- Tokend-Dev - lists.macosforge.org

SmartCardServices Installers for OS X v10.6-v10.9 Posted!
by Shawn Geddis 14 Jan '14

14 Jan '14

SmartCardServices Installers v2.0 for OS X v10.6 - v10.9 have been postedSmart Cards Supported • BELPIC • CAC • CACNG* (Gemalto TOPDLGX4 144 & G&D FIPS 201 SCE 3.2 - ONLY at this time) • JPKI* (NEW - First time release) • PIV Installers: http://smartcardservices.macosforge.org/trac/wiki/installers - Shawn _____________________________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo] SCS Contact: [scs-cotact(a)macosforge.org] SCS Admin: [scs-admin(a)macosforge.org] _____________________________________________________________________

1 0

TokenD libs and installers for Mavericks
by Mike Matyas 31 Dec '13

31 Dec '13

Has anyone seen TokenD support files for OS/X 10.9 yet? Michael Matyas Mount Airey Group, Inc. Arlington, VA 22201 703-919-0684 (o) mmatyas(a)mountaireygroup.com

2 1

Tokend on OS X Mavericks
by Ross, Adam 10 Nov '13

10 Nov '13

Tokend on OS X Mavericks With the commercial release of Mavericks a few weeks ago, we are interested in extending support of the Smart Card Services to the new version. Currently, there are two updates for Smart Card Services Updates posted for Lion and Mountain Lion. http://smartcardservices.macosforge.org/trac/wiki/installers Are there any similar Tokend module installers for Mavericks? Many thanks, Adam Ross Adam.ross(a)cryptovision.com

3 2

Re: [Tokend-Dev] [Fed-Talk] EAP-TLS Authentication with CAC on iPad or iPhone
by Shawn Geddis 30 Jan '13

30 Jan '13

Henry, I do agree this belongs on a developer list and have included the SmartCardServices-Users and Tokend-Dev lists here. I will quickly try to address your items and this can continue on the other lists (other than Fed-Talk). On Jan 30, 2013, at 1:42 PM, "Henry B. Hotz" <hotz(a)jpl.nasa.gov> wrote: > On Jan 24, 2013, at 8:51 AM, Shawn Geddis <geddis(a)apple.com> wrote: >> OSX's Smart Card Services are backed by CDSA, which everyone should know was deprecated with the release of OS X Lion v10.7. On OS X, all of the architectural components are still there except the Tokend modules installer needs to be downloaded from our SmartCardServices Project @ MacOSForge.org as well as the need to add the authentication mechanism line back into /etc/authorization. Commercial products are also available to augment or replace what continues to be available from MacOSForge.org. > > Maybe this question belongs on a development list, but I'm not clear about what this means. From an architectural/development point of view, how much of the infrastructure has gone away? As of OS X 10.8.2, even though CDSA & Tokend were Deprecated, Nothing has "gone away". After installing the Tokend modules from MacOSForge.org and modifying your /etc/authorization file accordingly, you have everything that was there before. Architecturally, everything is there! Developers providing Tokend support can still rely on the architecture as it still exits today. Other commercial developers have chosen to augment their products with components that replace what is built-in to OS X (ie. Tokend modules). > Without tokend's, are keychains still supported? "Keychains" are an abstraction of a Key Store. Smart Cards are still available as keychains because of the Tokend abstraction. If you take the Tokend out of the equation or do not have a Tokend installed corresponding to your desired Smart Card then No, the smart card would not appear as a keychain -- that has been the case since day 1. > (Do smart cards still look like funny-named keychains?) Funny Named ? The name depends on the Smart Card in use and what logic the Tokend developer chooses to use for Keychain naming. From Apple, we provided a name that began with the card type (ie. "CAC-", "CACNG-", "PIV-", "BELPIC-") and then the unique card identification. > Can you still daisy-chain keychain entries so one keychain entry can say to use another keychain for some specific thing? You are referring to the use of the CLI command "systemkeychain" Usage: systemkeychain -C [passphrase] # (re)create system root keychain systemkeychain [-k destination-keychain] -s source-keychain ... systemkeychain -T token-protected-keychain-name man page... SYSTEMKEYCHAIN(8) BSD System Manager's Manual SYSTEMKEYCHAIN(8) NAME systemkeychain -- creates system keychains and allows keychains to unlock keychains SYNOPSIS systemkeychain [-fv] [-k filename] [-C] [password] systemkeychain [-fvc] [-k filename] [-s] [file ...] systemkeychain [-v] [-k filename] [-t] DESCRIPTION The systemkeychain can be used to create a system keychain, make it pos- sible for a keychain to unlock another keychain, or test unlocking a key- chain. .... > There were thousands of pages of documentation for CDSA. While I was never up for reading them, it looked like it should be possible to associate Apple functionality with CDSA if you looked. The Apple doc's always seemed disjoint, and sparse on details. Without CDSA I'm left feeling like I can't find enough information to actually understand Apple's functionality. If you are only know trying to understand Apple's implementation of CDSA (which by the way is a specification managed by the OpenGroup), I would say it is too late. it was deprecated in OS X Lion and there is no guarantee it will exist in a future version of OS X. OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. > Of course, maybe the real answer will depend on what happens in the validation process. *sigh* Validation of what ? >>> Given ubiquitous PKI support, the card should, IMO, be just an OS device driver issue, not an application issue. >> >> I would agree that it would be very nice to rely on integrated services for use of various hardware tokens. I will strongly disagree that it is simply a device driver issue -- tight integration like smart cards have on OS X does not come through the OS vendor simply dropping in a device driver - it is much more than that. > > Yeah, "device driver" is oversimplified. I meant the whole PIV/CCID/USB/(pcscd/tokend?)/keychain(or pkcs11) support stack. Given the OS has a ubiquitous API for interfacing with PKI credentials, the card should be supported by that API and not require every single application to write special card support code. CCID, USB, PCSCD, Tokend... are all part of the "Smart Card Services"... As noted above...OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. - Shawn ________________________________________ Shawn Geddis Security Consulting Engineer Apple Enterprise Division

