Important!

Blog moved to https://blog.apdu.fr/

I moved my blog from https://ludovicrousseau.blogspot.com/ to https://blog.apdu.fr/ . Why? I wanted to move away from Blogger (owne...

Wednesday, March 27, 2013

Comments are now disabled

Since the beginning of this blog the comments were possible. The comment introduction text said:
Please, do only post comments related to the article above.

For general questions or bug reports, subscribe to and use the muscle mailing list.

Your comment may be moderated and will not appear until then. No need to repost the same comment.

But many readers of my blog used the comment system to ask for support on subject unrelated to the blog article. Many of the questions should have been asked on the MUSCLE mailing list. Many questions were not accepted in the (manual) moderation step.

My blog is NOT a support forum or something similar. Support request should go to the MUSCLE list. To enforce that I decided to suspend the comments from my blog.

Tuesday, March 12, 2013

Oracle, javax.smartcardio failures

In the article PCSC sample in Java I presented the javax.smartcardio package to use PC/SC from a Java application. It works except that SUN/Oracle made 2 mistakes related to the same problem: PC/SC is an API not an ABI.

API

An API is an interface used at the source code level. In C langage, you include a header file and link to the associated library. In the PC/SC case you use something like:

#ifdef __APPLE__
#include <PCSC/winscard.h>
#include <PCSC/wintypes.h>
#else
#include <winscard.h>
#endif

And then use the PC/SC functions as provided in the header file.

ABI

The ABI is an interface used at the binary level.
At the API level the type int is used. At the ABI level the representation of int is used. The difference is that the C language do not define what int is. At the ABI level the representation of int is fixed by the compiler.

Evolution of API and/or ABI

The API may evolve if a new function is added, an existing function is removed or a function signature is changed (a function parameter is added or removed for example).

Each time the API change the ABI also changes. The ABI may also evolve even if the API do not change. This is more rare but happened with C++ when GCC changed the way to pass parameters to a function/method.

To avoid incompatibility problems on GNU/Linux the library contains an versioning. It is called soname. Applications using the old API/ABI will use libfoo version n. Applications using the new API/ABI will use libfoo version n+1. It is possible to have the two library versions installed at the same time (I don't know if it is possible to do that on a Windows system).

The JVM problems

SUN/Oracle made 2 mistakes in its use of the PC/SC library.

Direct use of libpcsclite.so

As written above a library is versioned. In the case of PC/SC the library is called libpcsclite.so.1 on a GNU/Linux system. The previous version was libpcsclite.so.0. I changed the API in version 1.2.9-beta1 (May 2004). I then increased the ABI version from 0 to 1.

The file libpcsclite.so is a symbolic link pointing to the version corresponding to the installed header files. Only the linker should use that file when building an application. On a Debian (or Ubuntu) system the file libpcsclite.so is provided by the libpcsclite-dev package and not by the libpcsclite1 package.

The Oracle JVM tries to loads libpcsclite.so directly. This is wrong because:
  • This file is not installed by default when the PC/SC library is installed
  • This file do not reference a particular library version. So if the PC/SC API change again then the JVM will miserably fail.

I get many bug reports because of that. But the problem is not on the pcsc-lite side. So I can't do much.

Direct definition of DWORD


Oracle think a DWORD is a 64-bit entity on a 64-bit system. This is not always the case and is wrong on Mac OS X in 64-bits mode.

Apple defines DWORD as:
typedef uint32_t DWORD;

On Linux it is defined as:
typedef unsigned long DWORD;

If the application (the JVM in this case) and the library (PCSC framework) do not agree on the ABI (the size of a DWORD parameter) then bad things happen.

See the bug report javax.smartcardio package not working in Java 7 on OS X ML for a solution to this problem.

Conclusion

I wrote this blog article so that I can refer people at it. And so that you can refer Oracle at it.

I do not use Java. I do not know how to report a JVM bug at Oracle. If you know then please send them a link of this article.

