OpenSC, Tool for Smart Cards

At OpenSC page:

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures.

OpenSC implements the PKCS#11 API.

On the card OpenSC implements the PKCS#15 standard (file structure).

Good:

Support many smart cards
- National ID Cards
- Generic smart cards
- - Cryptoflex, MyEID, STARCOS
- USB Tokens

To improve:

Man pages are out of date
- Use build-in help pages

Opensc command examples

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --list-readers
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Generic Smart Card Reader Interface 0

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --reader 0 --atr
3b:f5:18:00:00:81:31:fe:45:4d:79:45:49:44:9a

Logging is available via -v parameter

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --reader 0 --name -v
Connecting to card in reader Generic Smart Card Reader Interface 0...
Using c         ard driver MyEID cards with PKCS#15 applet.
Card name: MyEID cards with PKCS#15 applet

PKCS11 examples

Retrieving information

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --show-info
Cryptoki version 2.11
Manufacturer     Fujitsu Services Oy
Library          mPollux DigiSign Client (ver 0.1)
Using slot 0 with a present token (0x2021880)


C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --list-mechanisms
Using slot 0 with a present token (0x1fdfa70)
Supported mechanisms:
  MD5, digest
  SHA-1, digest
  RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  MD5-RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  SHA1-RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  RSA-PKCS-KEY-PAIR-GEN, keySize={1024,4096}, hw, generate_key_pair


C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --list-objects
Using slot 0 with a present token (0x20afab0)
Private Key Object; RSA
  label:      Encryption key [kx00]
  ID:         45
  Usage:      decrypt, sign, unwrap
Public Key Object; RSA 1024 bits
  label:      Encryption key [kx00]
  ID:         45
  Usage:      none
Certificate Object, type = X.509 cert
  label:      Encryption certificate for key (69) [kxc00]
  ID:         45

PKCS15 examples

Erasing the MyEID card

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs15-init -E -T
Using reader with a card: Generic Smart Card Reader Interface 0
PIN [Security Officer PIN] required.
Please enter PIN [Security Officer PIN]:

To browse PKCS15 file structure, after card was initiated with vendor tool (MyEID)

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-explorer
OpenSC Explorer version 0.12.2-rc1
Using reader with a card: Generic Smart Card Reader Interface 0
OpenSC [3F00]> ls
FileID  Type  Size
[5015]    DF 32767      Name: \xA0\x00\x00\x00cPKCS-15
OpenSC [3F00]> info 5015

Dedicated File  ID 5015

File path:     3F00/5015
File size:     32767 bytes
DF name:       \xA0\x00\x00\x00cPKCS-15
ACL for SELECT:       N/A
ACL for LOCK:         N/A
ACL for DELETE:       NEVR
ACL for CREATE:       CHV3
ACL for REHABILITATE: N/A
ACL for INVALIDATE:   N/A
ACL for LIST FILES:   N/A
ACL for CRYPTO:       N/A
ACL for DELETE SELF:  N/A
Proprietary attributes:  00 02
Security attributes:     33 FF FF

OpenSC [3F00]> cd ..
unable to go up, already in MF.
OpenSC [3F00]> cd 5015
OpenSC [3F00/5015]> ls
FileID  Type  Size
OpenSC [3F00/5015]>

Other commands

opensc-tool –reader 0 –list-drivers
opensc-tool –reader 0 –serial
opensc-tool –list-algorithms
pkcs15-tool –list-keys
pkcs15-tool –list-certificates
pkcs15-tool –list-pins
pkcs15-tool –dump

Frequently asked questions

PKCS#11 is a software API for accessing cryptographic hardware like smart cards or HSMs
PKCS#15 is a format of on-card structures that defines a “filesystem layout” for smart cards.

Links

Security Considerations
- including opensc.conf settings
Degugging
Installing OpenSC and initializing the smartcard
- with steps and environment variable setting, erase and initialize command and warning of loosing private key, if stored only on smart card

Categories

Meta

Quotes