Important!

Blog moved to https://blog.apdu.fr/

I moved my blog from https://ludovicrousseau.blogspot.com/ to https://blog.apdu.fr/ . Why? I wanted to move away from Blogger (owne...

Wednesday, October 21, 2015

New version of libccid: 1.4.21

I just released a version 1.4.21 of libccid the Free Software CCID class smart card reader driver.

Direct download here.

Changes:
1.4.21 - 21 October 2015, Ludovic Rousseau
  • Add support of
    • ACS ACR1252 Dual Reader
    • Chicony HP USB Smartcard CCID Keyboard JP
    • Chicony HP USB Smartcard CCID Keyboard KR
    • FT ePass2003Auto
    • Feitian bR301 BLE
    • Feitian iR301 (ProductID 0x0619)
    • Feitian iR301 (ProductID 0x061C)
    • Identiv @MAXX ID-1 Smart Card Reader
    • Identiv @MAXX Light2 token
    • Identiv CLOUD 2980 F Smart Card Reader
    • Identiv Identiv uTrust 4701 F Dual Interface Reader
    • Identiv SCR3500 A Contact Reader
    • Identiv SCR3500 B Contact Reader
    • Identiv SCR35xx USB Smart Card Reader
    • Identiv uTrust 2900 R Smart Card Reader
    • Identiv uTrust 2910 R Smart Card Reader
    • Identiv uTrust 2910 R Taglio SC Reader
    • Identiv uTrust 3512 SAM slot Token
    • Identiv uTrust 3522 embd SE RFID Token
    • Identiv uTrust 3700 F CL Reader
    • Identiv uTrust 3701 F CL Reader
    • Identive Identive CLOUD 4000 F DTC
    • Liteon HP SC Keyboard - Apollo (Liteon)
    • Liteon HP SC Keyboard - Apollo JP (Liteon)
    • Liteon HP SC Keyboard - Apollo KR (Liteon)
    • Nitrokey Nitrokey HSM
    • Nitrokey Nitrokey Pro
    • Nitrokey Nitrokey Start
    • Rocketek RT-SCR1
    • VASCO DIGIPASS 875
    • WatchCNPC USB CCID Key
  • Remove support of
    • Crypto Stick Crypto Stick v1.4 is an old version of Nitrokey Nitrokey Pro
    • Free Software Initiative of Japan Gnuk Token is an old version of Nitrokey Nitrokey Start
    • Add Feitain R502 dual interface (composite) reader on Mac OS X
    • display a human readable version of the error code returned by libusb
    • Mac OS X: wait until libusb/the reader is ready
    • some minor bugs fixed

    Sunday, October 11, 2015

    My blog Google+ page

    You are now more than 200 to follow my blog Google+ page at https://plus.google.com/u/0/b/105951035108309096272/105951035108309096272/posts



    Comments

    I disabled comments on the blog in 2013. See why at "Comments are now disabled". Technical questions should go on the MUSCLE mailing list.

    The goal of the Google+ page is to allow you to leave comments about my blog articles.

    If you just want to know when a new article is available maybe you should subscribe to my blog RSS feed instead. It looks like many people are doing that because I have much more readers of my blog than subscribers of my blog Google+ page.

    Conclusion

    Feel free to leave comments related to the articles on Google+.

    If you want to contact me directly you should use email instead of comments. You can reach me at ludovic.rousseau@free.fr or ludovic.rousseau@gmail.com.

    Saturday, October 3, 2015

    Evolution of the number of CCID readers

    Regularly I add support of new smart card readers in the list of CCID devices. I wanted to know how regularly I did that over the lifetime of the project (more than 12 years now).
    So I extracted some numbers from the CCID driver git repository to generate a graphic.

    Graph




    I am really surprised by the linearity of the curve.



    The linear correlation equation is (according to Numbers): y = 1.132e-6 x -159.63
    That is a growth rate of 1.132x10-6 readers per second or 36.7 readers per year.


    The curve is even better approximated by a polynomial equation in x2. The coefficient of determination R2 is then equal to 0.9949 (closer to 1.0) instead of 0.9753 for the linear correlation.



    Accidents

    I note 3 "accidents" or fast evolutions:



    Conclusion

    The number of supported CCID readers continues to grow. I do not expect the growth rate to decrease.

    I guess some very old smart card reader models are no more sold. And are, or not, replaced by new newer models.
    You can list the readers sorted by "seniority" using the Readers sorted by 'release' field page and discover the first 7 readers included in version 0.1.0 of the driver.

    Friday, October 2, 2015

    OS X El Capitan and smart cards status

    El Capitan (OS X 10.11) is now out since 30th September, 2015.

