rebuilt documentation
This commit is contained in:
145
docs/_sources/ACardEmulator/README.txt
Normal file
145
docs/_sources/ACardEmulator/README.txt
Normal file
@@ -0,0 +1,145 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. |HCE| replace:: :abbr:`HCE (host card emulation)`
|
||||
|
||||
.. _acardemulator:
|
||||
|
||||
################################################################################
|
||||
Android Smart Card Emulator
|
||||
################################################################################
|
||||
|
||||
.. sidebar:: Summary
|
||||
|
||||
Use an Android phone as contact-less smart card
|
||||
|
||||
:Author:
|
||||
`Frank Morgner <frankmorgner@gmail.com>`_
|
||||
:License:
|
||||
GPL version 3
|
||||
:Tested Platform:
|
||||
Android, CyanogenMod
|
||||
|
||||
The Android Smart Card Emulator allows the emulation of a contact-less smart card.
|
||||
The emulator uses Android's |HCE| to fetch APDUs from a contact-less reader.
|
||||
The app allows to process the Command APDUs either by delegating them to a
|
||||
remote virtual smart card or by a built-in Java Card simulator. The response
|
||||
APDUs are then returned to the smart card reader.
|
||||
|
||||
With the built-in Java Card runtime of jCardSim_ the app includes the following
|
||||
Applets:
|
||||
|
||||
- `Hello World Applet`_ (application identifier ``F000000001``)
|
||||
- `OpenPGP Applet`_ (application identifier ``D2760001240102000000000000010000``)
|
||||
- `OATH Applet`_ (application identifier ``A000000527210101``)
|
||||
- `ISO Applet`_ (application identifier ``F276A288BCFBA69D34F31001``)
|
||||
- `GIDS Applet`_ (application identifier ``A000000397425446590201``)
|
||||
|
||||
The remote interface can be used together with the :ref:`vicc`, which allows
|
||||
emulating the following cards:
|
||||
|
||||
- Generic ISO-7816 smart card
|
||||
- German electronic identity card (nPA)
|
||||
- Electronic passport
|
||||
|
||||
You may also attach your own simulation to the remote interface by implementing
|
||||
a simple interface through a socket communication.
|
||||
|
||||
.. tikz:: Simulate a contact-less Java Card with Android Smart Card Emulator
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (reader) {\includegraphics[width=3cm]{%(wd)s/bilder/my_cardreader.pdf}};
|
||||
\node [below=0cm of reader, kleiner] {Contact-less Reader};
|
||||
\node (phone) [right=1cm of reader] {\includegraphics[width=3cm]{%(wd)s/bilder/smartphone.pdf}};
|
||||
\node (app) [at=(phone.center)] {\includegraphics[width=2.8cm, height=4.9cm]{%(wd)s/bilder/ACardEmulator.png}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\draw [rfid] (reader.center) -- (phone.west) ;
|
||||
\end{pgfonlayer}
|
||||
|
||||
.. tikz:: Simulate a contact-less smart card with a remote virtual smart card
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (reader) {\includegraphics[width=3cm]{%(wd)s/bilder/my_cardreader.pdf}};
|
||||
\node [below=0cm of reader, kleiner] {Contact-less Reader};
|
||||
\node (phone) [right=1cm of reader] {\includegraphics[width=3cm]{%(wd)s/bilder/smartphone.pdf}};
|
||||
\node (app) [at=(phone.center)] {\includegraphics[width=2.8cm, height=4.9cm]{%(wd)s/bilder/ACardEmulator.png}};
|
||||
\node (vicc) [aktivbox, right=2cm of phone, kleiner] {\texttt{vicc --reversed}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\draw [rfid] (reader.center) -- (phone.west) ;
|
||||
\path[linie] (phone) edge node {\includegraphics[width=1.5cm]{%(wd)s/bilder/simplecloud.pdf}} (vicc) ;
|
||||
\end{pgfonlayer}
|
||||
|
||||
The Android Smart Card Emulator has the following dependencies:
|
||||
|
||||
- NFC hardware built into the smartphone for |HCE|
|
||||
- Android 4.4 "KitKat" (or newer) or CyanogenMod 11 (or newer)
|
||||
- permissions for a data connection (communication with Virtual Smart Card) and
|
||||
for using NFC (communication to the reader); scanning the configuration via
|
||||
QR code requires permission to access the camera
|
||||
- Virtual Smart Card :ref:`installed on the host computer<vicc_install>` for
|
||||
using the remote interface
|
||||
|
||||
For emulating a contact-less smart card with a desktop or notebook, have a look at :ref:`pcsc-relay`.
|
||||
|
||||
Please note that the currently emulated applets are verifying the PIN by
|
||||
transmitting it without any protection between card and terminal. You may want
|
||||
to have a look at `Erik Nellesson's
|
||||
<http://sar.informatik.hu-berlin.de/research/publications/SAR-PR-2014-08/SAR-PR-2014-08_.pdf>`_
|
||||
`Virtual Keycard`_, which uses the PACE protocol for PIN verification.
|
||||
|
||||
|
||||
.. _acardemulator_install:
|
||||
|
||||
********************
|
||||
Download and Install
|
||||
********************
|
||||
|
||||
The Android Smart Card Emulator is available on F-Droid_.
|
||||
|
||||
.. qr code generated via http://www.qrcode-monkey.de
|
||||
|
||||
.. icon generated via https://romannurik.github.io/AndroidAssetStudio/icons-launcher.html#foreground.type=clipart&foreground.space.trim=0&foreground.space.pad=0.25&foreground.clipart=res%2Fclipart%2Ficons%2Fdevice_nfc.svg&foreColor=fdd017%2C0&crop=0&backgroundShape=hrect&backColor=ffffff%2C100&effects=shadow
|
||||
|
||||
.. image:: acardemu-qrcode.png
|
||||
:target: https://f-droid.org/repository/browse/?fdid=com.vsmartcard.acardemulator
|
||||
:alt: Android Smart Card Emulator on F-Droid
|
||||
:width: 265px
|
||||
:height: 265px
|
||||
|
||||
To manually compile the app you need to fetch the sources and initialize the
|
||||
submodules::
|
||||
|
||||
git clone https://github.com/frankmorgner/vsmartcard.git
|
||||
cd vsmartcard
|
||||
# fetch the applets that are in the submodules
|
||||
git submodule init
|
||||
git submodule update
|
||||
|
||||
We use `Android Studio`_ to build and deploy the application. Use
|
||||
:menuselection:`File --> Open` to select :file:`vsmartcard/ACardEmulator`.
|
||||
Attach your smartphone and choose :menuselection:`Run --> Run 'app'`.
|
||||
|
||||
|
||||
.. include:: questions.txt
|
||||
|
||||
|
||||
********************
|
||||
Notes and References
|
||||
********************
|
||||
|
||||
.. target-notes::
|
||||
|
||||
.. _jCardSim: http://www.jcardsim.org/
|
||||
.. _Hello World Applet: https://github.com/licel/jcardsim/blob/master/src/main/java/com/licel/jcardsim/samples/HelloWorldApplet.java
|
||||
.. _OpenPGP Applet: https://developers.yubico.com/ykneo-openpgp/
|
||||
.. _OATH Applet: https://developers.yubico.com/ykneo-oath/
|
||||
.. _ISO Applet: http://www.pwendland.net/IsoApplet/
|
||||
.. _GIDS Applet: https://github.com/vletoux/GidsApplet
|
||||
.. _Virtual Keycard: https://github.com/eriknellessen/Virtual-Keycard
|
||||
.. _F-Droid: https://f-droid.org/repository/browse/?fdid=com.vsmartcard.remotesmartcardreader.app
|
||||
.. _Android Studio: http://developer.android.com/sdk/installing/studio.html
|
||||
368
docs/_sources/ccid/README.txt
Normal file
368
docs/_sources/ccid/README.txt
Normal file
@@ -0,0 +1,368 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. |PACE| replace:: :abbr:`PACE (Password Authenticated Connection Establishment)`
|
||||
|
||||
.. _ccid-emulator:
|
||||
|
||||
################################################################################
|
||||
USB CCID Emulator
|
||||
################################################################################
|
||||
|
||||
.. sidebar:: Summary
|
||||
|
||||
Emulate a USB CCID compliant smart card reader
|
||||
|
||||
:Author:
|
||||
`Frank Morgner <frankmorgner@gmail.com>`_
|
||||
:License:
|
||||
GPL version 3
|
||||
:Tested Platforms:
|
||||
Linux (Debian, Ubuntu, OpenMoko)
|
||||
|
||||
The USB CCID Emulator forwards a locally present PC/SC smart card reader as a
|
||||
standard USB CCID reader. USB CCID Emulator can be used as trusted intermediary
|
||||
enabling secure PIN entry and PIN modification. In combination with OpenSC_
|
||||
also |PACE| can be performed by the emulator.
