<div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Thu, Oct 1, 2015 at 3:25 PM Shawn Geddis <<a href="mailto:geddis@icloud.com" target="_blank">geddis@icloud.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>On Oct 1, 2015, at 11:44 AM, Thomas Harning Jr. <<a href="mailto:harningt@gmail.com" target="_blank">harningt@gmail.com</a>> wrote:</div><blockquote type="cite"><br><div><div style="font-family:ArialMT">Thanks. Is there any documentation available that shows where the new tokend installations should go?<br><br></div><span style="font-family:ArialMT;float:none;display:inline!important">Does this installation location happen to work for older OSX versions, or is the location only scanned by OSX 10.11? If this location is only for newer versions of OSX, this complicates things for users that install an application on 10.10 or earlier and come to OSX 10.11 to discover their TokenD was obliterated.</span><br style="font-family:ArialMT"><br style="font-family:ArialMT"><span style="font-family:ArialMT;float:none;display:inline!important">Smart card development for OSX seems to be a particularly dark art. By chance are there any samples of TokenD modules written using Apple's new blessed token API - the asynchronous nature of the new API seems to be in conflict with TokenD API specifications.</span><br style="font-family:ArialMT"></div></blockquote><div><div style="font-family:ArialMT"><br></div></div></div><div style="word-wrap:break-word"><div style="font-family:ArialMT">Thomas,</div><div style="font-family:ArialMT"><br></div><div style="font-family:ArialMT">• The Installer Download Page, the Installer and the man page for SmartCardServices notes the new tokend installation path for OS X El Capitan v10.11.</div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:ArialMT">• The Path [/Library/Security/tokend/ ] is new for OS X El Capitan v10.11 and higher and is not supported on older versions of OS X v10.x.</div><div style="font-family:ArialMT">• Location of Tokend bundles does not affect use by Applications, since this is completely abstracted away.</div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:ArialMT">• There currently is no code samples or reference implementations for CryptoTokenKit Clients from Apple nor yet from the project here.</div><div style="font-family:ArialMT">• TokenD API specifications ? There never was any API specification to Apple’s knowledge. What reference are you making ?</div></div></blockquote><div>The specification that each of the TokenD modules implement. I referenced an API that exists but does not appear to be documented (at least publicly).<br><br></div><div>I brought these up as I am on a team maintaining a product with a TokenD module for our smart card support and have run into stumbling blocks with supporting the new operating systems with no reliable channel on changes aside from poking and prodding behavior as best as I can when new beta releases come out.<br></div><div></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:ArialMT">See man page for SmartCardServices….</div></div></blockquote><div>Thanks for this - I'll keep an eye on man-page changes.<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:ArialMT"><br></div><div style="font-family:ArialMT">$ man SmartCardServices</div><div style="font-family:ArialMT"><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div style="font-family:ArialMT"><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)">SMARTCARDSERVICES(7) BSD Miscellaneous Information Manual SMARTCARDSERVICES(7)</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(0,249,0);background-color:rgb(0,0,0)">NAME</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> <span style="color:#00f900">SmartCardServices</span> -- overview of smart card support</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(0,249,0);background-color:rgb(0,0,0)">DESCRIPTION</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> <span style="color:#00f900">SmartCardServices</span> is a set of components which add native support for</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> smart cards to OS X.</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> Supported smart cards appear as separate keychains. A Tokend module for</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> each smart card you wish to use must be installed in</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> <span style="text-decoration:underline">/Library/Security/tokend</span></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(0,249,0);background-color:rgb(0,0,0)">USB<span style="color:#29f914"> </span>SMART<span style="color:#29f914"> </span>CARD<span style="color:#29f914"> </span>READER<span style="color:#29f914"> </span>DRIVERS</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> OS X has built-in support for USB CCID class-compliant smart card read-</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> ers. For other readers, install the reader driver in</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> <span style="text-decoration:underline">/usr/local/libexec/SmartCardServices/drivers</span>. Each driver is a bundle.