Monday, February 25, 2013

Smart Card authentication on Mac OS X Lion and OpenDirectory

In a mail on the SmartcardServices-Users mailing list I found a reference to an article (in French sorry) from April 2012 written by Yoann Gini about Smart Card authentication on Mac OS X Lion and OpenDirectory.

The french title is "Utiliser des cartes à puce pour s’authentifier sur OS X Lion avec un OpenDirectory".

Yoann writes about the configuration of a Feitian smart card + OpenSC to login on Mac OS X Lion.

Yoann also improved the command line tool sc_auth to add OpenDirectory support (the command binary is provided but I can't find the corresponding source code).

Note: sc_auth is not a compiled binary but a bash script. So the source code is the program itself. I should have checked that before.

Tuesday, January 29, 2013

OpenSC server migration

History

The OpenSC project is/was hosted at http://www.opensc-project.org/. Andreas Jellinghaus was the OpenSC maintainer for a long time and managed the project server.

Andreas changed his job and could not invest the needed time to administer the server any more.

Projects

OpenSC is a project name and also an organization hosting sub-projects. From the main web page:

" OpenSC effort consists of various sub-projects that can be used independently as well, without OpenSC:
  • engine_pkcs11 is an OpenSSL engine to use PKCS#11 providers, either from command line or from applications
  • libp11 is a small C wrapper library for working with PKCS#11 modules.
  • pkcs11-helper eases working with PKCS#11 modules, by implementing common tasks.
  • PAM-PKCS#11 implements various authentication methods
  • pam_p11 is a small and simple PAM module for local authentication
  • OpenCT implements a reader driver interface for various non-standard readers on Linux, meant to be used with OpenSC.
  • OpenSC-Java is a Java<->OpenSC bridge? "

New services

Source code

The source code repository of the OpenSC project and sub-projects is now at github: https://github.com/OpenSC

Migration status: done

Bug tracker

Bug are stored in the Trac instance and are not easy to migrate. One option is to use github issues feature.

Migration status: not done

wiki

The wiki pages are also hosted at github: https://github.com/OpenSC/OpenSC/wiki

Migration status: done

Mailing lists

The mailing lists are hosted at the OpenSC project at SourceForge: http://sourceforge.net/projects/opensc/

You have to subscribe yourself to the new lists. We do not plan to do an automatic migration to:

Migration status: DIY (Do It Yourself)

Nightly builds

http://sourceforge.net/projects/opensc/files/OpenSC/nightly/

Tarball releases

http://sourceforge.net/projects/opensc/files/OpenSC/

github.com also provides tarball releases but these archives contain only the source code and not the generated ./configure scripts. So they are not really useful.
https://github.com/OpenSC/OpenSC/tags

Continuous integration

https://opensc.fr/jenkins/

Conclusion

The old server is now mostly done. The migration should be finished.

The bad news is that the bug reports are lost in the migration. Maybe they may appear at a later date.

Wednesday, January 16, 2013

New version of libccid: 1.4.9

I just released a version 1.4.9 of libccid the free software CCID class smart card reader driver.

Changes:
1.4.9 - 16 January 2013, Ludovic Rousseau
  • Add support of
    • Aktiv Rutoken PINPad In
    • Aktiv Rutoken PINPad Ex
    • REINER SCT cyberJack go
  • Info.plist: Correctly handle reader names containing &

New version of pcsc-lite: 1.8.8

I just released a new version of pcsc-lite 1.8.8.

Changes:
pcsc-lite-1.8.8: Ludovic Rousseau
16 January 2013
  • /etc/reader.conf: handle FRIENDLYNAME with no " delimiters (serial readers)
  • Info.plist: Correctly handle reader names containing & (USB readers)

Wednesday, January 9, 2013

OpenSC mailing list statistics for 2012

The OpenSC-devel mailing list has also a drop in number of messages. Statistics for 2011 are available in OpenSC mailing list statistics for 2011.

Year Total number of messages Progression
20113214
2012626-80%

The mailing list moved from opensc-devel@lists.opensc-project.org to opensc-devel@lists.sourceforge.net in late December 2012. But that should not have a significant impact. The truth is somewhere else.