|
||||
|
||||
.. tikz:: Portable smart card reader with trusted user interface
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\tikzstyle{bla}=[kleiner, text width=.45\textwidth]
|
||||
|
||||
\node (reader)
|
||||
{\includegraphics[width=1cm]{%(wd)s/bilder/my_cardreader.pdf}};
|
||||
\node (readertext) [right=0of reader, bla]
|
||||
{Smartphone provides smart card reader via USB};
|
||||
\node (display) [below=0of reader]
|
||||
{\includegraphics[width=1cm]{%(wd)s/bilder/display.pdf}};
|
||||
\node (displaytext) [right=0of display, bla]
|
||||
{Secure display of service provider and purpose of transaction};
|
||||
\node (keyboard) [below=0of display]
|
||||
{\includegraphics[width=1cm]{%(wd)s/bilder/keyboard.pdf}};
|
||||
\node (keyboardtext) [right=0of keyboard, bla]
|
||||
{Secure PIN Entry};
|
||||
\node (firewall) [below=0of keyboard]
|
||||
{\includegraphics[width=1cm]{%(wd)s/bilder/Firewall.pdf}};
|
||||
\node (firewalltext) [right=0of firewall, bla]
|
||||
{Verification of terminal authentication and sanitiy checks};
|
||||
|
||||
\node (features) [fit=(display) (keyboard) (reader) (firewall)] {};
|
||||
|
||||
\node (moko) [left=0of features.west] {\includegraphics[height=4cm]{%(wd)s/bilder/phone-fic-neo-freerunner.pdf}};
|
||||
|
||||
\node (epa) [left=1.5of moko, yshift=-2cm]
|
||||
{\includegraphics[width=3cm]{%(wd)s/bilder/nPA_VS.png}};
|
||||
\node (pc) [left=1.5of moko, yshift=1.5cm]
|
||||
{\includegraphics[width=3cm]{%(wd)s/bilder/computer-tango.pdf}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
|
||||
\node (mokobox)
|
||||
[box,
|
||||
fit=(moko) (readertext) (displaytext) (keyboardtext) (firewalltext)
|
||||
(features)] {};
|
||||
|
||||
\draw [usb]
|
||||
(moko) -- (pc.center) ;
|
||||
\draw [decorate, decoration={expanding waves, angle=20, segment length=6}, nichtrundelinie]
|
||||
(moko) -- (epa) ;
|
||||
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
If the machine running :command:`ccid-emulator` is in USB device mode, a local
|
||||
reader is forwareded via USB to another machine. If in USB host mode, the USB
|
||||
CCID reader will locally be present.
|
||||
|
||||
Applications on Windows and Unix-like systems can access the USB CCID Emulator
|
||||
through PC/SC as if it was a real smart card reader. No installation of a smart
|
||||
card driver is required since USB CCID drivers are usually shipped with the
|
||||
modern OS.
|
||||
|
||||
Here is a subset of USB CCID commands supported by the USB CCID Emulator with
|
||||
their PC/SC counterpart:
|
||||
|
||||
================================== ============================================================
|
||||
USB CCID PC/SC
|
||||
================================== ============================================================
|
||||
``PC_to_RDR_XfrBlock`` ``SCardTransmit``
|
||||
``PC_to_RDR_Secure`` ``FEATURE_VERIFY_PIN_DIRECT``, ``FEATURE_MODIFY_PIN_DIRECT``
|
||||
``PC_to_RDR_Secure`` (proprietary) ``FEATURE_EXECUTE_PACE``
|
||||
================================== ============================================================
|
||||
|
||||
PIN verification/modification and |PACE| can also be started by the application
|
||||
transmitting (SCardTransmit) specially crafted APDUs. Only the alternative
|
||||
initialization of |PACE| using SCardControl requires patching the driver
|
||||
(available for libccid, see :file:`patches`). The pseudo APDUs with no need for
|
||||
patches are defined as follows (see `BSI TR-03119 1.3`_ p. 33-34):
|
||||
|
||||
+--------------------------+----------------------------------------------------------------------------+------------------------------------------------+
|
||||
| | Command APDU | Response APDU |
|
||||
| +----------+----------+----------+----------+--------------------------------+-----------------------------------+------------+
|
||||
| | CLA | INS | P1 | P2 | Command Data | Response Data | SW1/SW2 |
|
||||
+==========================+==========+==========+==========+==========+================================+===================================+============+
|
||||
| GetReaderPACECapabilities| ``0xFF`` | ``0x9A`` | ``0x04`` | ``0x01`` | (No Data) | ``PACECapabilities`` | |
|
||||
+--------------------------+----------+----------+----------+----------+--------------------------------+-----------------------------------+ ``0x9000`` |
|
||||
| EstablishPACEChannel | ``0xFF`` | ``0x9A`` | ``0x04`` | ``0x02`` | ``EstablishPACEChannelInput`` | ``EstablishPACEChannelOutput`` | or other |
|
||||
+--------------------------+----------+----------+----------+----------+--------------------------------+-----------------------------------+ in case of |
|
||||
| DestroyPACEChannel | ``0xFF`` | ``0x9A`` | ``0x04`` | ``0x03`` | (No Data) | (No Data) | an error |
|
||||
+--------------------------+----------+----------+----------+----------+--------------------------------+-----------------------------------+ |
|
||||
| Verify/Modify PIN | ``0xFF`` | ``0x9A`` | ``0x04`` | ``0x10`` | Coding as ``PC_to_RDR_Secure`` | Coding as ``RDR_to_PC_DataBlock`` | |
|
||||
+--------------------------+----------+----------+----------+----------+--------------------------------+-----------------------------------+------------+
|
||||
|
||||
The USB CCID Emulator is implemented using GadgetFS_. Some fragments of the source
|
||||
code are based on the GadgetFS example and on the source code of the OpenSC
|
||||
tools.
|
||||
|
||||
.. tikz:: Software stack of the USB CCID Emulator running on the OpenMoko Neo FreeRunner
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\tikzstyle{schicht}=[text width=5cm, align=right]
|
||||
\tikzstyle{fade down}=[path fading=south, color=huslateblue]
|
||||
|
||||
\node (kernel)
|
||||
[box, shape=rectangle split, rectangle split parts=3, kleiner]
|
||||
{Linux Kernel
|
||||
\nodepart{second}
|
||||
\footnotesize S3C24xx Controller Driver
|
||||
\nodepart{third}
|
||||
\footnotesize GadgetFS
|
||||
};
|
||||
|
||||
\node (ccid)
|
||||
[aktivbox, shape=rectangle split, rectangle split parts=2, below=of kernel]
|
||||
{CCID Emulator
|
||||
\nodepart{second}
|
||||
\texttt{usb}\qquad\texttt{ccid}
|
||||
};
|
||||
\draw [box] ($(ccid.text split)-(.05cm,0)$) -- ($(ccid.south)-(.05cm,0)$);
|
||||
|
||||
\node (opensc) [box, below=of ccid, kleiner] {OpenSC};
|
||||
|
||||
\node (controller) [klein, right=0of kernel.two east, schicht]
|
||||
{Driver for USB Controller};
|
||||
\node (gadget) [klein, right=0of kernel.three east, schicht]
|
||||
{Gadget Driver};
|
||||
\node (upper) [klein, right=0of kernel.three east, schicht, yshift=-1.75cm]
|
||||
{Upper Layers};
|
||||
|
||||
\tikzstyle{rechts}=[to path={-- ++(1,0) |- (\tikztotarget)}]
|
||||
\tikzstyle{links}=[to path={-- ++(-1,0) |- (\tikztotarget)}]
|
||||
\begin{pgfonlayer}{background}
|
||||
\path
|
||||
(ccid.two west) edge [links, linie] (kernel.three west)
|
||||
(ccid.two east) edge [rechts, linie] (opensc.east)
|
||||
;
|
||||
|
||||
\path [color=black!30]
|
||||
(controller.north east) edge +(-9,0)
|
||||
(gadget.north east) edge +(-9,0)
|
||||
(upper.north east) edge +(-9,0)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
\node [kleiner, anchor=east, text width=3cm]
|
||||
at ($($(ccid.two west)+(-3,0)$)!.5!(kernel.three west)$)
|
||||
{\color{hublue}
|
||||
\texttt{/dev/gadget/ep1-bulk}\\
|
||||
\texttt{/dev/gadget/ep2-bulk}\\
|
||||
\texttt{/dev/gadget/ep3-bulk}\\};
|
||||
|
||||
|
||||
Running the USB CCID Emulator has the following dependencies:
|
||||
|
||||
- Linux Kernel with GadgetFS_
|
||||
- OpenSC_
|
||||
|
||||
Whereas using the USB CCID Emulator on the host system as smart card reader only
|
||||
needs a usable PC/SC middleware with USB CCID driver. This is the case for most
|
||||
modern Windows and Unix-like systems by default.