    As I did with the previous major versions of Mac OS X Yosemite, Mavericks, Mountain Lion (and Lion) I will list changes in El Capitan regarding the smart card world.


    API Differences between 10.10 and 10.11

    The differences are listed in the developer page OS X El Capitan v10.11. The page only document big changes. The smart card changes are not listed there :-)

    A complete list of API changes is at OS X v10.11 API Diffs. Regarding the smart card world we have:
    The CryptoTokenKit API has changed. Some methods have been modified, some methods have been added.

    I note two sets of new methods: TKSmartCardPIN* and TKSmartCardUserInteractionFor*. It looks like Apple wants to provide a nice User eXperience regarding PIN management.

    I hope Apple will provide more documentation than the .h header file and some code samples.
    I will try to rebuild my Crypto Token Kit Objective-C and Swift examples on El Capitan to check if they still work.

    PC/SC

    Since Yosemite (10.10) the PC/SC layer is no more a fork of pcsc-lite. So comparing versions with pcsc-lite is useless.

    $ cat /System/Library/Frameworks/PCSC.framework/Versions/A/Resources/version.plist 
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
     <key>BuildAliasOf</key>
     <string>CryptoTokenKit</string>
     <key>BuildVersion</key>
     <string>13</string>
     <key>CFBundleShortVersionString</key>
     <string>8.0</string>
     <key>CFBundleVersion</key>
     <string>1</string>
     <key>ProjectName</key>
     <string>SmartCardServices</string>
     <key>SourceVersion</key>
     <string>79001001000000</string>
    </dict>
    </plist>
    


    The BuildVersion changed from 1 on Yosemite to 13 on El Capitan, and SourceVersion changed from 22020004000000 to 79001001000000. I have no idea what the SourceVersion "number" is.

    It looks like Apple made 12 builds of the PC/SC framework since Yosemite 10.10.

    Bugs fixed

    At least one bug remains: PC/SC functions crash after a fork(2). But this bug may be hard to fix.

    I updated my blog article OS X Yosemite and smart cards: known bugs.

    Maybe new bugs will be found on El Capitan. But I have not yet found any after just a few hours of tests.

    CCID driver

    Driver version 1.4.14.
    No change since Yosemite.

    $ grep -A 1 CFBundleShortVersionString /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/Info.plist
     <key>CFBundleShortVersionString</key>
     <string>1.4.14</string>
    

    New driver location

    The System Integrity Protection (SIP) introduced in El Capitan impose that custom PC/SC drivers are now installed in /usr/local/libexec/SmartCardServices/drivers/.

    Only the CCID driver provided by Apple is still in /usr/libexec/SmartCardServices/drivers/.

    Tokend

    Because of SIP, the tokend needs to be installed in /Library/Security/tokend/ now instead of /System/Library/Security/tokend/.

    The tokend and CDSA are still usable. I just fixed the PKCS11.tokend so that it looks for PKCS#11 libraries in /usr/local/lib/pkcs11/ if /usr/lib/pkcs11/ does not exist (as it is the case on El Capitan because of SIP again).

    Conclusion

    Most of the remaining PC/SC bugs fixed.
    tokend still usable.
    Some new Crypto Token Kit methods.

    Saturday, September 26, 2015

    PCSC sample in Swift

    To continue the list of PC/SC wrappers initiated in 2010 with "PC/SC sample in different languages" I now present a sample in Swift using the Apple Crypto Token Kit API.

    Crypto Token Kit API

    See my previous article "PCSC sample in Objective-C" to know more about Crypto Token Kit API.

    Source code

    Create a new Swift application in Xcode. You need to enable the App Sandbox and add/set the com.apple.security.smartcard entitlement to YES.

    This code is just a, more or less direct, conversion of the Objective-C source code to Swift.

    I used Xcode 7.0 that implements Swift version 2.1.

    Swift is a language not yet known by my colorization tool: source-highlight. The colors may not be great.
    import CryptoTokenKit
    
    let mngr = TKSmartCardSlotManager.defaultManager()
    
    // Use the first reader/slot found
    let slotName = mngr!.slotNames[0]
    print("slotName:", slotName)
    
    // connect to the slot
    mngr?.getSlotWithName(slotName, reply: {
        (slot: TKSmartCardSlot?) in
        // connect to the card
        let card = slot?.makeSmartCard()
        if (card != nil)
        {
            // begin a session
            card?.beginSessionWithReply({
                (success: Bool, error: NSError?) in
                if (success)
                {
                    // send 1st APDU
                    let aid : [UInt8] = [0xA0, 0x00, 0x00, 0x00, 0x62, 0x03, 0x01, 0x0C, 0x06, 0x01]
                    let data = NSData(bytes: aid, length: aid.count)
                    card?.sendIns(0xA4, p1: 0x04, p2: 0x00, data: data, le: 0, reply: {
                        (data: NSData?, sw: UInt16, error: NSError?) in
                        if (error != nil)
                        {
                            print("sendIns error:", error!)
                        }
                        else
                        {
                            print("Response:", data!, String(sw, radix: 16))
    
