- Tokend-Dev - lists.macosforge.org

TokenD issue on MacOS X 10.6
by Giuseppe Amato 05 Nov '09

05 Nov '09

Hello, since the tokend binary I'm using on 10.5 doesn't works anymore on 10.6, also on 32 bit hardware, I'm trying to rebuild tokend. I've a problem similar to that reported here [1]. The smart card keychain and all objects can be seen in KeyChain Access application, but when I try to make a signature an error is returned. actually the most detailed error I got is: CSSM_SignData returned: 8001082E Error: 0x8001082E -2147416018 CSSMERR_CSP_INVALID_ACL_ENTRY_TAG The system never asks me the PIN. To make it simpler I've modified the BELPIC tokend to became a completely software tokend, that is accepts any card the use keys and certificate located in files. The behavior is the SAME sa my tokend. So I think that is just a build problem... I'm using currnet darwinbuld from trunk, xcode 3.2 and I'm initializing darwinbuld on the build id 10B504 Anyone was successfully in building ad using a tokend on 10.6? Can you help me? links: [1] http://lists.macosforge.org/pipermail/tokend-dev/2009-September/000015.html

1 0

Keychain Access does not dynamically update the keychain list on Snow Leopard Mac OS X 10.6.1 (10B504)
by Ludovic Rousseau 23 Oct '09

23 Oct '09

Hello smart card users, I just reported problem ID 7329889 (copy bellow) I would like to know if it is a known problem or only in my configuration. Bye 23-Oct-2009 10:36 AM Ludovic Rousseau: Summary: When a smart card is inserted and a tokend is executed the new keychain does not appear in the Keychain Access application. I have to quit and restart Keychain Access to have my new keychain displayed. Steps to Reproduce: 1. start Keychain Access 2. insert a supported smart card 3. wait, wait, wait. no new keychain displayed in the application 4. quit Keychain Access 5. start Keychain Access 6. a new keychain corresponding to the smart card is displayed Expected Results: 1. start Keychain Access 2. insert a supported smart card 3. a new keychain corresponding to the smart card is displayed Actual Results: The new keychain is displayed only after the Keychain Access application is restarted. The same problem is also present when removing the smart card. The keychain corresponding to the smart card is still displayed after the card removal. The list is only updated after restarting Keychain Access. Regression: Yes. This problem was not present in Leopard. It is new in Snow Leopard. -- Dr. Ludovic Rousseau

1 0

error: dlfcn.h: No such file or directory
by Ludovic Rousseau 21 Oct '09

21 Oct '09

Hello, I am trying to add a tokend to the existing tokend from Apple. The goal is to upload it on macosforge.org. My tokend uses dlopen() and so #includes dlfcn.h. My problem is that this header is not found: /Volumes/BuildRoot_10B504_20091012115357/SourceCache/Tokend/Tokend-36720/PKCS11/FooToken.cpp:15:19: error: dlfcn.h: No such file or directory I guess I need to add a dependency on dyld by creating an Info.plits like the one for SmartcardCCID [1]. Is that correct? Where should I put the Info.plist file and what to put inside? Thanks [1] http://svn.macosforge.org/repository/smartcardservices/trunk/SmartcardCCID/… -- Dr. Ludovic Rousseau

2 1

Getting OpenSC.tokend to work on Snow Leopard
by João Poupino 16 Sep '09

16 Sep '09

Hi All, I'm trying to build a working OpenSC tokend [1] on Snow Leopard, but unfortunately I'm facing some issues and can't really understand what could be the cause. I've successfully built OpenSC.tokend on Snow Leopard through two different methods: using darwinbuild and through a modified Xcode project [2] provided by Martin Paljak. In both methods the result the same: a tokend that (almost) works. The generated tokend binary supports both the i386 and x86_64 architectures. When I insert the smart card, the tokend is correctly started, all keys and certificates are shown in keychain access, and all seems to be working fine. But, when I try to login locally (loginwindow) or with Safari to a site, it simply fails. It doesn't crash, but it doesn't appear to be doing anything at all. All exchanged APDUs are ok, which leads me to believe that the problem might not be with libopensc (that the tokend uses to communicate with the card) but in the tokend code itself… The OpenSC.tokend code being used it at [3]. Some notes: Trying to unlock the keychain associated with the tokend works. If I try to login locally with a smart card, the following message can be seen in /var/log/secure.log: authorizationhost[2237]: failed to sign data (-2147416018) OpenSC's command line tools (pkcs11-tool, pkcs15-tool, etc.) and the PKCS #11 module (opensc-pkcs11.so) work fine. Could anyone explain how does one properly debugs a tokend? I'm not referring to lower level debugging methods like capturing APDUs and such - I'm ok with that. I've tried putting some debug statements in the tokend code but all seems "ok". Is there any way to follow the execution flow of the Tokend and maybe even securityd? I think that without having the big picture of the architecture (what components exist, what is their relationship, how do they interact, what do they expect, …) it will be pretty difficult to find the problem. If anyone can help, I would be really grateful! Thank you. João [1] - http://www.opensc-project.org/sca/wiki/OpenscTokend [2] - http://wiki.github.com/martinpaljak/opensc.tokend [3] - http://www.opensc-project.org/sca/browser/trunk/opensc.tokend/OpenSC

1 0

Building tokend
by Amira Solomovici 24 Aug '09

24 Aug '09

Hello Can anyone send me instructions how to compile and build a tokend? In particularly, which Mac OS + Xcode versions should be used? Thanks, Amira.