|
||||
|
||||
.. tikz:: Implementation of a mobile smart card reader for the German ID card
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\tikzstyle{keks}=[to path={-- ++(.1,0) |- (\tikztotarget)}]
|
||||
|
||||
\tikzstyle{bla}=[shape=rectangle split, rectangle split parts=2,
|
||||
every text node part/.style={align=center, klein}, text width=7cm,
|
||||
every second node part/.style={kleiner}, inner sep=0pt]
|
||||
|
||||
\node (ccid-emulator)
|
||||
{\texttt{ccid-emulator}};
|
||||
|
||||
\node (basis) [below=3of ccid-emulator]
|
||||
{\includegraphics[keepaspectratio, height=2cm,
|
||||
width=2cm]{%(wd)s/bilder/moko/basisleser_plain_klein.png}};
|
||||
\node (basisbeschreibung) [below=0cm of basis, kleiner, text width=2cm]
|
||||
{Reiner SCT RFID basis};
|
||||
|
||||
\node (npa) [left=1.5of basis]
|
||||
{\includegraphics[keepaspectratio, height=3cm,
|
||||
width=3cm]{%(wd)s/bilder/nPA_VS.png}};
|
||||
\node (npabeschreibung) [below=0cm of npa, kleiner]
|
||||
{German identity card};
|
||||
|
||||
\node (funktionenchat) [right=.6cm of ccid-emulator.east, anchor=text west, bla]
|
||||
{
|
||||
PACE
|
||||
\nodepart{second}
|
||||
\begin{itemize}
|
||||
|
||||
\item Display CHAT
|
||||
\begin{itemize}
|
||||
\item Display context (eID/eSign)
|
||||
\item Display requested permissions
|
||||
\end{itemize}
|
||||
|
||||
\item Display certificate description
|
||||
\begin{itemize}
|
||||
\item Identification of service provider
|
||||
\item Display purpose of transaction
|
||||
\end{itemize}
|
||||
|
||||
\item Secure PIN entry
|
||||
\end{itemize}
|
||||
};
|
||||
\node (funktionenpace) [below=.5 of funktionenchat, bla]
|
||||
{
|
||||
Terminal Authentication
|
||||
\nodepart{second}
|
||||
\begin{itemize}
|
||||
\item Verify authenticy of terminal
|
||||
\item Check freshness of cv certificate
|
||||
\end{itemize}
|
||||
};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\node (box) [fit=(ccid-emulator) (basis) (basisbeschreibung)
|
||||
(funktionenchat) (funktionenpace), box, inner sep=.5cm] {};
|
||||
\node (boxbild) at (box.north west)
|
||||
{\includegraphics[keepaspectratio, height=1.5cm,
|
||||
width=1.5cm]{%(wd)s/bilder/moko/moko_reader.png}};
|
||||
\node [right=0cm of boxbild.east, yshift=.3cm]
|
||||
{Openmoko Neo FreeRunner};
|
||||
\end{pgfonlayer}
|
||||
|
||||
\node (a) [above=1of npa]
|
||||
{\includegraphics[keepaspectratio, height=3cm,
|
||||
width=3cm]{%(wd)s/bilder/computer-tango.pdf}};
|
||||
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path
|
||||
(ccid-emulator) edge [doppelpfeil] (basis)
|
||||
(basis) edge [rfid] (npa)
|
||||
(a.center) edge [usb] (ccid-emulator)
|
||||
(ccid-emulator.east) edge [pfeil, keks] (funktionenchat.text west)
|
||||
(ccid-emulator.east) edge [pfeil, keks] (funktionenpace.text west);
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
.. include:: download.txt
|
||||
|
||||
|
||||
.. include:: autotools.txt
|
||||
|
||||
|
||||
=================
|
||||
Hints on GadgetFS
|
||||
=================
|
||||
|
||||
To create a USB Gadget in both USB host and USB client mode, you need to load
|
||||
the kernel module :program:`gadgetfs`. Here is how to get a running version of
|
||||
GadgetFS on a Debian system (see also `OpenMoko Wiki`_)::
|
||||
|
||||
sudo apt-get install linux-source linux-headers-`uname -r`
|
||||
sudo tar xjf /usr/src/linux-source-*.tar.bz2
|
||||
cd linux-source-*/drivers/usb/gadget
|
||||
# build dummy_hcd and gadgetfs
|
||||
echo "KDIR := /lib/modules/`uname -r`/build" >> Makefile
|
||||
echo "PWD := `pwd`" >> Makefile
|
||||
echo "obj-m := dummy_hcd.o gadgetfs.o" >> Makefile
|
||||
echo "default: " >> Makefile
|
||||
echo -e "\t\$(MAKE) -C \$(KDIR) SUBDIRS=\$(PWD) modules" >> Makefile
|
||||
make
|
||||
# load GadgetFS with its dependencies
|
||||
sudo modprobe udc-core
|
||||
sudo insmod ./dummy_hcd.ko
|
||||
sudo insmod ./gadgetfs.ko default_uid=`id -u`
|
||||
# mount GadgetFS
|
||||
sudo mkdir /dev/gadget
|
||||
sudo mount -t gadgetfs gadgetfs /dev/gadget
|
||||
|
||||
On OpenMoko it is likely that you need to `patch your kernel
|
||||
<http://docs.openmoko.org/trac/ticket/2206>`_. If you also want to switch
|
||||
multiple times between :program:`gadgetfs` and :program:`g_ether`, `another
|
||||
patch is needed <http://docs.openmoko.org/trac/ticket/2240)>`_.
|
||||
|
||||
If you are using a more recent version of :program:`dummy_hcd` and get an error
|
||||
loading the module, you maybe want to check out `this patch
|
||||
<http://comments.gmane.org/gmane.linux.usb.general/47440>`_.
|
||||
|
||||
|
||||
===============
|
||||
Hints on OpenSC
|
||||
===============
|
||||
|
||||
USB CCID Emulator needs the OpenSC components to be
|
||||
installed (especially :file:`libopensc.so`). Here is an example of how to get
|
||||
the standard installation of OpenSC without |PACE|::
|
||||
|
||||
PREFIX=/tmp/install
|
||||
VSMARTCARD=$PWD/vsmartcard
|
||||
git clone https://github.com/frankmorgner/vsmartcard.git $VSMARTCARD
|
||||
cd $VSMARTCARD
|
||||
git submodule init
|
||||
git submodule update
|
||||
cd $VSMARTCARD/ccid/src/opensc
|
||||
autoreconf --verbose --install
|
||||
./configure --prefix=$PREFIX
|
||||
make install && cd -
|
||||
|
||||
Now :file:`libopensc.so` should be located in ``$PREFIX/lib``. Here is how to
|
||||
configure the USB CCID Emulator to use it::
|
||||
|
||||
cd $VSMARTCARD/ccid
|
||||
./configure --prefix=$PREFIX OPENSC_LIBS="-L$PREFIX/lib -lopensc"
|
||||
make install && cd -
|
||||
|
||||
|
||||
*****
|
||||
Usage
|
||||
*****
|
||||
|
||||
The USB CCID Emulator has various command line options to customize the appearance
|
||||
on the USB host. In order to run the USB CCID Emulator GadgetFS must be loaded
|
||||
and mounted. The USB CCID Emulator is compatible with the unix driver libccid_
|
||||
and the `Windows USB CCID driver`_. PIN commands are supported if implemented
|
||||
by the driver.