Statistics from 1.1.2012 to 31.12.2012
for opensc-devel@lists.opensc-project.org



People who have written most messages:


 Author  Msg  Percent
1ludovic.rousseau@gmail.com6510.38 %
2jmpoure@gooze.eu589.27 %
3viktor.tarasov@gmail.com568.95 %
4deengert@anl.gov538.47 %
5peter@stuge.se507.99 %
6martin@martinpaljak.net345.43 %
7helpcrypto@gmail.com243.83 %
8quannguyen@mbm.vn223.51 %
9anders.rundgren@telia.com213.35 %
10ndk.clanbo@gmail.com193.04 %
11morgner@informatik.hu-berlin.de172.72 %
12andreas.schwier@cardcontact.de172.72 %
13alon.barlev@gmail.com162.56 %
14andreas@ionisiert.de152.40 %
15andreas.schwier.ml@cardcontact.de111.76 %
16anthony.foiani@gmail.com91.44 %
17peter@adpm.de71.12 %
18m4gw4s@gmail.com60.96 %
19mathias.tausig@a-cert.at60.96 %
20evalues.es@gmail.com50.80 %
21lukas@wunner.de50.80 %
22pk@opensc-project.org40.64 %
23grharon@gmail.com40.64 %
24frank@linetwo.net40.64 %
25rns_course@yahoo.com40.64 %
26scott_thomas007@yahoo.com30.48 %
27mboorshtein@gmail.com30.48 %
28scottm@aero.org30.48 %
29n.mavrogiannopoulos@gmail.com30.48 %
30development@aventra.fi30.48 %
other7912.62 %

Best authors, by total size of their messages (w/o quoting):


 Author  KBytes
1ludovic.rousseau@gmail.com488.7
2jmpoure@gooze.eu406.5
3viktor.tarasov@gmail.com332.5
4peter@stuge.se331.5
5deengert@anl.gov327.0
6martin@martinpaljak.net180.0
7helpcrypto@gmail.com144.2
8quannguyen@mbm.vn138.4
9ndk.clanbo@gmail.com133.1
10morgner@informatik.hu-berlin.de128.7
11andreas.schwier@cardcontact.de118.5
12anders.rundgren@telia.com112.2
13alon.barlev@gmail.com101.9
14andreas@ionisiert.de85.1
15andreas.schwier.ml@cardcontact.de58.7
16anthony.foiani@gmail.com57.7
17evalues.es@gmail.com42.5
18peter@adpm.de40.9
19n.mavrogiannopoulos@gmail.com38.0
20lukas@wunner.de34.3
21m4gw4s@gmail.com29.9
22grharon@gmail.com28.9
23mathias.tausig@a-cert.at27.0
24opensc-devel-bounces@lists.opensc-project.org23.2
25pk@opensc-project.org20.0
26frank@linetwo.net19.9
27gdt@ir.bbn.com18.5
28scottm@aero.org18.4
29ep@acm.org18.3
30jonmark816@gmail.com16.2

Best authors, by average size of their message (w/o quoting):


 Author  bytes
1opensc@secure-edge.com15538
2dave_muoio@yahoo.com13665
3roam@ringlet.net13541
4n.mavrogiannopoulos@gmail.com12983
5eserrano@emergya.com12851
6manu@netbsd.org12680
7poort@telenet.be11234
8jean-pierre.szikora@uclouvain.be10226
9ep@acm.org9376
10evalues.es@gmail.com8702
11jorge.martin@cenatic.es8645
12jonmark816@gmail.com8306
13plem21@gmail.com8048
14opensc-devel-bounces@lists.opensc-project.org7919
15morgner@informatik.hu-berlin.de7752
16joemar.mante@gmail.com7728
17christian@hohnstaedt.de7718
18ludovic.rousseau@gmail.com7698
19william.hunter@trusted-logic.com7607
20aron.szabo@egroup.hu7462
21grharon@gmail.com7393
22jmpoure@gooze.eu7177
23ndk.clanbo@gmail.com7173
24andreas.schwier@cardcontact.de7135
25lukas@wunner.de7020
26peter@stuge.se6789
27leonardo.schenkel@gmail.com6613
28anthony.foiani@gmail.com6566
29alon.barlev@gmail.com6524
30quannguyen@mbm.vn6441

