which i give, it then again asks me for the right certificate, i am stuck in an infinite Loop. I now do the same with a 2nd Gen ID Card, after providing the pincode i go to the protected website with the personal information of a family member who still has a 2nd gen ID Card. As we see, it works if we avoid the tokend, if we use the tokens, it works with Gen 2 but not Gen 3 ID Cards, besides that, the reader needs to be connected before boot. We also know The Belgian Government written tokens is Version 2.0-2.0.1 which is certainly not written For Mac OS X 10.10. The MacOSForge tokens is version 3.0, supports Mac OS X 10.10 but doesn’t have the compatibility with Belgian Beid Cards version 3. The solutions are (imho). - Belgian Government fix their Tokend & during this fix update it to version 3.0. Also they keep it up to date from now on. - The Belgian Government gives the MacOSForge the needed code to make their Tokend BeID Card Version 3 compatible & let them keep the tokend up to date. If a future Generation 4 happens again, they work with the MacOSForge & let them have the new code. Also they supply the latest DMG of smartcardservices with every update of their software or provide a link to the MacOSForge to let the end user get the latest SmartCardServices themselves. > Op 24-aug.-2015, om 20:12 heeft tokend-dev-request(a)lists.macosforge.org het volgende geschreven: > > Date: Mon, 24 Aug 2015 20:07:47 +0200 > From: Maccampus <maccampus(a)gmail.com> > To: tokend-dev(a)lists.macosforge.org > Subject: [Tokend-Dev] Altered Security Tokend for Belpic/Beid > Message-ID: <D2362340-45CA-4B87-865A-F6848C08DEDA(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > > Hello, > > The Belgian Government Agency (Belpic) who is in charge of making software for the Belgian Electronic Identity Card (BEID) has altered the BelPic Tokend from this project. > They never have uploaded their changes to this project though. > > They seem to have taken the Apple Card Services 2.0bx or lower which contains Belpic.tokend 2.2.1 & 2.2. Maybe they took the source files & altered them or they took the Installable files & have hacked them, to add a higher encryption for Version 3 of the Beid Cards. > > They have not informed you of their changes & their changes are not added to the later versions of your versions of the Belpic.tokend. Rather they renamed the Belpic.tokent to Beid.tokend & even with their latest software they make us Belgian Apple using citizens to install an old version of the Belpic.tokend, instead of altering the later versions as one would atlas have expected. > > I want to inform you about these changes in hope that you can add them to the latest versions of the Belpic.tokend & inform them about their inappropriate behavior. Maybe also discuss the future name of the tokens to be Belpic or Beid. > > I have added their versions of the older Tokend which they are currently using, maybe you can extract the changes from those, if not you will need to ask them for the source. > > They are found here Home <http://eid.belgium.be/nl/> & have an online contactsheet for technical questions Contact - Home <http://eid.belgium.be/nl/contact/contactform.jsp>. They also use a 3th party to develop for them which is Zetes & can be found here, Zetes Industries - Supply Chain & Mobility Solutions | Auto-ID & Goods Identification | People ID Solutions - Zetes Europe, Middle-East & Africa <http://nl.zetes.be/>, or here Overzicht - Kaartlezers Belgische identiteitskaart <http://www.belgeid.be/>. Maybe you might find them to be the one?s that (once) altered & delived your software for the Belpic Agency. > > I hope you can make them in cooperation with you deliver the latest version of YOUR Belpic/Beid.tokend containing THEIR changes with their software, preferably by adding your complete software installer to their package or a link to your website rather then only the BELPIC/BEID.tokend. They can inform users to only install the Belpic/Beid Tokend. > > Thanks for making them setting things right. > > > >