|
||||
|
||||
.. versionadded:: 0.7
|
||||
USB CCID Emulator now supports the boxing commands defined in `BSI TR-03119
|
||||
1.3`_.
|
||||
|
||||
|
||||
.. program-output:: ccid-emulator --help
|
||||
|
||||
|
||||
.. include:: questions.txt
|
||||
|
||||
|
||||
********************
|
||||
Notes and References
|
||||
********************
|
||||
|
||||
.. target-notes::
|
||||
|
||||
.. _`GadgetFS`: http://www.linux-usb.org/gadget/
|
||||
.. _`OpenSC`: https://github.com/frankmorgner/OpenSC
|
||||
.. _`libccid`: http://pcsclite.alioth.debian.org/ccid.html
|
||||
.. _`Windows USB CCID driver`: http://msdn.microsoft.com/en-us/windows/hardware/gg487509
|
||||
.. _`OpenMoko Wiki`: http://wiki.openmoko.org/wiki/Building_Gadget_USB_Module
|
||||
.. _`BSI TR-03119 1.3`: https://www.bsi.bund.de/DE/Publikationen/TechnischeRichtlinien/tr03119/index_htm.html
|
||||
98
docs/_sources/index.txt
Normal file
98
docs/_sources/index.txt
Normal file
@@ -0,0 +1,98 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. |vsmartcard| replace:: Virtual Smart Card Architecture
|
||||
|
||||
################################################################################
|
||||
Welcome to the |vsmartcard| documentation!
|
||||
################################################################################
|
||||
|
||||
Welcome to the |vsmartcard|. |vsmartcard| is an umbrella project for various
|
||||
projects concerned with the emulation of different types of smart card readers
|
||||
or smart cards themselves.
|
||||
|
||||
.. tikz:: The Virtual Smart Card Architecture connects different aspects of smart card handling
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\tikzstyle{bla}=[box, klein, rounded rectangle, inner sep=.3cm]
|
||||
\node (a) {};
|
||||
|
||||
\node[bla, above left=.5cm of a]
|
||||
(usb) {USB Terminal};
|
||||
|
||||
\node[bla, below left=.5cm of a]
|
||||
(nfc) {NFC Terminal};
|
||||
|
||||
\node[bla, rounded rectangle left arc=concave, above right=.5cm of a]
|
||||
(sc) {Real Smart Card};
|
||||
|
||||
\node[bla, rounded rectangle left arc=concave, below right=.5cm of a]
|
||||
(vsc) {Virtual Smart Card};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path[line width=.8cm,color=hublue!20]
|
||||
(a.mid) edge [out=180, in=0] (usb.center)
|
||||
edge [out=180, in=0] (nfc.center)
|
||||
edge [out=0, in=180] (sc.center)
|
||||
edge [out=0, in=180] (vsc.center)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
Currently the following projects are part of |vsmartcard|:
|
||||
|
||||
.. toctree::
|
||||
:titlesonly:
|
||||
|
||||
virtualsmartcard/README
|
||||
remote-reader/README
|
||||
ACardEmulator/README
|
||||
pcsc-relay/README
|
||||
ccid/README
|
||||
|
||||
.. toctree::
|
||||
:hidden:
|
||||
|
||||
npa/README
|
||||
|
||||
Looking for a feature the included programs do not offer? Want to extend the
|
||||
functionality of some library? Apart from requesting a new feature, you can
|
||||
have a look at these programming guides and try yourself:
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
virtualsmartcard/api
|
||||
|
||||
.. image:: https://img.shields.io/travis/frankmorgner/vsmartcard/master.svg?label=Travis%20CI%20build
|
||||
:target: https://travis-ci.org/frankmorgner/vsmartcard
|
||||
:alt: Travis CI Build Status Image
|
||||
|
||||
.. image:: https://img.shields.io/appveyor/ci/frankmorgner/vsmartcard/master.svg?label=AppVeyor%20build
|
||||
:target: https://ci.appveyor.com/project/frankmorgner/vsmartcard
|
||||
:alt: AppVeyor CI Build Status Image
|
||||
|
||||
.. image:: https://img.shields.io/coverity/scan/3987.svg?label=Coverity%20scan
|
||||
:target: https://scan.coverity.com/projects/3987
|
||||
:alt: Coverity Scan Status
|
||||
|
||||
|
||||
Download
|
||||
--------
|
||||
|
||||
You can download the latest release of the |vsmartcard| `here
|
||||
<https://github.com/frankmorgner/vsmartcard/releases>`_. Older releases are
|
||||
still available at the `old project
|
||||
location <http://sourceforge.net/projects/vsmartcard/files>`_.
|
||||
|
||||
Alternatively, you can clone our git repository::
|
||||
|
||||
git clone https://github.com/frankmorgner/vsmartcard.git
|
||||
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
.. bibliography:: references.bib
|
||||
:all:
|
||||
12
docs/_sources/npa/README.txt
Normal file
12
docs/_sources/npa/README.txt
Normal file
@@ -0,0 +1,12 @@
|
||||
.. meta::
|
||||
:http-equiv=refresh: 0;URL='https://github.com/frankmorgner/OpenSC'
|
||||
|
||||
######################
|
||||
nPA Smart Card Library
|
||||
######################
|
||||
|
||||
Access the German electronic identity card (neuer Personalausweis/nPA).
|
||||
|
||||
The functionality of nPA Smart Card Library has been integrated into
|
||||
OpenSC. Developement and Support will continue at our new home
|
||||
https://github.com/frankmorgner/OpenSC.
|
||||
301
docs/_sources/pcsc-relay/README.txt
Normal file
301
docs/_sources/pcsc-relay/README.txt
Normal file
@@ -0,0 +1,301 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. _pcsc-relay:
|
||||
|
||||
################################################################################
|
||||
PC/SC Relay
|
||||
################################################################################
|
||||
|
||||
.. sidebar:: Summary
|
||||
|
||||
Relay a smart card to a contactless interface
|
||||
|
||||
:Authors:
|
||||
- `Frank Morgner <frankmorgner@gmail.com>`_
|
||||
- `Dominik Oepen <oepen@informatik.hu-berlin.de>`_
|
||||
:License:
|
||||
GPL version 3
|
||||
:Tested Platforms:
|
||||
- Windows
|
||||
- Linux (Debian, Ubuntu, OpenMoko)
|
||||
|
||||
Welcome to PC/SC Relay. The purpose of PC/SC Relay is to relay a smart
|
||||
card using an contact-less interface. Currently the following contact-less
|
||||
emulators are supported:
|
||||
|
||||
- `Hardware supported by libnfc`_
|
||||
- OpenPICC_
|
||||
- :ref:`acardemulator`
|
||||
|
||||
Command APDUs are received with the contact-less interface and relayed. The
|
||||
Response APDUs are then sent back via RFID. The contact-less data will be
|
||||
relayed to one of the following:
|
||||
|
||||
- to a *real* smart card inserted into one of the systems' smart card readers.
|
||||
The smart card reader must be accessible with PC/SC. The smart card may be
|
||||
contact-based *or* contact-less.
|
||||
- to a :ref:`vicc` that directly connects to :command:`pcsc-relay`. The virtual
|
||||
smart card's native interface is used and (despite its name) PC/SC Relay
|
||||
does not need to access PC/SC in this case.
