- Tokend-Dev - lists.macosforge.org

Re: [Tokend-Dev] Tokend Installer on MAC OS 10.11
by Finch, Ben 29 Jun '15

29 Jun '15

An alternate path to install the tokend driver in /Library/Security/tokend. I don’t believe that directory is created, so you’ll need to go to /Library/Security/ and create the /tokend directory. But that takes care of the rootless protection. I created the directory and my smart card is being read properly by the system and Keychain Access. I was then able to successfully configure Outlook 2011 with the certs on my smart card and send signed and encrypted emails. As for getting the PIN caching to prompt correctly, why not disable PIN caching altogether? For security purposes, it would be more effective to enter your PIN each time. I know myself and many others wouldn’t mind that if that means it is working properly and managing the certs and smart card accordingly. Thanks, Ben

1 0

Tokend Installer on MAC OS 10.11
by Francois-Eric Guyomarch 29 Jun '15

29 Jun '15

Hi, The tokend must be installed in a specific system directory(/System/Library/Security/tokend?). With MAC OS 10.11 the introduction of rootless protection prevents from installing our tokend on this system specific directory unless the MAC OS is 'jailbroken' by disabling the rootless protection. Once the protection is disabled the tokend works as normal. What is the supported procedure to install a tokend on MAC OS 10.11 without disabling rootless protection, is that supported ? Francois-Eric Guyomarc'h Senior Product Architect, CISSP Office : + 33 4 67 44 20 55 Mobile : + 33 6 62 08 02 48 fguyomarch(a)hidglobal.com <mailto:xxxxx@actividentity.com> <http://www.hidglobal.com/> 24 ave du General de Gaulle, 92150 Suresnes, France www.hidglobal.com <http://www.hidglobal.com/> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you received this email message in error, please notify the sender by reply email and delete the message and any attachments.

2 1

Displaying a GUI from tokend
by Francois-Eric Guyomarch 29 Jun '15

29 Jun '15

Our tokend supports a PIN caching mechanism. On PIN caching expiry the user must be re-prompted for his/her PIN. We are currently unable to display a GUI from the tokend. This results in freeze or crash. We have tried several different approaches including: On PIN caching expiry trying to force the tokend to reload the ACL so we can change the ACL on the PIN object to PwdPromptSubject so as to trigger a prompt by the caller. This fails as it looks like there is no way to change the ACLs on the PIN during the tokend lifecycle. Invoking a different component (that would prompt for the GUI) from the tokend . The IPC mechanism using standard MACOS XPC. We have tried the following components: XPC service Launch Agent Daemon. In all cases the tokend either fails to connect to the external component and/ or the external component can't display a GUI either. Our analysis is that the security context of the tokend prevents any possible architecture that would allow to prompt for a GUI. We'd like to confirm that statement. Thanks

1 0

Tokend on MAC OS 10.11
by Francois-Eric Guyomarch 01 Jun '15

01 Jun '15

Can anyone tell whether tokend will continue to be supported in MAC OS 10.11, any plan for replacement ? Thanks Francois-Eric Guyomarc'h Senior Product Architect, CISSP Office : + 33 4 67 44 20 55 Mobile : + 33 6 62 08 02 48 fguyomarch(a)hidglobal.com <mailto:xxxxx@actividentity.com> <http://www.hidglobal.com/> 24 ave du General de Gaulle, 92150 Suresnes, France www.hidglobal.com <http://www.hidglobal.com/> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you received this email message in error, please notify the sender by reply email and delete the message and any attachments.