1 0

10.8 cac
by Jay Johnston 04 May '12

04 May '12

Hello i have been working on getting the CAC to work on 10.8 for a few releases of the dev preview sense it broke in dp2 i posted it on the mac dev forms but i wanted to know if anyone hear has fixed the issue so i not recreating the wheel V/R Johnston Jay

2 1

ECDSA Support in Tokend
by John Billings 09 Feb '12

09 Feb '12

Hello, Can anyone tell me if the Tokend interface really supports the use of Elliptic Curve certificates? I noticed that some of the *_csp_capabilities_common.mds files include ECDSA in the list, but it's unclear if it's really supported anywhere. Also, I am seeing the build failure described in Ticket #113 when building Tokend. Does the latest version still only work on old versions of Xcode and OS X? Thanks!

1 0

PKCS#11 Tokend module?
by Cristian Thiago Moecke 14 Dec '11

14 Dec '11

Hello all! My name is Cristian, and I'm a Brazilian graduate student, researching PKI themes. I've just bought me a Macbook Pro, and I was looking for a way to make my epass2k token work on Mac OS X 10.6 (Snow Leopard). But "PRONOVA" don't provide a tokend module. They provide a PKCS#11 module only for Mac. So I can use firefox and thunderbird, but not safari, chrome, java, mail and everithing else I would like to use with it. I must say I've got a bit disappointed on the lack of support for PKCS#11 on Mac OS X Keychain. I've read that Apple don't want it because of the need to point to dynlibs... I can understand, but I would be happy even if the option was available by editing some config file or running terminal commands. But ok, stop complaining, I'm on mac for 3 weeks now and this is my first and only complaint until now, that is good. Since I'm a programmer, since I've come from the Linux world and since I've got some friends here that also are programmers, also use mac, also would like to use PKCS#11 modules on theis Mac Keychain, and also would enjoy giving a solution for this, I'm interested on try to develop a Tokend module that works as an interface to user provided PKCS#11 dynlibs. I would like to know: - if you have heard about someone already trying/doing this (I've found this slides: http://middleware.internet2.edu/pki06/proceedings/dinapoli-pkcs11-mac.pdf, from 2006... I'm trying to contact the author. But found nothing else). - if there is already a documentation to people like me, that want to develop his first Tokend module. On the website I've found only user documentation, not developer documentation. Regards, -- Cristian Thiago Moecke contato(a)cristiantm.com.br

5 6

TokenD and Adobe Reader 9.4 signing problem
by Giuseppe Amato 17 Nov '11

17 Nov '11

Hello, I'm experiencing a problem using our TokenD with Adobe Reader 9 (actually 9.4.6) on OSX version 10.5. Note that with OSX 10.6 and 10.7 versions the problem doesn't exists. In Adobe Reader I can see all certificates exposed by the TokenD, from the smartcard, and I can also choose the default certificate in the preferences pane. But when I try to make a signature and the certificate selection dialog box appears, when I push on the "Sign" button nothing happens: I can just cancel the signature. If the certificate chosen from the list is not from TokenD but is one imported from PKCS#12 file in login keychain, the signature just works fine. The strange thing is that this happens just on OSX 10.5. I'm sure that the TokenD works well since I can use it with Safari and Mail. And also with a Digital Signature application. I don't know if is Adobe Reader that have problems with TokenD on OSX 10.5 or if is fault of our TokenD implementation. Some one is experiencing the same problem? Regards, Giuseppe Amato

1 0

Updating Tokend building and installing documentation
by Jeff Bair 01 Jul '11

01 Jul '11

Hi, So I've recently been trying to figure out how to build Tokend with all of modules including CAC-NG. Since the darwinbuild command downloads the Tokend source code that is slightly out of date, I pulled the new source code from http://opensource.apple.com/tarballs/Tokend/ and was able to build the latest version. I'd like to submit my own documentation on the process for building and installing the project for the benefit of other possible users of the project. How would I go about that and is that okay with the developers? Thanks, Jeff

2 3

Regarding CAC-NG build/install
by Jeff Bair 21 Jun '11

21 Jun '11

Hi, I was able to build and install CAC, BELPIC, and PIV tokend by following the instructions here: http://smartcardservices.macosforge.org/trac/wiki/documentation/building However, I was wondering whether I could build and install CAC-NG tokend on my own since the source code is listed here: http://smartcardservices.macosforge.org/trac/browser/branches/tokend/10.6/C… instead of using the installer listed here: http://smartcardservices.macosforge.org/trac/wiki/installers Any help would be greatly appreciated! - Jeff

2 2