Table showing the most successful subjects:


 Subject  Msg  Percent
1[opensc-devel] state of the project?
253.99 %
2[opensc-devel] new release?
213.35 %
3[opensc-devel] Technical Description - Android Embedded SE
193.04 %
4[opensc-devel] OpenSC and gerrit
172.72 %
5[opensc-devel] OpenSC write access to main trunk, discussion
162.56 %
6[opensc-devel] Upgrading aPass2003 Firmware to PIV
121.92 %
7[opensc-devel] PKCS15init profile to omit a part of path
91.44 %
8[opensc-devel] proving a key is on a smart card
81.28 %
9[opensc-devel] Biometric integraiton?
81.28 %
10[opensc-devel] OpenPGP card / Cryptostick - current status???
81.28 %
11[opensc-devel] OpenSC support for iKey4000?
71.12 %
12[opensc-devel] ACR122U + MyEID dual interface
71.12 %
13[opensc-devel] GetInvolved wiki page
71.12 %
14[opensc-devel] OpenSC Server Maintenance
71.12 %
15[opensc-devel] Driver develop
71.12 %
16[opensc-devel] new server hoster and adminstrator for
71.12 %
17[opensc-devel] W3C takes on Web+SecurityElements
71.12 %
18[opensc-devel] Segmentation fault in pkcs11-tool
71.12 %
19[opensc-devel] Changed certificate on opensc-project.org
60.96 %
20[opensc-devel] Fix a crash when trying to list objects via
60.96 %
21[opensc-devel] OpenSC staging branch
60.96 %
22[opensc-devel] Minidriver assume hexstring encoding for card
60.96 %
23[opensc-devel] Secure Credential Cloning. Was: Intel's Virtual
60.96 %
24[opensc-devel] obtaining a CSR for a token-generated (and
60.96 %
25[opensc-devel] a few more trivial patches
60.96 %
26[opensc-devel] Question about struct sc_pkcs15_id
50.80 %
27[opensc-devel] gerrit and merge process: "Submitted,
50.80 %
28[opensc-devel] Managing the queue line of a compilation farm
50.80 %
29[opensc-devel] Ownership issue and consequences on OpenSC
50.80 %
30[opensc-devel] How to deal with the gerrit backlog in an
50.80 %
other36057.51 %

Most used email clients:


 Mailer  Msg  Percent
1(unknown)31350.00 %
2Mozilla/5.x20132.11 %
3Evolution 3.2.2-1
274.31 %
4Evolution 3.2.2-1+b1
132.08 %
5Evolution 3.4.3-1
132.08 %
6KMail121.92 %
7Mutt111.76 %
8Evolution 3.0.3-3
40.64 %
9Microsoft Office Outlook 12.0
40.64 %
10YahooMailWebService/0.8.128.478
30.48 %
11Gnus/5.130006 (Ma Gnus v0.6) Emacs/23.4 (berkeley-unix)
30.48 %
12YahooMailClassic/15.0.4 YahooMailWebService/0.8.116.331537
20.32 %
13Evolution 3.0.3 (3.0.3-1.fc15)
20.32 %
14iPhone Mail (10A403)
20.32 %
15Evolution 3.4.4-1
20.32 %
16YahooMailClassic/15.0.4 YahooMailWebService/0.8.115.331698
10.16 %
17Zimbra 7.1.3_GA_3346 (Zimbra Desktop/7.1.2_10978_Windows)
10.16 %
18Alpine 2.00 (BSO 1167 2008-08-23)
10.16 %
19YahooMailWebService/0.8.116.338427
10.16 %
20iPhone Mail (9B176)
10.16 %
21Evolution 2.6.0
10.16 %
22Zimbra 6.0.5_GA_2213.RHEL5_64 (Zimbra Desktop/7.1.1_10917_Linux)
10.16 %
23AtMail PHP 5.5
10.16 %
24YahooMailWebService/0.8.120.356233
10.16 %
25Apple Mail (2.1084)
10.16 %
26YahooMailWebService/0.8.123.460
10.16 %
27Apple Mail (2.1085)
10.16 %
28Claws Mail 3.8.1 (GTK+ 2.24.13; i686-pc-linux-gnu)
10.16 %
29Foxmail 7.0.1.91[cn]
10.16 %
other00.00 %