|
||||
|
||||
.. tikz:: Debug, Analyze and Emulate with PC/SC Relay
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (pcsc-relay) {\texttt{pcsc-relay}};
|
||||
|
||||
\node [kleiner, right=2cm of pcsc-relay, yshift=.9cm]
|
||||
(libnfc) {Libnfc Devices};
|
||||
\node [kleiner, right=2cm of pcsc-relay, yshift=.3cm]
|
||||
(openpicc) {OpenPICC};
|
||||
\node [kleiner, right=2cm of pcsc-relay, yshift=-.3cm]
|
||||
(vpcd) {Virtual Smart Card Reader};
|
||||
\node [kleiner, right=2cm of pcsc-relay, yshift=-.9cm]
|
||||
(acardemulator) {Android Smart Card Emulator};
|
||||
|
||||
\node [kleiner, left=2cm of pcsc-relay, yshift=.9cm]
|
||||
(contactbased) {Contact-based Smart Card};
|
||||
\node [kleiner, left=2cm of pcsc-relay, yshift=.3cm]
|
||||
(contactless) {Contact-less Smart Card};
|
||||
\node [kleiner, left=2cm of pcsc-relay, yshift=-.9cm]
|
||||
(remotereader) {Remote Smart Card Reader};
|
||||
\node [kleiner, left=2cm of pcsc-relay, yshift=-.3cm]
|
||||
(virtual) {Virtual Smart Card};
|
||||
|
||||
\node [above=.3cm of pcsc-relay, kleiner, xshift=1.2cm]
|
||||
(capdu) {Command APDU};
|
||||
\node [below=.3cm of pcsc-relay, kleiner, xshift=-1.2cm]
|
||||
(rapdu) {Response APDU};
|
||||
\draw (rapdu.east) edge [pfeil] +(1,0);
|
||||
\draw (capdu.west) edge [pfeil] +(-1,0);
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path[line width=.5cm,color=hublue!20]
|
||||
(pcsc-relay.mid) edge [out=180, in=0] (contactbased.east)
|
||||
edge [out=180, in=0] (contactless.east)
|
||||
edge [out=180, in=0] (virtual.east)
|
||||
edge [out=180, in=0] (remotereader.east)
|
||||
edge [out=0, in=180] (libnfc.west)
|
||||
edge [out=0, in=180] (openpicc.west)
|
||||
edge [out=0, in=180] (vpcd.west)
|
||||
edge [out=0, in=180] (acardemulator.west)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
With PC/SC Relay you can relay a contact-less or contact based smart card
|
||||
over a long distance. Also you can use it in combination with the :ref:`vicc`
|
||||
to completely emulate an ISO/IEC 14443 smart card.
|
||||
|
||||
.. tikz:: Emulate a contact-less German ID card to perform sanity checks
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\tikzstyle{bla}=[shape=rectangle split, rectangle split parts=2,
|
||||
every text node part/.style={align=center, klein}, text width=7cm,
|
||||
every second node part/.style={kleiner}, inner sep=0pt]
|
||||
|
||||
\tikzstyle{keks}=[to path={-- ++(.1,0) |- (\tikztotarget)}]
|
||||
|
||||
\node (touchatag)
|
||||
{\includegraphics[keepaspectratio, height=2cm,
|
||||
width=2cm]{%(wd)s/bilder/touchatag.png}};
|
||||
\node (touchatagbeschreibung) [below=0cm of touchatag, kleiner]
|
||||
{touchatag};
|
||||
|
||||
\node (pcsc-relay) [right=of touchatag]
|
||||
{\texttt{pcsc-relay}};
|
||||
\node (pcsc-relaybeschreibung) [below=0cm of pcsc-relay, kleiner]
|
||||
{NFC emulator
|
||||
};
|
||||
|
||||
\node (vicc) [right=of pcsc-relay]
|
||||
{\texttt{vicc -t nPA}};
|
||||
\node (viccbeschreibung) [below=0cm of vicc, kleiner]
|
||||
{nPA emulator};
|
||||
|
||||
\node (group) [fit=(touchatag) (pcsc-relay) (vicc) (touchatagbeschreibung)
|
||||
(pcsc-relaybeschreibung) (viccbeschreibung)] {};
|
||||
\node (funktionenchat) [below=0cm of group, bla]
|
||||
{
|
||||
PACE
|
||||
\nodepart{second}
|
||||
\begin{itemize}
|
||||
\item Display context (eID/eSign)
|
||||
\item Display requested permissions
|
||||
\end{itemize}
|
||||
};
|
||||
\node (funktionenpace) [below=.5 of funktionenchat, bla]
|
||||
{
|
||||
Terminal Authentication
|
||||
\nodepart{second}
|
||||
\begin{itemize}
|
||||
\item Verify authenticy of terminal
|
||||
\item Check freshness of cv certificate
|
||||
\item With certificate database
|
||||
\begin{itemize}
|
||||
\item Identification of service provider
|
||||
\item Display purpose of transaction
|
||||
\end{itemize}
|
||||
\end{itemize}
|
||||
};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\node (box) [fit=(touchatag) (pcsc-relay) (vicc) (touchatagbeschreibung)
|
||||
(pcsc-relaybeschreibung) (viccbeschreibung) (funktionenchat)
|
||||
(funktionenpace), box, inner sep=.5cm] {};
|
||||
\node (boxbild) at (box.north west)
|
||||
{\includegraphics[keepaspectratio, height=1.5cm,
|
||||
width=1.5cm]{%(wd)s/bilder/moko/moko_reader.png}};
|
||||
\node [right=0cm of boxbild.east, yshift=.3cm]
|
||||
{Openmoko Neo FreeRunner};
|
||||
\end{pgfonlayer}
|
||||
|
||||
\node (a) [left=1.5of box]
|
||||
{\includegraphics[keepaspectratio, height=4cm,
|
||||
width=4cm]{%(wd)s/bilder/ivak_kiosk-terminal.pdf}};
|
||||
\node (e) [below=0cm of a, text width=2.5cm, align=center]
|
||||
{(Public) Terminal};
|
||||
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path
|
||||
(touchatag) edge [doppelpfeil] (pcsc-relay)
|
||||
(pcsc-relay) edge [doppelpfeil] (vicc)
|
||||
(vicc.east) edge [keks, pfeil] (funktionenchat.text east)
|
||||
(vicc.east) edge [keks, pfeil] (funktionenpace.text east)
|
||||
(a) edge [decorate, decoration={expanding waves, angle=20, segment
|
||||
length=6}, nichtrundelinie] (touchatag.south west);
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
PC/SC Relay has the following dependencies:
|
||||
|
||||
- PC/SC middleware
|
||||
- libnfc_
|
||||
|
||||
|
||||
.. include:: relay-note.txt
|
||||
|
||||
|
||||
.. include:: download.txt
|
||||
|
||||
|
||||
.. include:: autotools.txt
|
||||
|
||||
|
||||
===============
|
||||
Hints on libnfc
|
||||
===============
|
||||
|
||||
Here is an example of how to get the standard
|
||||
installation of libnfc::
|
||||
|
||||
PREFIX=/tmp/install
|
||||
LIBNFC=libnfc
|
||||
git clone https://code.google.com/p/libnfc $LIBNFC
|
||||
cd $LIBNFC
|
||||
autoreconf -i
|
||||
# See `./configure --help` for enabling support of additional hardware
|
||||
./configure --prefix=$PREFIX
|
||||
make
|
||||
make install
|
||||
|
||||
Building PC/SC Relay with libnfc is done best using :command:`pkg-config`. The file
|
||||
:file:`libnfc.pc` should be located in ``$INSTALL/lib/pkgconfig``. Here is how to
|
||||
configure PC/SC Relay to use it::
|
||||
|
||||
./configure PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig
|
||||
|
||||
|
||||
====================================
|
||||
Hints on Android Smart Card Emulator
|
||||
====================================
|
||||
|
||||
The Android Smart Card Emulator is build around the host card emulation mode of
|
||||
Android 4.4 and later. This mode activates the app if the terminal issues a
|
||||
SELECT command with one of the app's application identifiers. The app registers
|
||||
for the following AIDs (:file:`ACardEmulator/app/src/main/res/xml/aid_list.xml`):
|
||||
|
||||
.. literalinclude:: ../../ACardEmulator/app/src/main/res/xml/aid_list.xml
|
||||
:language: xml
|
||||
:emphasize-lines: 8,12,16,20
|
||||
|
||||
If used together with PC/SC Relay you need to change these application
|
||||
identifiers to match the emulated card. Otherwise the app will not be activated
|
||||
when it should relay command APDUs to PC/SC Relay.
|
||||
|
||||
And while you are already modifying the Android Smart Card Emulator you may also
|
||||
want to activate `useVPCD` and change `hostname` and `port` to configure the
|
||||
connection to PC/SC Relay
|
||||
(:file:`ACardEmulator/app/src/main/java/com/vsmartcard/acardemulator/SimulatorService.java`):
|
||||
|
||||
.. literalinclude:: ../../ACardEmulator/app/src/main/java/com/vsmartcard/acardemulator/SimulatorService.java
|
||||
:language: java
|
||||
:lines: 47-52
|
||||
:emphasize-lines: 3,5-6
|
||||
|
||||
Compiling and installing Android Smart Card Emulator is covered in its :ref:`acardemulator_install` section.