2 2

Altered Security Tokend for Belpic/Beid
by Maccampus 24 Aug '15

24 Aug '15

Hello, The Belgian Government Agency (Belpic) who is in charge of making software for the Belgian Electronic Identity Card (BEID) has altered the BelPic Tokend from this project. They never have uploaded their changes to this project though. They seem to have taken the Apple Card Services 2.0bx or lower which contains Belpic.tokend 2.2.1 & 2.2. Maybe they took the source files & altered them or they took the Installable files & have hacked them, to add a higher encryption for Version 3 of the Beid Cards. They have not informed you of their changes & their changes are not added to the later versions of your versions of the Belpic.tokend. Rather they renamed the Belpic.tokent to Beid.tokend & even with their latest software they make us Belgian Apple using citizens to install an old version of the Belpic.tokend, instead of altering the later versions as one would atlas have expected. I want to inform you about these changes in hope that you can add them to the latest versions of the Belpic.tokend & inform them about their inappropriate behavior. Maybe also discuss the future name of the tokens to be Belpic or Beid. I have added their versions of the older Tokend which they are currently using, maybe you can extract the changes from those, if not you will need to ask them for the source. They are found here Home <http://eid.belgium.be/nl/> & have an online contactsheet for technical questions Contact - Home <http://eid.belgium.be/nl/contact/contactform.jsp>. They also use a 3th party to develop for them which is Zetes & can be found here, Zetes Industries - Supply Chain & Mobility Solutions | Auto-ID & Goods Identification | People ID Solutions - Zetes Europe, Middle-East & Africa <http://nl.zetes.be/>, or here Overzicht - Kaartlezers Belgische identiteitskaart <http://www.belgeid.be/>. Maybe you might find them to be the one’s that (once) altered & delived your software for the Belpic Agency. I hope you can make them in cooperation with you deliver the latest version of YOUR Belpic/Beid.tokend containing THEIR changes with their software, preferably by adding your complete software installer to their package or a link to your website rather then only the BELPIC/BEID.tokend. They can inform users to only install the Belpic/Beid Tokend. Thanks for making them setting things right.

2 1

how to monitor smart card reader's hot plug event?
by liuddd 18 Aug '15

18 Aug '15

Hello! I wan't to use PC/SC API to monitor a USB smartcard reader's plug event, but after I plug out the reader and wait for a while, the pcscd will exit, and if I continue to call PCSC functions, some functions will cause segment fault. Can I get a message when a reader is plugged out, or can I configure pcscd so that it won't exit until system restart? Thank you !

2 1

Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 3
by liuddd 14 Aug '15

14 Aug '15

Hello! Thank you! I can insall a pc/sc driver to get my tokend loaded, but only on MacOSX 10.10。 On MacOSX 10.9, it doesn't work, It seems that only CCID device can do it. The question is : Can I create a Keychain when my USB device plugged in, then add certificate and public keypair items, and then bowsers such as Safari will use my Tokend to do cryptograhic operation such as doing SSL handshakes. But I can't find any materials about how Tokend and Keychain is related, and which API can I use to create a keychain for Tokend, and add other items under the new created keychain. Thanks a lot ! At 2015-08-14 03:00:01, tokend-dev-request(a)lists.macosforge.org wrote: >Send Tokend-Dev mailing list submissions to > tokend-dev(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/tokend-dev >or, via email, send a message with subject or body 'help' to > tokend-dev-request(a)lists.macosforge.org > >You can reach the person managing the list at > tokend-dev-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Tokend-Dev digest..." > > >Today's Topics: > > 1. Re: Tokend-Dev Digest, Vol 31, Issue 1 (Ludovic Rousseau) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 13 Aug 2015 13:59:38 +0200 >From: Ludovic Rousseau <ludovic.rousseau(a)gmail.com> >To: "tokend-dev(a)lists.macosforge.org" > <tokend-dev(a)lists.macosforge.org> >Subject: Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 1 >Message-ID: > <CAGstE8ApeajcyawzefV7OEON=WK-whVF1BvFEE82c9ikfdSOmQ(a)mail.gmail.com> >Content-Type: text/plain; charset=UTF-8 > >Hello, > >2015-08-12 9:14 GMT+02:00 liuddd <liudy75(a)163.com>: >> Thanks for the reply. In my situation, I have a reader using only USB >> HID(Human Interface Device) protocol to communicate with MacOS, It is not a >> CCID reader, but I can write a PCSC driver for the reader under Windows and >> then use PCSC API to communicate with it, can I also write a PCSC driver to >> do that under MacOSX? If I can, What should I do to achieve that? >> Is that only CCID reader can initiate the loading of TokenD? I would >> like to know how securityd, pcscd and tokend interact, and what happened >> from when a USB reader plugin into the system to when the corresponding >> Tokend is loaded. > > >Yes, you will have to write a PC/SC driver for Mac OS X. > >The system will detect when you insert your USB device and start the >PC/SC driver and the different tokend. > >Maybe you can write a fake/limited PC/SC driver and use HID directly >(instead of PC/SC) in your tokend. > >Bye > >-- > Dr. Ludovic Rousseau > > >------------------------------ > >_______________________________________________ >Tokend-Dev mailing list >Tokend-Dev(a)lists.macosforge.org >https://lists.macosforge.org/mailman/listinfo/tokend-dev > > >End of Tokend-Dev Digest, Vol 31, Issue 3 >*****************************************

