Guidance (archived)

EssentialPIM is a good alternative for Personal Information Manager tool.

Good:

• Combined set of tools:
  • appointments, tasks, notes, contacts, password entries and email messages
• password protected tool
• possible to import contacts etc.
• possible to synchronize with android via own application

Bad:

• Slow’ish operation sometimes (database)

The figure below shows Calendar view. In the free edition, repetitive tasks (todo) are not enabled, but one can use calendar for the same purpose. In this case a reminder for the “Lotto”.

The above mentioned tools are available even in the free edition. By surpise, it seems that tree structure is supported in the Notes. In the figure below some text and figure is copied from wikipedia.

Tips

With free edition one cannot synchronize with outlook (pro version is needed). There are 2 alternatives to transfer Contacts from Outlook into EssentialPIM

• Alternative 1:
  • Export contacts in outlook as individual vcf files, in Actions menu: Forward as vCard
  • Import, in EssentialPIM, use File:Import:Contacts:vCard
• Alternative 2:
  • Export contacts and other data in outlook inside pst file
    • File->New->Outlook Data File
      • for example test.pst
    • Select this pst file inside Outlook, and Create new folder with type Contact
      • for example name “PersonalContacts”
    • Select “Contacts” menu in Outlook, and now the “PersonalContacts in test” is visbile under “My Contacts”
    • Copy your contacts into this new contact list (“PersonalContacts”)
    • Close test.pst
  • Import, in EssentialPIM, use File:Import:Outlook

Note!

I have categorized this in the Advanced Tools, because at the same time as it can facilitate the tasks, at the same time it can be more risky, if backups are not taken regularly. And care is need in order not to blowup the tool with information. For example, for notes one could use another instance, or another tool like keynote NF. And for passwords, one could use Keepass. But all in all, use with care since a lot of information in one place…

At OpenSC page:

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures.

OpenSC implements the PKCS#11 API.

On the card OpenSC implements the PKCS#15 standard (file structure).

Good:

• Support many smart cards
• • National ID Cards
  • Generic smart cards
  • • Cryptoflex, MyEID, STARCOS
  • USB Tokens

To improve:

• Man pages are out of date
• • Use build-in help pages

Opensc command examples

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --list-readers
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Generic Smart Card Reader Interface 0

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --reader 0 --atr
3b:f5:18:00:00:81:31:fe:45:4d:79:45:49:44:9a

Logging is available via -v parameter

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-tool --reader 0 --name -v
Connecting to card in reader Generic Smart Card Reader Interface 0...
Using c         ard driver MyEID cards with PKCS#15 applet.
Card name: MyEID cards with PKCS#15 applet

PKCS11 examples

Retrieving information

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --show-info
Cryptoki version 2.11
Manufacturer     Fujitsu Services Oy
Library          mPollux DigiSign Client (ver 0.1)
Using slot 0 with a present token (0x2021880)


C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --list-mechanisms
Using slot 0 with a present token (0x1fdfa70)
Supported mechanisms:
  MD5, digest
  SHA-1, digest
  RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  MD5-RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  SHA1-RSA-PKCS, keySize={1024,4096}, hw, encrypt, decrypt, sign, verify
  RSA-PKCS-KEY-PAIR-GEN, keySize={1024,4096}, hw, generate_key_pair


C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module "C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Crypt
oki.dll" --list-objects
Using slot 0 with a present token (0x20afab0)
Private Key Object; RSA
  label:      Encryption key [kx00]
  ID:         45
  Usage:      decrypt, sign, unwrap
Public Key Object; RSA 1024 bits
  label:      Encryption key [kx00]
  ID:         45
  Usage:      none
Certificate Object, type = X.509 cert
  label:      Encryption certificate for key (69) [kxc00]
  ID:         45

PKCS15 examples

Erasing the MyEID card

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs15-init -E -T
Using reader with a card: Generic Smart Card Reader Interface 0
PIN [Security Officer PIN] required.
Please enter PIN [Security Officer PIN]:

To browse PKCS15 file structure, after card was initiated with vendor tool (MyEID)

C:\Program Files\OpenSC Project\OpenSC\tools>opensc-explorer
OpenSC Explorer version 0.12.2-rc1
Using reader with a card: Generic Smart Card Reader Interface 0
OpenSC [3F00]> ls
FileID  Type  Size
[5015]    DF 32767      Name: \xA0\x00\x00\x00cPKCS-15
OpenSC [3F00]> info 5015

Dedicated File  ID 5015

File path:     3F00/5015
File size:     32767 bytes
DF name:       \xA0\x00\x00\x00cPKCS-15
ACL for SELECT:       N/A
ACL for LOCK:         N/A
ACL for DELETE:       NEVR
ACL for CREATE:       CHV3
ACL for REHABILITATE: N/A
ACL for INVALIDATE:   N/A
ACL for LIST FILES:   N/A
ACL for CRYPTO:       N/A
ACL for DELETE SELF:  N/A
Proprietary attributes:  00 02
Security attributes:     33 FF FF

OpenSC [3F00]> cd ..
unable to go up, already in MF.
OpenSC [3F00]> cd 5015
OpenSC [3F00/5015]> ls
FileID  Type  Size
OpenSC [3F00/5015]>

Other commands

opensc-tool –reader 0 –list-drivers
opensc-tool –reader 0 –serial
opensc-tool –list-algorithms
pkcs15-tool –list-keys
pkcs15-tool –list-certificates
pkcs15-tool –list-pins
pkcs15-tool –dump

Frequently asked questions

• PKCS#11 is a software API for accessing cryptographic hardware like smart cards or HSMs
• PKCS#15 is a format of on-card structures that defines a “filesystem layout” for smart cards.

Links

• Security Considerations
• • including opensc.conf settings
• Degugging
• Installing OpenSC and initializing the smartcard
• • with steps and environment variable setting, erase and initialize command and warning of loosing private key, if stored only on smart card

In XCA home page:

X Certificate and Key management: This application is intended for creating and managing X.509 certificates, certificate requests, RSA, DSA and EC private keys, Smartcards and CRLs. Everything that is needed for a CA is implemented. It uses the OpenSSL library for the cryptographic operations.

Good:

• Smart-Cards via PKCS#11 interface

In the figure below, the root private key of CA has been created and used for CA self signed root. The keys and certificates are stored in “test.xdb” database file.

In the figure below, the root private key of CA has been created on the Smart Card and used for CA self signed root. The root key on Smart Card is protected by PIN. The other keys and certificates are stored in “XCA-aventra.xdb” database file.

Tips

• Protect your xdb file
• XCA is using OpenSC to access smart card via PKCS11. In menu File->Options, one can add vendor specific PKCS11 Provider. In case of Aventra MyEID smart card, one can use “C:\Program Files\Fujitsu Services\ActiveSecurity MyClient\Cryptoki.dll”.

Links

• Good “Step by step” flows, found via google search…
  • Using XCA to configure the OpenVPN PKI part as an alternative to OpenVPN’s easy-rsa
  • How to manage X509 certificates with XCA for their correct implementation in Panda GateDefender Integra
  • http://www2.lancom.de/kb.nsf/1276/B59D0CA49EBD3559C12578FF003210B2?OpenDocument