1 0

Tokend development
by André Cruz 27 May '09

27 May '09

Hello. I'm interested in developing a Tokend driver for the portuguese citizen card (http://www.cartaodecidadao.pt/) which is a smartcard. The reader I'm using is supported on osx so I think I just need a tokend: $ pcsctest MUSCLE PC/SC Lite Test Program Testing SCardEstablishContext : Command successful. Testing SCardGetStatusChange Please insert a working reader : Command successful. Testing SCardListReaders : Command successful. Reader 01: Gemplus GemPC Twin 00 00 Enter the reader number : 1 Waiting for card insertion : Command successful. Testing SCardConnect : Command successful. Testing SCardStatus : Command successful. Current Reader Name : Gemplus GemPC Twin 00 00 Current Reader State : 0x34 Current Reader Protocol : 0x0 Current Reader ATR Size : 10 (0xa) Current Reader ATR Value : 3B 95 95 40 FF D0 00 54 01 31 Testing SCardDisconnect : Command successful. Testing SCardReleaseContext : Command successful. Testing SCardEstablishContext : Command successful. Testing SCardGetStatusChange Please insert a working reader : Command successful. Testing SCardListReaders : Command successful. Reader 01: Gemplus GemPC Twin 00 00 Enter the reader number : What I would like to know is where to start... It seems the documentation is not done yet. What are the best resources to use so as to learn what to do? Thanks, André Cruz

3 3

Re: [Tokend-Dev] Tokend-Dev Digest, Vol 2, Issue 1
by Paul Kwan 25 May '09

25 May '09

Hi Andre, I suggest you to start with the Home page of SmartCard Services Web site: http://smartcardservices.macosforge.org/ There are doc and sample codes for SmartCard drivers there. Good luck. > From: <tokend-dev-request(a)lists.macosforge.org> > Reply-To: <tokend-dev(a)lists.macosforge.org> > Date: Sun, 24 May 2009 07:06:52 -0700 > To: <tokend-dev(a)lists.macosforge.org> > Subject: Tokend-Dev Digest, Vol 2, Issue 1 > > Send Tokend-Dev mailing list submissions to > tokend-dev(a)lists.macosforge.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.macosforge.org/mailman/listinfo.cgi/tokend-dev > or, via email, send a message with subject or body 'help' to > tokend-dev-request(a)lists.macosforge.org > > You can reach the person managing the list at > tokend-dev-owner(a)lists.macosforge.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Tokend-Dev digest..." > > > Today's Topics: > > 1. Tokend development (Andr? Cruz) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 22 May 2009 19:36:08 +0100 > From: Andr? Cruz <andre.cruz(a)co.sapo.pt> > To: tokend-dev(a)lists.macosforge.org > Subject: [Tokend-Dev] Tokend development > Message-ID: <44CB89F3-23A4-4812-A586-01553E982B5E(a)co.sapo.pt> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes > > Hello. > > I'm interested in developing a Tokend driver for the portuguese > citizen card (http://www.cartaodecidadao.pt/) which is a smartcard. > The reader I'm using is supported on osx so I think I just need a > tokend: > > $ pcsctest > > MUSCLE PC/SC Lite Test Program > > Testing SCardEstablishContext : Command successful. > Testing SCardGetStatusChange > Please insert a working reader : Command successful. > Testing SCardListReaders : Command successful. > Reader 01: Gemplus GemPC Twin 00 00 > Enter the reader number : 1 > Waiting for card insertion > : Command successful. > Testing SCardConnect : Command successful. > Testing SCardStatus : Command successful. > Current Reader Name : Gemplus GemPC Twin 00 00 > Current Reader State : 0x34 > Current Reader Protocol : 0x0 > Current Reader ATR Size : 10 (0xa) > Current Reader ATR Value : 3B 95 95 40 FF D0 00 54 01 31 > Testing SCardDisconnect : Command successful. > Testing SCardReleaseContext : Command successful. > Testing SCardEstablishContext : Command successful. > Testing SCardGetStatusChange > Please insert a working reader : Command successful. > Testing SCardListReaders : Command successful. > Reader 01: Gemplus GemPC Twin 00 00 > Enter the reader number : > > > What I would like to know is where to start... It seems the > documentation is not done yet. What are the best resources to use so > as to learn what to do? > > Thanks, > Andr? Cruz > > > > ------------------------------ > > _______________________________________________ > Tokend-Dev mailing list > Tokend-Dev(a)lists.macosforge.org > http://lists.macosforge.org/mailman/listinfo.cgi/tokend-dev > > > End of Tokend-Dev Digest, Vol 2, Issue 1 > ****************************************