|
||||
|
||||
|
||||
=========================
|
||||
Hints on PC/SC middleware
|
||||
=========================
|
||||
|
||||
A PC/SC middleware is included by default in most modern operating systems. On
|
||||
Unix-like systems (Linux, OS X, Sun OS) it is realized by PCSC-Lite_. To
|
||||
compile PC/SC Relay you will need to install the PCSC-Lite headers from
|
||||
your distribution.
|
||||
|
||||
Windows also ships with a PC/SC middleware in form of the Winscard module.
|
||||
PC/SC Relay can be (cross) compiled with MinGW-w64. Also, Microsoft's
|
||||
developement environment Visual Studio includes all necessary data for building
|
||||
PC/SC Relay.
|
||||
|
||||
|
||||
*****
|
||||
Usage
|
||||
*****
|
||||
|
||||
.. program-output:: pcsc-relay --help
|
||||
|
||||
Below we explain what option to choose for the emulator which receives a
|
||||
command APDU and transmits a response APDU back to the terminal:
|
||||
|
||||
=================================================== ==============
|
||||
Option ``--emulator``
|
||||
=================================================== ==============
|
||||
Emulation hardware supported via libnfc ``libnfc``
|
||||
Emulation with OpenPICC ``openpicc``
|
||||
Android Smart Card Emulator ``vpcd``
|
||||
Virtual Smart Card ``vpcd``
|
||||
=================================================== ==============
|
||||
|
||||
Below we explain what option to choose for the connector which calculates
|
||||
a response APDU from a given command APDU:
|
||||
|
||||
=================================================== ===============
|
||||
Option ``--connector``
|
||||
=================================================== ===============
|
||||
Contact-based Smart Card in PC/SC Reader ``pcsc``
|
||||
Contact-less Smart Card in PC/SC Reader ``pcsc``
|
||||
Contact-less Smart Card in Remote Smart Card Reader ``vicc``
|
||||
Virtual Smart Card ``vicc``
|
||||
=================================================== ===============
|
||||
|
||||
|
||||
.. include:: questions.txt
|
||||
|
||||
|
||||
********************
|
||||
Notes and References
|
||||
********************
|
||||
|
||||
.. target-notes::
|
||||
|
||||
.. _`Hardware supported by libnfc`: http://nfc-tools.org/index.php?title=Devices_compatibility_matrix
|
||||
.. _libnfc: http://www.libnfc.org/
|
||||
.. _OpenPICC: http://www.openpcd.org/OpenPICC
|
||||
.. _PCSC-lite: http://pcsclite.alioth.debian.org/
|
||||
135
docs/_sources/remote-reader/README.txt
Normal file
135
docs/_sources/remote-reader/README.txt
Normal file
@@ -0,0 +1,135 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. |vpcd| replace:: :abbr:`vpcd (virtual smart card reader)`
|
||||
|
||||
.. _remote-reader:
|
||||
|
||||
################################################################################
|
||||
Remote Smart Card Reader
|
||||
################################################################################
|
||||
|
||||
.. sidebar:: Summary
|
||||
|
||||
Use an Android phone as contact-less smart card reader
|
||||
|
||||
:Author:
|
||||
`Frank Morgner <frankmorgner@gmail.com>`_
|
||||
:License:
|
||||
GPL version 3
|
||||
:Tested Platform:
|
||||
Android, CyanogenMod
|
||||
|
||||
Allow a host computer to use the smartphone's NFC hardware as contact-less
|
||||
smartcard reader. On the host computer a special smart card driver, |vpcd|, must
|
||||
be installed. The app establishes a connection to |vpcd| over the network when a
|
||||
contact-less card is detected.
|
||||
|
||||
|
||||
.. tikz:: Remote Smart Card Reader used to access a contact-less card
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (pcsc) [klein, aktivbox, inner xsep=.75cm, align=center] {PC/SC\\Framework};
|
||||
\node (sca) [aktivbox, klein, left=.75cm of pcsc, align=center] {Smart Card\\Application};
|
||||
\node (vpcd) [box, at=(pcsc.east), kleiner] {\texttt{vpcd}};
|
||||
\node (phone) [right=2cm of vpcd] {\includegraphics[width=3cm]{%(wd)s/bilder/smartphone.pdf}};
|
||||
\node (app) [at=(phone.center)] {\includegraphics[width=2.8cm, height=4.9cm]{%(wd)s/bilder/remote-reader.png}};
|
||||
\node (card) [right=0cm of phone, rotate=45] {\includegraphics[width=2cm]{%(wd)s/bilder/smartcard.pdf}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\node (box) [box, fit=(pcsc) (sca) (vpcd), inner ysep=1.5em] {};
|
||||
\node [at=(box.north west)] {\includegraphics[width=1cm]{%(wd)s/bilder/computer-tango.pdf}};
|
||||
\path[linie]
|
||||
(sca) edge (pcsc)
|
||||
(vpcd) edge node {\includegraphics[width=1.5cm]{%(wd)s/bilder/simplecloud.pdf}} (app)
|
||||
;
|
||||
\draw [rfid] (phone.center) -- (card.center) ;
|
||||
\end{pgfonlayer}
|
||||
|
||||
The Remote Smart Card Reader has the following dependencies:
|
||||
|
||||
- NFC hardware built into the smartphone
|
||||
- Android 4.4 "KitKat" or CyanogenMod 11 (or newer)
|
||||
- permissions for a data connection (communication with |vpcd|) and for using
|
||||
NFC (communication to the card); scanning the configuration via QR code
|
||||
requires permission to access the camera
|
||||
- |vpcd| :ref:`installed on the host computer<vicc_install>`
|
||||
|
||||
For remotely accessing a traditional smart card reader on one computer from an
|
||||
other computer, the :ref:`vicc` in relay mode can be used:
|
||||
|
||||
.. tikz:: Virtual Smart Card used in relay mode to remotely access a card
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (pcsc) [klein, aktivbox, inner xsep=.75cm, align=center] {PC/SC\\Framework};
|
||||
\node (sca) [aktivbox, klein, left=.75cm of pcsc, align=center] {Smart Card\\Application};
|
||||
\node (vpcd) [box, at=(pcsc.east), kleiner] {\texttt{vpcd}};
|
||||
\node (pcsc2) [klein, aktivbox, inner xsep=.75cm, align=center, below=2.5cm of vpcd] {PC/SC\\Framework};
|
||||
\node (vicc) [aktivbox, left=1cm of pcsc2, kleiner] {\texttt{vicc -t relay}};
|
||||
\node (reader) [right=1cm of pcsc2] {\includegraphics[width=2cm]{%(wd)s/bilder/my_cardreader.pdf}};
|
||||
\node (card) [at=(reader.east), rotate=45] {\includegraphics[width=2cm]{%(wd)s/bilder/smartcard.pdf}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\node (box) [box, fit=(pcsc) (sca) (vpcd), inner ysep=1.5em] {};
|
||||
\node (box2) [box, fit=(vicc) (pcsc2), inner ysep=1.5em] {};
|
||||
\node [at=(box.north west)] {\includegraphics[width=1cm]{%(wd)s/bilder/computer-tango.pdf}};
|
||||
\node [at=(box2.north west)] {\includegraphics[width=1cm]{%(wd)s/bilder/computer-tango.pdf}};
|
||||
\path[linie]
|
||||
(sca) edge (pcsc)
|
||||
(vpcd) edge [out=south, in=north] node {\includegraphics[width=1.5cm]{%(wd)s/bilder/simplecloud.pdf}} (vicc)
|
||||
(vicc) edge (pcsc2)
|
||||
(pcsc2) edge [usb] (reader.center)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
|
||||
|
||||
.. include:: relay-note.txt
|
||||
|
||||
|
||||
********************
|
||||
Download and Install
|
||||
********************
|
||||
|
||||
The Remote Smart Card Reader is available on F-Droid_.