                            // send 2nd APDU
                            let data = NSData(bytes: nil, length: 0)
                            card?.sendIns(0x0, p1: 0x00, p2: 0x00, data: data, le: 200, reply: {
                                (data: NSData?, sw: UInt16, error: NSError?) in
                                if (error != nil)
                                {
                                    print("sendIns error:", error!)
                                }
                                else
                                {
                                    print("Response:", data!, String(sw, radix: 16))
                                    let newString = NSString(bytes: data!.bytes, length: data!.length, encoding: NSASCIIStringEncoding)
                                    print(newString!)
                                }
                            })
                        }
                    })
                }
                else
                {
                    print("Session error:", error)
                }
            })
        }
        else
        {
            print("No card found")
        }
    })
    
    // wait for the asynchronous blocks to finish
    sleep(1)

    Output

    slotName: Gemalto PC Twin Reader
    Response: <> 9000
    Response: <48656c6c 6f20776f 726c6421> 9000
    Hello world!
    

    Comments

    See the previous article "PCSC sample in Objective-C" for comments about the Crypto Token Kit API.

    Swift may be easier to learn and use than Objective-C. Using the Crypto Token Kit API is not different if you use Objective-C or Swift.

    It looks like I am the first to provide a public code sample using the Crypto Token Kit API in Swift. Great! I hope that is a good Swift sample, I am not a Swift expert.

    Conclusion

    As I wrote in "PCSC framework will stay in Mac OS X 10.11 El Capitan" the PC/SC API is not available from Swift. So the only option (for now) to use a smart card from Swift is to use the Crypto Token Kit API.

    [Update 5 Oct 2015]

    The sample code was not correct in the error treatment.

    I then discovered that if the card returns an "error" code then the sendIns method returns an error in the error parameter. Here is the execution output of the program with a card that does not contain the applet:
    slotName: Gemalto PC Twin Reader
    sendIns error: Error Domain=CryptoTokenKit Code=-3 "SmartCard returned error 6a82" UserInfo=0x600000060940 {NSLocalizedDescription=SmartCard returned error 6a82}
    The card returns 0x6A82 (Wrong parameter(s) P1-P2, File not found) in SW (Status Word).

    It may be difficult to differentiate errors at the card/reader communication level from "errors" returned  by the card.  A SW different from 0x9000 may be completely valid and expected by the application in some cases.

    Friday, September 25, 2015

    PCSC sample in Objective-C

    To continue the list of PC/SC wrappers initiated in 2010 with "PC/SC sample in different languages" I now present a sample in Objective-C using the Apple Crypto Token Kit API.

    Crypto Token Kit API

    In Yosemite (Mac OS X 10.10) Apple introduced a new API to access smart cards. See OS X Yosemite and smart cards status.
    This API is not a wrapper above PC/SC. It is the native API to be used on Mac OS X. You do not need to install it, it comes with the OS.

    Source code

    Create a new Cocoa application in Xcode. You need to enable the App Sandbox and add/set the com.apple.security.smartcard entitlement to yes.

    My sample HellloWorld application does not use Cocoa. It is a text only application.


    #import <CryptoTokenKit/CryptoTokenKit.h>
    
    int main(int argc, const char * argv[])
    {
        TKSmartCardSlotManager * mngr;
        mngr = [TKSmartCardSlotManager defaultManager];
        
        // Use the first reader/slot found
        NSString *slotName = (NSString *)mngr.slotNames[0];
        NSLog(@"slotName: %@", slotName);
        
        // connect to the slot
        [mngr getSlotWithName:slotName reply:^(TKSmartCardSlot *slot)
         {
             // connect to the card
             TKSmartCard *card = [slot makeSmartCard];
             if (card)
             {
                 // begin a session
                 [card beginSessionWithReply:^(BOOL success, NSError *error)
                  {
                      if (success)
                      {
                          // send 1st APDU
                          uint8_t aid[] = {0xA0, 0x00, 0x00, 0x00, 0x62, 0x03, 0x01, 0x0C, 0x06, 0x01};
                          NSData *data = [NSData dataWithBytes: aid length: sizeof aid];
                          [card sendIns:0xA4 p1:0x04 p2:0x00 data:data le:nil
                                  reply:^(NSData *replyData, UInt16 sw, NSError *error)
                           {
                               if (error)
                               {
                                   NSLog(@"sendIns error: %@", error);
                               }
                               else
                               {
                                   NSLog(@"Response: %@ 0x%04X", replyData, sw);
    