</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> The bundle contains an XML file Info.plist which contains the device's</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> USB vendor ID and product ID. For detailed description of the plist for-</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> mat and how to write a reader driver, see</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> <a href="http://pcsclite.alioth.debian.org/api/group__IFDHandler.html" target="_blank">http://pcsclite.alioth.debian.org/api/group__IFDHandler.html</a></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(0,249,0);background-color:rgb(0,0,0)">SMART<span style="color:#29f914"> </span>CARD<span style="color:#29f914"> </span>APDU<span style="color:#29f914"> </span>LOGGING</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> It is possible to turn on logging for smart cards. Logging is turned on</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> by setting the global preference:</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> sudo defaults write /Library/Preferences/com.apple.security.smartcard</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> Logging -bool yes</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> After a smart card reader is connected (or after reboot) all operations</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> including contents of sent and received APDU messages are then logged</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> into the system log. Logging uses the facility com.apple.security.smart-</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> card.log so it is possible to set up filtering of these logs into custom</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> targets (see asl.conf(5))</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> To avoid security risks that could occur if logging is turned on indefi-</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> nitely, the logging setting is one-shot - it must be turned on by the</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> command above to start logging again with a new reader. This includes</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> unplugging and replugging the same reader.</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(0,249,0);background-color:rgb(0,0,0)">SEE<span style="color:#29f914"> </span>ALSO</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)"> sc_auth(8), defaults(1), asl.conf(5), ssh-keychain(8)</div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0);min-height:14px"><br></div><div style="margin:0px;font-size:12px;line-height:normal;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)">Mac OS X August 5, 2014 Mac OS X</div><div><br></div></div></blockquote><br><br><div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><span style="border-collapse:separate;line-height:normal;border-spacing:0px"><div style="word-wrap:break-word"><font style="color:rgb(0,0,0)" face="Helvetica"><span style="font-size:12px">- Shawn<br>_____________________________________________________________________<br>Shawn Geddis<span style="white-space:pre-wrap"> </span> <span style="white-space:pre-wrap"> </span> </span></font><font face="Helvetica"><span style="font-size:12px">geddis@{Mac | Me | iCloud}.com</span></font><font style="color:rgb(0,0,0)" face="Helvetica"><span style="font-size:12px"><br></span></font><span>Security and Certifications Engineer</span><font style="color:rgb(0,0,0)" face="Helvetica"><span style="font-size:12px">, Apple <a href="mailto:geddis@apple.com" target="_blank">geddis@apple.com</a></span></font></div></span></div></div></div></div></div></div></div></div></div></div></div><div style="word-wrap:break-word"><div><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><span style="border-collapse:separate;line-height:normal;border-spacing:0px"><div style="word-wrap:break-word"><font style="color:rgb(0,0,0)" face="Helvetica"><span style="font-size:12px"><br><br>Smart Card Services<span> </span> Project/Dev Lead: <br><span style="white-space:pre-wrap"> </span>Project Wiki:<span style="white-space:pre-wrap"> </span> [<a href="http://SmartCardServices.MacOSFforge.Org" target="_blank">SmartCardServices.MacOSFforge.Org</a>]<br><span style="white-space:pre-wrap"> </span>Mailing Lists:<span style="white-space:pre-wrap"> </span> [<a href="http://lists.macosforge.org/mailman/listinfo" target="_blank">Lists.MacOSForge.Org/mailman/listinfo</a>]</span></font></div></span></div></div></div></div></div></div></div></div></div></div></div><div style="word-wrap:break-word"><div><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><span style="border-collapse:separate;line-height:normal;border-spacing:0px"><div style="color:rgb(0,0,0);word-wrap:break-word"><font face="Helvetica"><span style="font-size:12px"><span style="white-space:pre-wrap"> </span>SCS Contact:<span style="white-space:pre-wrap"> </span> [<a href="mailto:scs-cotact@macosforge.org" target="_blank">scs-cotact@macosforge.org</a>]</span></font></div><div style="color:rgb(0,0,0);word-wrap:break-word"><font face="Helvetica"><span style="font-size:12px"><span style="white-space:pre-wrap"> </span>SCS Admin:<span style="white-space:pre-wrap"> </span> [<a href="mailto:scs-admin@macosforge.org" target="_blank">scs-admin@macosforge.org</a>]</span></font></div><div style="color:rgb(0,0,0);word-wrap:break-word"><font face="Helvetica"><span style="font-size:12px">_____________________________________________________________________</span></font><br></div></span></div></div></div></div></div></div></div></div></div></div></div></blockquote></div></div>