|
||||
|
||||
.. qr code generated via http://www.qrcode-monkey.de
|
||||
|
||||
.. icon generated via https://romannurik.github.io/AndroidAssetStudio/icons-launcher.html#foreground.type=clipart&foreground.space.trim=0&foreground.space.pad=0.25&foreground.clipart=res%2Fclipart%2Ficons%2Fnotification_tap_and_play.svg&foreColor=fdd017%2C0&crop=0&backgroundShape=hrect&backColor=ffffff%2C100&effects=shadow
|
||||
|
||||
.. image:: remote-reader-qrcode.png
|
||||
:target: https://f-droid.org/repository/browse/?fdid=com.vsmartcard.remotesmartcardreader.app
|
||||
:alt: Remote Smart Card Reader on F-Droid
|
||||
:width: 265px
|
||||
:height: 265px
|
||||
|
||||
To manually compile the app you need to fetch the sources::
|
||||
|
||||
git clone https://github.com/frankmorgner/vsmartcard.git
|
||||
|
||||
We use `Android Studio`_ to build and deploy the application. Use
|
||||
:menuselection:`File --> Open` to select :file:`vsmartcard/remote-reader`.
|
||||
Attach your smartphone and choose :menuselection:`Run --> Run 'app'`.
|
||||
|
||||
On the host system, where the smart card at the phone's NFC interface is relayed to,
|
||||
|vpcd| needs to be installed. It can be installed on Windows and Unix. On the
|
||||
host computer, :command:`vpcd-config` prints a QR code to configure the Remote
|
||||
Smart Card Reader. Scan the configuration with the bar code scanner of your
|
||||
choice.
|
||||
|
||||
|
||||
.. include:: questions.txt
|
||||
|
||||
|
||||
********************
|
||||
Notes and References
|
||||
********************
|
||||
|
||||
.. target-notes::
|
||||
|
||||
.. _OpenSC: https://github.com/OpenSC/OpenSC
|
||||
.. _Android Studio: http://developer.android.com/sdk/installing/studio.html
|
||||
.. _F-Droid: https://f-droid.org/repository/browse/?fdid=com.vsmartcard.remotesmartcardreader.app
|
||||
341
docs/_sources/virtualsmartcard/README.txt
Normal file
341
docs/_sources/virtualsmartcard/README.txt
Normal file
@@ -0,0 +1,341 @@
|
||||
.. highlight:: sh
|
||||
|
||||
.. |vpicc| replace:: :abbr:`vpicc (virtual smart card)`
|
||||
.. |vpcd| replace:: :abbr:`vpcd (virtual smart card reader)`
|
||||
.. |BAC| replace:: :abbr:`BAC (Basic Access Control)`
|
||||
.. |PACE| replace:: :abbr:`PACE (Password Authenticated Connection Establishment)`
|
||||
.. |TA| replace:: :abbr:`TA (Terminal Authenticatation)`
|
||||
.. |CA| replace:: :abbr:`CA (Chip Authentication)`
|
||||
.. |EAC| replace:: :abbr:`EAC (Extended Access Control)`
|
||||
|
||||
.. _vicc:
|
||||
|
||||
################################################################################
|
||||
Virtual Smart Card
|
||||
################################################################################
|
||||
|
||||
.. sidebar:: Summary
|
||||
|
||||
Smart card emulator written in Python
|
||||
|
||||
:Authors:
|
||||
- `Frank Morgner <frankmorgner@gmail.com>`_
|
||||
- `Dominik Oepen <oepen@informatik.hu-berlin.de>`_
|
||||
:License:
|
||||
GPL version 3
|
||||
:Tested Platforms:
|
||||
- Windows
|
||||
- Mac OS X
|
||||
- Linux (Debian, Ubuntu, OpenMoko)
|
||||
|
||||
Virtual Smart Card emulates a smart card and makes it accessible through PC/SC.
|
||||
Currently the Virtual Smart Card supports the following types of smart cards:
|
||||
|
||||
- Generic ISO-7816 smart card including secure messaging
|
||||
- German electronic identity card (nPA) with complete support for |EAC|
|
||||
(|PACE|, |TA|, |CA|)
|
||||
- Electronic passport (ePass/MRTD) with support for |BAC|
|
||||
- Cryptoflex smart card (incomplete)
|
||||
|
||||
The |vpcd| is a smart card reader driver for PCSC-Lite_ and the windows smart
|
||||
card service. It allows smart card applications to access the |vpicc| through
|
||||
the PC/SC API. By default |vpcd| opens slots for communication with multiple
|
||||
|vpicc|'s on localhost on port 35963 and port 35964. But the |vpicc| does not
|
||||
need to run on the same machine as the |vpcd|, they can connect over the
|
||||
internet for example.
|
||||
|
||||
Although the Virtual Smart Card is a software emulator, you can use
|
||||
:ref:`pcsc-relay` to make it accessible to an external contact-less smart card
|
||||
reader.
|
||||
|
||||
The file :file:`utils.py` was taken from Henryk Plötz's cyberflex-shell_.
|
||||
|
||||
.. tikz:: Virtual Smart Card used with PCSC-Lite or WinSCard
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (pcsclite)
|
||||
[klein, aktivbox, inner xsep=.7cm, text width=3cm]
|
||||
{PC/SC Framework\\\
|
||||
(\texttt{pcscd} or \texttt{SCardSvr})
|
||||
};
|
||||
\node (sca) [aktivbox, klein, left=of pcsclite] {Smart Card\\Application};
|
||||
\node (vpcd) [box, at=(pcsclite.east), xshift=-.3cm] {\texttt{vpcd}};
|
||||
\node (vicc) [aktivbox, right=2cm of pcsclite] {\texttt{vicc}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path[linie]
|
||||
(sca) edge (pcsclite)
|
||||
(vpcd) edge node {\includegraphics[width=1.2cm]{%(wd)s/bilder/simplecloud.pdf}} (vicc)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
.. versionadded:: 0.7
|
||||
The Virtual Smart Card optionally brings its own standalone implementation of
|
||||
PC/SC. This allows accessing |vpicc| without PCSC-Lite. Our PC/SC
|
||||
implementation acts as replacement for ``libpcsclite`` which can lead to
|
||||
problems when used in parallel with PCSC-Lite.
|
||||
|
||||
.. tikz:: Virtual Smart Card used with its own PC/SC implementation
|
||||
:stringsubst:
|
||||
:libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows
|
||||
|
||||
\input{%(wd)s/bilder/tikzstyles.tex}
|
||||
\node (pcsclite)
|
||||
[klein, box, text width=4cm]
|
||||
{Virtual Smart Card's\\
|
||||
PC/SC Framework
|
||||
};
|
||||
\node (sca) [aktivbox, klein, left=of pcsclite] {Smart Card\\Application};
|
||||
\node (vicc) [aktivbox, right=2cm of pcsclite] {\texttt{vicc}};
|
||||
|
||||
\begin{pgfonlayer}{background}
|
||||
\path[linie]
|
||||
(sca) edge (pcsclite)
|
||||
(pcsclite) edge node {\includegraphics[width=1.5cm]{%(wd)s/bilder/simplecloud.pdf}} (vicc)
|
||||
;
|
||||
\end{pgfonlayer}
|
||||
|
||||
On Android, where a traditional PC/SC framework is not available, you can use
|
||||
our framework to make your real contact-less smart accessible through PKCS#11.
|
||||
For example, an email signing application can use the PKCS#11 interface of
|
||||
OpenSC, which is linked against our PC/SC implementation. Then an Android App
|
||||
(e.g. :ref:`remote-reader`) can connect as |vpicc| delegating all requests and
|
||||
responses via NFC to a contact-less smart card that signs the mail.
|
||||
|
||||
Depending on your usage of the |vpicc| you may need to install the following:
|
||||
|
||||
- Python_
|
||||
- pyscard_ (relaying a local smart card with :option:`--type=relay`)
|
||||
- PyCrypto_, PBKDF2_, PIL_, readline_ or PyReadline_ (emulation of electronic
|
||||
passport with :option:`--type=ePass`)
|
||||
- OpenPACE_ (emulation of German identity card with :option:`--type=nPA`)
|
||||
- libqrencode_ (to print a QR code on the command line for `vpcd-config`; an
|
||||
URL will be printed if libqrencode is not available)
|
||||
|
||||
|
||||
.. include:: download.txt
|
||||
|
||||
|
||||
.. _vicc_install:
|
||||
|
||||
.. include:: autotools.txt
|
||||
|
||||
|
||||
================================================================================
|
||||
Building and installing |vpcd| on Mac OS X
|
||||
================================================================================
|
||||
|
||||
Mac OS X 10.9 and earlier is using PCSC-Lite as smart card service which allows
|
||||
using the standard routine for :ref:`installation on Unix<vicc_install>`.