                                   // send 2nd APDU
                                   NSData *data = [NSData dataWithBytes: nil length: 0];
                                   [card sendIns:0x00 p1:0x00 p2:0x00 data:data le:@200
                                           reply:^(NSData *replyData, UInt16 sw, NSError *error)
                                    {
                                        if (error)
                                        {
                                            NSLog(@"sendIns error: %@", error);
                                        }
                                        else
                                        {
                                            NSLog(@"Response: %@ 0x%04X", replyData, sw);
                                            NSString *newString = [[NSString alloc] initWithData:replyData encoding:NSASCIIStringEncoding];
                                            NSLog(@"%@", newString);
                                        }
                                    }];
                               }
                           }];
                      }
                      else
                      {
                          NSLog(@"Session error: %@", error);
                      }
                  }];
             } else
             {
                 NSLog(@"No card found");
             }
         }];
        
        // wait for the asynchronous blocks to finish
        sleep(1);
        
        return 0;
    }
    


    Output

    2015-09-25 14:24:19.552 HelloWorld[1578:141676] slotName: Gemalto PC Twin Reader
    2015-09-25 14:24:19.668 HelloWorld[1578:141740] Response: <> 0x9000
    2015-09-25 14:24:19.681 HelloWorld[1578:141740] Response: <48656c6c 6f20776f 726c6421> 0x9000
    2015-09-25 14:24:19.681 HelloWorld[1578:141740] Hello world!
    

    Comments

    The method SendIns is asynchronous. The result is executed in a block. It is similar to a callback in the JavaScript example PCSC sample in JavaScript (Node.js).

    With the method SendIns you do not specify the class byte. If needed you can use the lower level transmitRequest method instead.

    The method SendIns takes a parameter that contains the data sent to the card. I get a compiler warning if I use nil to indicate that I have no data to transmit. I have to create a NSData structure of 0 bytes and use it as argument. It is perfectly valid to send no data and the API should allow a simpler code.

    My code is a very simple example. The code does not explicitly wait for the asynchronous blocks to finish. I use sleep(1) instead. Without this delay the main function would return before the asynchronous blocks are executed.

    Conclusion

    I have seen very few source codes using this new Crypto Token Kit API one year after it is available.
    The only API documentation I found is comments contained in the .h header files with no sample code. That does not help.

    Maybe the situation will evolve with El Capitan (Mac OS X 10.11) that should be available in the next few days.

    [UPDATE 26 Sept 2015]

    It is in fact possible to specify the class byte CLA of an APDU. This byte is stored in the cla property of the TKSmartCard class. The default value is 0x00.

    [UPDATE 31 March 2017]

    See also ""PC/SC" sample in Objective-C (synchronous)".

    Wednesday, September 2, 2015

    Reader Selection: find the smart card reader you search

    I now provide a web interface to access and filter the amazing list of 353 readers supported by my CCID driver.

    Filter

    You can filter the list using any field from the USB CCID descriptor. I presented each field from the descriptor in the articles "CCID descriptor statistics" in 2013 and 2014.

    It is also possible to filter using the "features" field. This field is not available from the descriptor. It documents the features of the reader, like "contactless".

    Combination of filters

    It is possible to filter the results according to more than one field. The result is a AND combination. The readers must match according to field1 AND according to field2.

    Demo

    The web site is available at https://ccid.apdu.fr/select_readers/

    By default no filer is used and you get the complete list of 353 readers.


    Add a filter

    To add a filer click on the "Add a match on..." drop down menu and select a field. For example "iManufacturer".
    Then enter a manufacturer name like "NXP" in the value field.

    Change the relation operator

    You can use different relation operators:
    • = strict equality (for number or string)
    • ~ match the head of a string
    • ≤ lesser or equal
    • ≥ greater or equal
    For example you can use the relation "~" with the value "a" and you get all the readers with the iManufacturer field starting with "a" or "A".

    Share your results

    You can share your selection by clicking on the "Get URL" button. A link will be displayed. Just use this URL and you will get the same selection again.

    Examples:

    Source code

    The Javascript + HTML source code is available at https://anonscm.debian.org/cgit/pcsclite/website.git/tree/select_readers.

    The code is Free Software and licensed under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

    The project uses Bootstrap and jQuery.

    Conclusion

    Please propose new ideas, user experience improvements, design modifications, bug fixes, etc.
    You can use the MUSCLE list for discussion.