1 0

Re: [Tokend-Dev] Tokend-Dev Digest, Vol 31, Issue 1
by liuddd 13 Aug '15

13 Aug '15

Thanks for the reply. In my situation, I have a reader using only USB HID(Human Interface Device) protocol to communicate with MacOS, It is not a CCID reader, but I can write a PCSC driver for the reader under Windows and then use PCSC API to communicate with it, can I also write a PCSC driver to do that under MacOSX? If I can, What should I do to achieve that? Is that only CCID reader can initiate the loading of TokenD? I would like to know how securityd, pcscd and tokend interact, and what happened from when a USB reader plugin into the system to when the corresponding Tokend is loaded. At 2015-08-11 03:00:01, tokend-dev-request(a)lists.macosforge.org wrote: >Send Tokend-Dev mailing list submissions to > tokend-dev(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/tokend-dev >or, via email, send a message with subject or body 'help' to > tokend-dev-request(a)lists.macosforge.org > >You can reach the person managing the list at > tokend-dev-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Tokend-Dev digest..." > > >Today's Topics: > > 1. Re: Tokend-Dev post from liudy75(a)163.com requires approval > (Shawn A. Geddis) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Sun, 09 Aug 2015 14:32:07 -0700 >From: "Shawn A. Geddis" <geddis(a)apple.com> >To: liuddd <liudy75(a)163.com> >Cc: Tokend-Dev <tokend-dev(a)lists.macosforge.org> >Subject: Re: [Tokend-Dev] Tokend-Dev post from liudy75(a)163.com > requires approval >Message-ID: <1216EAFC-0357-411E-AB3F-2FF2F7995A53(a)apple.com> >Content-Type: text/plain; charset="utf-8" > >> From: liuddd <liudy75(a)163.com> >> Date: August 6, 2015 at 2:34:38 AM PDT >> To: tokend-dev(a)lists.macosforge.org >> Subject: get tokend loaded for USB HID device >> >> Hi ! >> I wan't to get my own tokend get loaded, but my device is a USB HID device. Is there any way to do it? Can I just send some message to securityd to accomplish it? Thanks for some advices. > >You have provided very little information for anyone to be able to help. You will need to provide much more for us to know exactly what you need for direction. > >A Tokend is for communication usually to an Applet on the card and not to the device ? USB devices actually play the role of both reader and token in one. Devices are required to be supported first by a reader driver ? default driver included in OS X is a CCID driver which supports hundreds of readers ? may or may not supports yours - can?t tell since we do not know what reader and token type you are using. > >When you insert a token (ie. provisioned Smart Card into a reader or a USB Composite Token), all of the installed Tokend modules will be launched by the OS with each performing their own probing of the card to determine what it is (ie. BELPIC, CAC, CACNG, JPKI, PIV, etc?) and determining whether it knows and can communicate with that card type. Scoring takes place and the Tokend with the highest score remains live and associated with that card for this session. You can execute the command ?top? in Terminal prior to inserting your token. If you do not see the tokend names I listed above appear or remain after probing (or one that may correspond to a tokend you installed) then there is no currently supported tokend for the token you have inserted. > >If you can provide more, we can give more/better guidance. > >- Shawn >_____________________________________________________________________ >Shawn Geddis geddis@{Mac | Me | iCloud}.com >Security and Certifications Engineer, Apple geddis(a)apple.com > >Smart Card Services Project/Dev Lead: > Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] > Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] > SCS Contact: [scs-contact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] > SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] >_____________________________________________________________________ >

2 1

Re: [Tokend-Dev] Tokend-Dev post from liudy75@163.com requires approval
by Shawn A. Geddis 09 Aug '15

09 Aug '15

> From: liuddd <liudy75(a)163.com> > Date: August 6, 2015 at 2:34:38 AM PDT > To: tokend-dev(a)lists.macosforge.org > Subject: get tokend loaded for USB HID device > > Hi ! > I wan't to get my own tokend get loaded, but my device is a USB HID device. Is there any way to do it? Can I just send some message to securityd to accomplish it? Thanks for some advices. You have provided very little information for anyone to be able to help. You will need to provide much more for us to know exactly what you need for direction. A Tokend is for communication usually to an Applet on the card and not to the device — USB devices actually play the role of both reader and token in one. Devices are required to be supported first by a reader driver — default driver included in OS X is a CCID driver which supports hundreds of readers — may or may not supports yours - can’t tell since we do not know what reader and token type you are using. When you insert a token (ie. provisioned Smart Card into a reader or a USB Composite Token), all of the installed Tokend modules will be launched by the OS with each performing their own probing of the card to determine what it is (ie. BELPIC, CAC, CACNG, JPKI, PIV, etc…) and determining whether it knows and can communicate with that card type. Scoring takes place and the Tokend with the highest score remains live and associated with that card for this session. You can execute the command ‘top’ in Terminal prior to inserting your token. If you do not see the tokend names I listed above appear or remain after probing (or one that may correspond to a tokend you installed) then there is no currently supported tokend for the token you have inserted. If you can provide more, we can give more/better guidance. - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-contact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0