1 0

Re: [Tokend-Dev] Building Tokend on Leopard?
by Henry B. Hotz 23 Mar '09

23 Mar '09

On Mar 16, 2009, at 5:29 PM, Shawn A. Geddis wrote: > On Mar 16, 2009, at 8:23 PM, Henry B. Hotz wrote: >> That sounds like standard policy, which is fine. >> >> Am I wrong to believe that the posted source for this project is >> newer and more Snow-Leopard-like than the 9G55 version of Tokend? >> If it is, then I'm still interested. > > > The Source for ALL of the sub-components of this project > "SmartCardServices" are all exact copies of the source which was > compiled and shipped in Mac OS X 10.5.6. We will make note of this > on the wiki pages as we move forward with this project. So this project's Tokend is identical to Tokend-35209? > The issue you seem to be trying to resolve is related to the > 1024/2048 key size issue with the shipped PIV tokend. I am getting > that source and binary out here as soon as I can and will post a > note then as well. Well, I'm told that's the problem. I can't say I know that's the issue independently. I just know that the 10.5.6 Tokend can't identify the user for loginwindow. OpenSC Tokend and ActiveIdentity Tokend can do that, but they can't unlock the card with a PIN. If I got past this hump, I'd ask about Apple's support for MIT Kerberos' pre-auth plugin interface and PKINIT, but that would be severely off-topic. ;-) ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz(a)jpl.nasa.gov, or hbhotz(a)oxy.edu

3 4

Re: [Tokend-Dev] Building Tokend on Leopard?
by Henry B. Hotz 17 Mar '09

17 Mar '09

On Mar 16, 2009, at 3:47 PM, Shawn A. Geddis wrote: > On Mar 16, 2009, at 1:57 PM, Henry B. Hotz wrote: >> Can anyone tell me how to build the latest Tokend on Leopard? >> >> It has dependencies on three frameworks that aren't on the system >> or in the Leopard SDK. >> >> When I try darwinbuild I get the following: >> >> laphotz:smartcards hotz$ sudo darwinbuild -init 9G55 >> Downloading http://svn.macosforge.org/repository/darwinbuild/trunk/plists//9G55.plist >> ... >> [...working...] >> Download complete >> Initialization Complete >> laphotz:smartcards hotz$ sudo darwinbuild Tokend >> *** Fetching Sources ... >> [...working...] >> libsecurity_cdsa_utilities - 52 files registered. >> Downloading http://src.macosforge.org/Roots/9G55//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9F33//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9E17//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9D34//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9C31//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9B18//libsecurity_cssm.root.tar.gz >> ... >> Downloading http://src.macosforge.org/Roots/9A581//libsecurity_cssm.root.tar.gz >> ... >> ERROR: could not find root: libsecurity_cssm >> laphotz:smartcards hotz$ > > > Henry, > > Right now the source posted here would still require the Darwin > Build pieces, but you still hit a wall since there are a couple that > still need to be posted. They will be posted, but the folks > responsible for this are a bit behind and I am working with them to > get this up-to-date for this project. > > Note: This will be for Leopard only. SnowLeopard source that is > not already part of these projects or avail via Darwin Open Source > will not be posted until SnowLeopard ships. > > - Shawn > ________________________________________ > Shawn Geddis T (703) 264-5103 > Security Consulting Engineer C (703) 623-9329 > Apple Enterprise Division geddis(a)apple.com That sounds like standard policy, which is fine. Am I wrong to believe that the posted source for this project is newer and more Snow-Leopard-like than the 9G55 version of Tokend? If it is, then I'm still interested. ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz(a)jpl.nasa.gov, or hbhotz(a)oxy.edu

2 1

Building Tokend on Leopard?
by Henry B. Hotz 16 Mar '09

16 Mar '09

Can anyone tell me how to build the latest Tokend on Leopard? It has dependencies on three frameworks that aren't on the system or in the Leopard SDK. When I try darwinbuild I get the following: laphotz:smartcards hotz$ sudo darwinbuild -init 9G55 Downloading http://svn.macosforge.org/repository/darwinbuild/trunk/plists//9G55.plist ... [...working...] Download complete Initialization Complete laphotz:smartcards hotz$ sudo darwinbuild Tokend *** Fetching Sources ... [...working...] libsecurity_cdsa_utilities - 52 files registered. Downloading http://src.macosforge.org/Roots/9G55//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9F33//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9E17//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9D34//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9C31//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9B18//libsecurity_cssm.root.tar.gz ... Downloading http://src.macosforge.org/Roots/9A581//libsecurity_cssm.root.tar.gz ... ERROR: could not find root: libsecurity_cssm laphotz:smartcards hotz$ ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz(a)jpl.nasa.gov, or hbhotz(a)oxy.edu

2 1