1 0

SmartCardServices Installer Posted for OS X Yosemite v10.10
by Shawn A. Geddis 31 Oct '14

31 Oct '14

SmartCard Services Community, Installer posted for OS X Yosemite v10.10. This SmartCardServices Installer provides the Tokend modules and cacloginconfig.plist for installation on your OS X Yosemite systems. Note that the installer and Tokend modules are not digitally signed again yet, but will be in the future. To ensure you have the original installer posted here and not one that has been modified, please verify the SHA-1 hash of the .zip you download against the hash posted for the corresponding installer from the installers download page: http://smartcardservices.macosforge.org/trac/wiki/installers/ <http://smartcardservices.macosforge.org/trac/wiki/installers/> - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

messagebox in tokend
by Vernelen Frederik (consultant) 10 Apr '14

10 Apr '14

Hello, We at fedict are looking at expanding the BELPIC.tokend with PPDU over transmit functionality. (for secure pinpad readers that support it) The PIN would then be entered on the cardreader, so the PIN protection on the keychain is no longer needed. We would however like to display a message to the user, stating he has to enter his PIN on his cardreader, but we are having difficulties creating those messages from within tokend. Does anyone know if it possible to create a dialog pop up from within a tokend? Wkr, Frederik

1 0

Certificates from token through Tokend in built-in VPN client on Mavericks
by Мироненко Евгений 17 Mar '14

17 Mar '14

Hello! I'm using Gemalto Tokend to access the certificates on the token. On Mac OS X 10.8 the certificates on the token are accessible via Keychain Access, Mail utilities and built-in VPN client, but after updating to 10.9 I've got an issue that certificates on the token are not listed in built-in VPN client (when selecting authentication parameters) though they are visible in Keychain Access utility. Is it a problem with Tokend used or Apple has just cut out tokend support from VPN client? Is there any workaround for the issue? Best regards, Eugene Mironenko

3 7

[MacOSForge.org] Servers will be down for scheduled maintenance - TUE 11 MAR 2014 8AM-12PM PST
by Shawn Geddis 10 Mar '14

10 Mar '14

SmartCardServices & SCAP-On-Apple Participants, Scheduled maintenance on ALL Mac OS Forge Servers will be taking place on TUE 11 MAR 2014 8AM-12PM PST. It is scheduled to start at 8AM PST and the activity is expected to take about four hours or more resulting in shutdown until at least 12PM PST. All affected servers will be going through a change in IP address. DNS changes to the domain will be made and its propagation to the Public domains will take approximately 30 Mins to an hour. When maintenance begins, all MacOSForge systems are expected to stop functioning. We very much appreciate your participation and hope the scheduled downtime does not negatively impact your efforts. If you have any questions, comments or otherwise, please drop a line to the projects Admin account: SmartCardServices Admin scs-admin(a)macosforge.org SCAP Admin scap-admin(a)macosforge.org - Shawn _______________________________________________________________________ Shawn Geddis Enterprise Security Consulting Engineer, Apple (geddis(a)apple.com) SCAP-On-Apple Project/Dev Lead: (SCAP-On-Apple.MacOSForge.Org) SmartCardServices Project/Dev Lead: (SmartCardServices.MacOSForge.Org) _______________________________________________________________________

1 0

Re-compiling your Tokend Source for security fix [SCSSU-201401] to address CVE-2013-1867
by Shawn A. Geddis 16 Jan '14

16 Jan '14

Tokend-Dev Community, I wanted to highlight that the security fix [SCSSU-201401] for addressing CVE-2013-1867 was included in the recent release of installers I posted. However, each one of you that has developed your own Tokend for OS X, will want to ensure you pickup the change. The fix was noted in Ticket #109 And the source code diffs are at Changeset #158 if any of you have any questions, fire away here on the list. - Shawn _____________________________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo] SCS Contact: [scs-cotact(a)macosforge.org] SCS Admin: [scs-admin(a)macosforge.org] _____________________________________________________________________

1 0

tokend without a PCSC device
by Woloszyn, Stephan 16 Jan '14

16 Jan '14

Hello, My main question is: can a tokend be loaded into memory without a PCSC device? For reference I found a similar discussion list at http://lists.apple.com/archives/apple-cdsa/2009/Jul/msg00038.html. It mentions a Soft Token concept that sounds promising. So, is there an existing Soft Token solution that I can re-use? Or, is Soft Token just a concept that needs custom development (if so how can it be done)? Thanks, Steve The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

2 1