FLOSS Luxtrust - Revision history

Lmamane: /* Status */ Mention that it might work with French certigreffe keys

2011-06-08T17:30:01Z

Status: Mention that it might work with French certigreffe keys

Lmamane: /* Development */ Resources: trac ticket, git repo

2011-06-08T17:25:00Z

Development: Resources: trac ticket, git repo

Lmamane: New section /* Development */

2011-06-08T16:55:05Z

New section Development

Lmamane: /* Scope */ Rename to Status

2011-06-08T16:34:44Z

Scope: Rename to Status

Lmamane: bash syntax highlight not supported on this wiki

2011-06-08T16:32:56Z

bash syntax highlight not supported on this wiki

Lmamane: /* Get Source */ Update to newer version of patch

2011-06-08T16:22:55Z

Get Source: Update to newer version of patch

Lmamane: intro: better

2011-06-08T16:20:23Z

intro: better

Lmamane: Copy Luxtrust page from C3L wiki

2011-06-08T16:19:30Z

Copy Luxtrust page from C3L wiki

New page

A FLOSS driver, in the OpenSC framework is being developed by [[User:lmamane]].

Some day, hopefully soon, it will just be part of [http://www.opensc-project.org OpenSC] and you'll just install your distro's packets. In the meantime, here's how to get the code manually.

== Scope ==

This driver should work for every application that supports PKCS#11, in particular the Mozilla applications. So you can authenticate to websites, sign and decrypt email, etc.

However:
* It can use only the authentication key, not the signature (non-repudiation) key. Usage of the latter has to be cryptographically authenticated, so more work to develop.
* It does not work for the luxtrust.lu website, because this website
** uses the signature key for authentication (yes, really!)
** does not use the facilities provided by the browser, but a mix of Java code and binary object/machine code (!) that looks for the Gemalto libraries by hardcoded filename (!). Yes, it really is that bad; yes, it really downloads a shared library (.so/.dll) to your machine and uses that. "Obviously" (at least the GNU/Linux version of) that shared library is only available for IA32, so even if we would hack things to emulate the gemalto libraries perfectly, it still wouldn't work for amd64, sparc, PowerPC, mips or any other architecture.

So for now, you still need to use the Gemalto binary-only middleware to activate your smartcard, to revoke it on-line, etc.

=== Tested websites ===

Working:
* etat.lu websites for companies
** eTVA
** company registry (RCSL)
* etat.lu websites for individuals
** guichet.lu ([https://www.services-publics.lu/assistants/espace-perso])

Not working:
* luxtrust.lu

Unknown status
* bcee.snet.lu most probably does not work out of the box. It may or may not work if you link from /usr/lib/pkcs11/libgclib.so to openssl-pkcs11.so; I (lmamane) get unrelated Java error "cannot open zip file", so I don't know.

=== Tested applications ===

Working:
* Mozilla family
** Firefox / Iceweasel: authentication to websites
** Thunderbird / Icedove: email signing and decryption (with the auth certificate!)
* openssl command-line tool: MIME signing / decryption, PKCS1 RSA computations, reading certificates (both your own and also the LuxTrust ones), ...

Not working:
* Microsoft Windows-native applications (using CryptoAPI instead of PKCS #11)
** Microsoft Internet Explorer
** Smartcard authentication to a Microsoft Windows Active Directory domain

== GNU/Linux & other Unixy systems ==

=== Get Source ===

Either download a complete ready tarball (snapshot from November 2010) from [http://www.cypherpunks.lu/opensc/opensc-0.12.0-rc1+lem.tar.gz local cypherpunks], or do it manually to get the latest OpenSC:

Get a SVN trunk checkout of OpenSC (see [http://www.opensc-project.org/opensc/wiki/SubversionRepository]):
<syntaxhighlight lang="bash">
svn co http://www.opensc-project.org/svn/opensc/trunk opensc
</syntaxhighlight>
apply patch from trac ticket [https://www.opensc-project.org/opensc/ticket/267 #267]:
<syntaxhighlight lang="bash">
wget https://www.opensc-project.org/opensc/raw-attachment/ticket/267/lem_gemsafe_v2_svnr5052.patch
cd opensc
patch -p0 < ../lem_gemsafe_v2_svnr5052.patch
</syntaxhighlight>

If the tool segfaults in <tt>strlen</tt> when using a card with an empty label, please apply this patch [http://lilux.lu/pipermail/lilux-help/attachments/20110125/f698eb8c/attachment.bin]

=== Compile ===
Replace N with number of CPU cores in your system, plus one.
<syntaxhighlight lang="bash">
./bootstrap
./configure --prefix=/some/place
make -jN
</syntaxhighlight>

=== Install ===
<syntaxhighlight lang="bash">
make install
#or, depending on choice of /some/place
sudo make install
</syntaxhighlight>

=== Use ===
Now, /some/place/bin contains command-line utilities to manipulate your card. In particular, pkcs15-tool allows to read the contents of the card, change the user or admin PIN, unblock user PIN (using the admin PIN), ...