Table of maximal quoting:


 Author  Percent
1djm@mindrot.org73.97 %
2mathias.tausig@a-cert.at51.90 %
3grharon@gmail.com44.06 %
4Scott.Michel@aero.org43.97 %
5francesco.zema@gimo.co.uk41.90 %
6rholliday@moyatech.com41.83 %
7lovecraftesque@yahoo.com39.23 %
8ttaylor@mitre.org34.61 %
9martin.cmelik@gmail.com34.56 %
10okir@lst.de34.05 %
11leonardo.schenkel@gmail.com33.56 %
12B.Thomas@astronautics.com31.96 %
13funny.sweet.naughty@gmail.com29.68 %
14hwit@a-domani.nl28.49 %
15aidinboog@gmail.com28.29 %
16frank@linetwo.net27.83 %
17lists@kaiser.cx26.67 %
18akroehnert@go-lan.net26.54 %
19info@mightymarvels.de25.69 %
20ionut.scutaru@gmail.com24.51 %
21evalues.es@gmail.com24.15 %
22lukas@wunner.de24.15 %
23poort@telenet.be23.99 %
24scottm@aero.org23.85 %
25plem21@gmail.com23.06 %
26jean-pierre.szikora@uclouvain.be21.75 %
27linuxchuck@gmail.com21.11 %
28andreas@ionisiert.de19.11 %
29mboorshtein@gmail.com18.04 %
30ben@ftsafe.com17.78 %
average13.22 %

Graph showing number of messages written during hours of day:


msgs
14
|
12
|
1
|
0
|
2
|
2
|
5
|
5
|
19
|
70
|
56
|
48
|
26
|
37
|
44
|
41
|
38
|
30
|
34
|
28
|
24
|
28
|
38
|
24
|
hour
01234567891011121314151617181920212223

Graph showing number of messages written during days of month:


msgs
7
|
15
|
25
|
18
|
22
|
19
|
13
|
15
|
19
|
22
|
19
|
25
|
13
|
13
|
10
|
20
|
21
|
19
|
28
|
28
|
38
|
30
|
41
|
23
|
29
|
22
|
39
|
14
|
7
|
6
|
5
|
day
12345678910111213141516171819202122232425262728293031

Warning: 1 message(s) not counted.


Graph showing number of messages written during days of week:


msgs
116
|
97
|
119
|
92
|
75
|
47
|
80
|

MonTueWedThuFriSatSun

Maximal quoting:


Author : quannguyen@mbm.vn
Subject : [opensc-devel] Support of generating & importing key in OpenPGP card

Date : Thu, 12 Jul 2012 09:51:05 +0700

Quote ratio: 79.88% / 21100 bytes

Longest message:


Author : ndk.clanbo@gmail.com
Subject : [opensc-devel] CRYPTOMATE64
Date : Wed, 13 Jun 2012 23:03:32 +0200
Size : 53992 bytes

Most successful subject:


Subject : [opensc-devel] state of the project?
No. of msgs: 25
Total size : 155397 bytes

Final summary:


Total number of messages: 626
Total number of different authors: 89
Total number of different subjects: 229
Total size of messages (w/o headers): 4653742 bytes
Average size of a message: 7434 bytes



Input file last updated: Wed Jan 9 15:24:06 2013
Generated by MailListStat v1.3