To use with an application that supports the PKCS#11 interface (e.g. the Mozilla applications), use /some/place/lib/opensc-pkcs11.so.

You can also "test" the card using the following command:

<tt>/some/place/bin/pkcs11-tool --module /some/place/lib/opensc-pkcs11.so -l -t</tt>

However, for the time being, this will fail with a confusing "User not logged in" when the test tries to use the signature key.

It is also very slow (up to 30 seconds) if you don't enable caching (see below).

=== Performance ===

By default, the card is very slow. The Luxtrust proprietary middleware has appropriate speed, because it caches most information on the computer. You can set up the open middleware to cache too.

# Edit <tt>/some/place/etc/opensc.conf</tt>, and uncomment the "<tt>use_file_caching = true</tt>" line in the "<tt>framework pkcs15</tt>" section.
# Initialize the cache using the following command: <tt>/some/place/bin/pkcs15-tool --learn-card</tt>

== Microsoft Windows ==

We here show how to cross-compile from a Debian (or Ubuntu) GNU/Linux machine with mingw. You can also use Cygwin or compile directly on Windows.

=== Build ===

Get the tarball, or get the source with SVN.
<syntaxhighlight lang="bash">
svn co http://www.opensc-project.org/svn/build/trunk cross-build
cd cross-build
cd sources
wget http://www.cypherpunks.lu/opensc/opensc-0.12.0-rc1+lem.tar.gz
cd ..
MAKEFLAGS=-j1 CHOST=i586-mingw32msvc CBUILD=i686-pc-linux-gnu ./build
</syntaxhighlight>
Parallel build does not work because of OpenSSL build system bug. Try [http://www.cypherpunks.lu/opensc/build-parallel-openssl-workaround.patch this patch] if you want a parallel build, it "Works For Me (tm)".

=== Install ===

This creates a .exe installer; run it.

=== Use ===
c:\program files\opensc\bin contains command-line utilities to manipulate your card. In particular, pkcs15-tool allows to read the contents of the card, change the user or admin PIN, unblock user PIN (using the admin PIN), ... Put that directory in your path or run from there.

To use with an application that supports the PKCS#11 interface (e.g. the Mozilla applications), use c:\program files\opensc\bin\opensc-pkcs11.dll; yes, that's bin/, not lib/, that's somewhat suprising / confusing.

As far as I (lmamane) know, a CryptoAPI driver for OpenSC (used by native applications, e.g. Internet Explorer, smartcard login to Windows, ...) is not available yet.

== Footnotes ==
<references/>

← Older revision		Revision as of 17:25, 8 June 2011
Line 126:		Line 126:

	== Development ==		== Development ==
		+
		+	=== Resources ===
		+
		+	Trac ticket upstream: [#267 https://www.opensc-project.org/opensc/ticket/267]
		+
		+	Lionel's git repo: <tt>git://git.debian.org/users/lmamane/opensc.git</tt>
		+
		+	Development happens in branch <tt>luxtrust</tt> of that git repo. This branch might be rebased on top of further imported commits from SVN, so if you fork it, please advise with Lionel.
		+
		+	=== Notes ===

	The main next step is to get the driver able to use the signing key. This needs implementation of "secure messaging" (SM) so that the commands are cryptographically authenticated.		The main next step is to get the driver able to use the signing key. This needs implementation of "secure messaging" (SM) so that the commands are cryptographically authenticated.

← Older revision		Revision as of 16:20, 8 June 2011
Line 1:		Line 1:
−	A FLOSS driver, in the OpenSC framework is being developed by [[User:lmamane]].	+	A FLOSS driver for the Luxtrust smartcard and signing stick, in the OpenSC framework is being developed by [[User:lmamane]].

	Some day, hopefully soon, it will just be part of [http://www.opensc-project.org OpenSC] and you'll just install your distro's packets. In the meantime, here's how to get the code manually.		Some day, hopefully soon, it will just be part of [http://www.opensc-project.org OpenSC] and you'll just install your distro's packets. In the meantime, here's how to get the code manually.

@@ Line 15: / Line 15: @@
 So for now, you still need to use the Gemalto binary-only middleware to activate your smartcard, to revoke it on-line, etc.
-=== Tested websites ===
+=== Cards ===
 Working:
@@ Line 30: / Line 39: @@
 * bcee.snet.lu most probably does not work out of the box. It may or may not work if you link from /usr/lib/pkcs11/libgclib.so to openssl-pkcs11.so; I (lmamane) get unrelated Java error "cannot open zip file", so I don't know.
-=== Tested applications ===
+=== Applications ===
 Working:

@@ Line 124: / Line 124: @@
 As far as I (lmamane) know, a CryptoAPI driver for OpenSC (used by native applications, e.g. Internet Explorer, smartcard login to Windows, ...) is not available yet.
 == Footnotes ==
 <references/>

@@ Line 3: / Line 3: @@
 Some day, hopefully soon, it will just be part of [http://www.opensc-project.org OpenSC] and you'll just install your distro's packets. In the meantime, here's how to get the code manually.
-== Scope ==
+== Status ==
 This driver should work for every application that supports PKCS#11, in particular the Mozilla applications. So you can authenticate to websites, sign and decrypt email, etc.

@@ Line 50: / Line 50: @@
 Get a SVN trunk checkout of OpenSC (see [http://www.opensc-project.org/opensc/wiki/SubversionRepository]):
-<syntaxhighlight lang="bash">
+<tt>
-svn co http://www.opensc-project.org/svn/opensc/trunk opensc
+ svn co http://www.opensc-project.org/svn/opensc/trunk opensc
-</syntaxhighlight>
+</tt>
 apply patch from trac ticket [https://www.opensc-project.org/opensc/ticket/267 #267]:
-<syntaxhighlight lang="bash">
+<tt>
-wget https://www.opensc-project.org/opensc/raw-attachment/ticket/267/lem_gemsafe_v2_svnr5562.patch
+ wget https://www.opensc-project.org/opensc/raw-attachment/ticket/267/lem_gemsafe_v2_svnr5562.patch
-cd opensc
+ cd opensc
-patch -p0 < ../lem_gemsafe_v2_svnr5562.patch
+ patch -p0 < ../lem_gemsafe_v2_svnr5562.patch
-</syntaxhighlight>
+</tt>
 If the tool segfaults in <tt>strlen</tt> when using a card with an empty label, please apply this patch [http://lilux.lu/pipermail/lilux-help/attachments/20110125/f698eb8c/attachment.bin]
@@ Line 64: / Line 64: @@
 === Compile ===
 Replace N with number of CPU cores in your system, plus one.
-<syntaxhighlight lang="bash">
+<tt>
-./bootstrap
+ ./bootstrap
-./configure --prefix=/some/place
+ ./configure --prefix=/some/place
-make -jN
+ make -jN
-</syntaxhighlight>
+</tt>
 === Install ===
-<syntaxhighlight lang="bash">
+<tt>
-make install
+ make install
-#or, depending on choice of /some/place
+ #or, depending on choice of /some/place
-sudo make install
+ sudo make install
-</syntaxhighlight>
+</tt>
 === Use ===
@@ Line 104: / Line 104: @@
 Get the tarball, or get the source with SVN.
-<syntaxhighlight lang="bash">
+<tt>
-svn co http://www.opensc-project.org/svn/build/trunk cross-build
+ svn co http://www.opensc-project.org/svn/build/trunk cross-build
-cd cross-build
+ cd cross-build
-cd sources
+ cd sources
-wget http://www.cypherpunks.lu/opensc/opensc-0.12.0-rc1+lem.tar.gz
+ wget http://www.cypherpunks.lu/opensc/opensc-0.12.0-rc1+lem.tar.gz
-cd ..
+ cd ..
-MAKEFLAGS=-j1 CHOST=i586-mingw32msvc CBUILD=i686-pc-linux-gnu ./build
+ MAKEFLAGS=-j1 CHOST=i586-mingw32msvc CBUILD=i686-pc-linux-gnu ./build
-</syntaxhighlight>
+</tt>
 Parallel build does not work because of OpenSSL build system bug. Try [http://www.cypherpunks.lu/opensc/build-parallel-openssl-workaround.patch this patch] if you want a parallel build, it "Works For Me (tm)".