|
||||
|
||||
Mac OS X 10.10 (and later) ships with a proprietary implementation of the PC/SC
|
||||
layer instead of with PCSC-Lite. As far as we know, this means that smart card
|
||||
readers must be USB devices instead of directly allowing a more generic type of
|
||||
reader. To make |vpcd| work we simply configure it to pretend being a USB smart
|
||||
card reader with an :file:`Ìnfo.plist`::
|
||||
|
||||
./configure --prefix=/ --enable-infoplist
|
||||
make
|
||||
make install
|
||||
|
||||
================================================================================
|
||||
Building and installing |vpcd| on Windows
|
||||
================================================================================
|
||||
|
||||
.. versionadded:: 0.7
|
||||
We implemented |vpcd| as user mode device driver for Windows so that
|
||||
|vpicc| can directly be used in Windows' smart card applications that use
|
||||
PC/SC.
|
||||
|
||||
For the Windows integration we extended `Fabio Ottavi's UMDF Driver for a
|
||||
Virtual Smart Card Reader`_ with a |vpcd| interface. To build |vpcd| for
|
||||
Windows we use `Windows Driver Kit 8.1 and Visual Studio 2013`_. If you choose
|
||||
to download the `Windows binaries`_, you may directly jump to step 3.
|
||||
|
||||
|
||||
1. In Visual Studio select :menuselection:`File --> Open --> Convert
|
||||
Sources/Dirs...` and choose the vpcd's :file:`sources` either in the
|
||||
:file:`WinXP` [#footnote1]_ or :file:`Win7` folder.
|
||||
|
||||
When successfully imported, ensure with the configuration manager, that both
|
||||
of the created projects are built for the same platform (x64 or Win32).
|
||||
|
||||
2. If you can successfully :guilabel:`Build the solution`, you can find the
|
||||
install package in :file:`BixVReader-package`. It contains `BixVReader.inf`
|
||||
and the required libraries, especially `BixVReader.dll` and
|
||||
`WudfUpdate_01009.dll` [#footnote2]_.
|
||||
|
||||
3. Copy :file:`win32\\BixVReader\\BixVReader.ini` into the :envvar:`%SystemRoot%`
|
||||
directory.
|
||||
|
||||
4. In a console with administrator rights go to :file:`BixVReader-package` and
|
||||
install the driver::
|
||||
|
||||
"C:\Program Files\Windows Kits\8.1\Tools\x86\devcon.exe" install BixVReader.inf root\BixVirtualReader
|
||||
|
||||
You can adjust the path to ``devcon.exe`` with your version of the WDK and
|
||||
your target architecture (e.g., use ``...\x64\devcon.exe`` for a 64 bit
|
||||
driver). You can also download `DevCon's source code`_ and compile it
|
||||
yourself.
|
||||
|
||||
For Win7 and older, code signing is optional and will yield a warning during
|
||||
installation when missing. Simply click continue to install the driver anyway.
|
||||
|
||||
To activate the WDK test signing, use VS build-in Driver Signing settings.
|
||||
Right click :guilabel:`BixVReader-package` :menuselection:`Properties -->
|
||||
Driver Signing --> Sign Mode --> Test Sign`. Import the WDKTestCert
|
||||
certificate :file:`BixVReader-package.cer` into your windows keystore (e.g.
|
||||
on local computer) and then install the driver. See
|
||||
`Microsoft's Kernel-Mode Code Signing Walkthrough`_ for
|
||||
details.
|
||||
|
||||
For debugging |vpcd| and building the driver with an older version of Visual
|
||||
Studio or WDK please see `Fabio Ottavi's UMDF Driver for a Virtual Smart Card
|
||||
Reader`_ for details. All of Fabio's card connectors (pipe reader/TCP/IP
|
||||
reader) are still active by default.
|
||||
|
||||
|
||||
********************************************************************************
|
||||
Using the Virtual Smart Card
|
||||
********************************************************************************
|
||||
|
||||
The protocol between |vpcd| and |vpicc| as well as details on extending |vpicc|
|
||||
with a different card emulator are covered in :ref:`virtualsmartcard-api`. Here
|
||||
we will focus on configuring and running the provided modules.
|
||||
|
||||
.. _vicc_config:
|
||||
|
||||
================================================================================
|
||||
Configuring |vpcd| on Unix
|
||||
================================================================================
|
||||
|
||||
The configuration file of |vpcd| is usually placed into
|
||||
:file:`/etc/reader.conf.d/`. For older versions of PCSC-Lite you
|
||||
need to run :command:`update-reader.conf` to update :command:`pcscd`'s main
|
||||
configuration file. The PC/SC daemon should read it and load the
|
||||
|vpcd| on startup. In debug mode :command:`pcscd -f -d` should say something
|
||||
like "Attempting startup of Virtual PCD" when loading |vpcd|.
|
||||
|
||||
By default, |vpcd| opens a socket for |vpicc| and waits for incoming
|
||||
connections. The port to open should be specified in ``CHANNELID`` and
|
||||
``DEVICENAME``:
|
||||
|
||||
.. literalinclude:: vpcd_example.conf
|
||||
:emphasize-lines: 2,4
|
||||
|
||||
If the first part of the ``DEVICENAME`` is different from ``/dev/null``, |vpcd|
|
||||
will use this string as a hostname for connecting to a waiting |vpicc|. |vpicc|
|
||||
needs to be started with :option:`--reversed` in this case.
|
||||
|
||||
================================================================================
|
||||
Configuring |vpcd| on Mac OS X
|
||||
================================================================================
|
||||
|
||||
Mac OS X 10.9 and earlier is using PCSC-Lite as smart card service which allows
|
||||
using the standard routine for :ref:`configuration on Unix<vicc_config>`.
|
||||
|
||||
On Mac OS X 10.10 you should have configured the generation of
|
||||
:file:`Info.plist` at compile time. Now do the following for registering |vpcd|
|
||||
as USB device:
|
||||
|
||||
1. Choose an USB device (e.g. mass storage, phone, mouse, ...), which will be
|
||||
used to start |vpcd|. Plug it into the computer.
|
||||
|
||||
2. Run the following command to get the device's product and vendor ID::
|
||||
|
||||
system_profiler SPUSBDataType
|
||||
|
||||
3. Change :file:`/usr/libexec/SmartCardServices/drivers/ifd-vpcd.bundle/Info.plist`
|
||||
to match your product and vendor ID:
|
||||
|
||||
.. literalinclude:: Info.plist
|
||||
:emphasize-lines: 34,39
|
||||
|
||||
Note that ``ifdFriendlyName`` can be used in the same way as ``DEVICENAME``
|
||||
:ref:`described above<vicc_config>`.
|
||||
|
||||
4. Restart the PC/SC service::
|
||||
|
||||
sudo killall -SIGKILL -m .*com.apple.ifdreader
|
||||
|
||||
Now, every time you plug in your USB device |vpcd| will be started. It will be
|
||||
stopped when you unplug the device.
|
||||
|
||||
================================================================================
|
||||
Configuring |vpcd| on Windows
|
||||
================================================================================
|
||||
|
||||
The configuration file `BixVReader.ini` of |vpcd| is usually placed into
|
||||
:file:`C:\\Windows` (:envvar:`SystemRoot`). The user mode device driver
|
||||
framework (:command:`WUDFHost.exe`) should read it automatically and load the
|
||||
|vpcd| on startup. The Windows Device Manager :command:`mmc devmgmt.msc` should
|
||||
list the :guilabel:`Bix Virtual Smart Card Reader`.
|
||||
|
||||
|vpcd| opens a socket for |vpicc| and waits for incoming
|
||||
connections. The port to open should be specified in ``TCP_PORT``:
|
||||
|
||||
.. literalinclude:: ../../virtualsmartcard/win32/BixVReader/BixVReader.ini
|
||||
:emphasize-lines: 8
|
||||
|
||||
Currently it is not possible to configure the Windows driver to connect to an
|
||||
|vpicc| running with :option:`--reversed`.
|
||||
|
||||
================================================================================
|
||||
Running |vpicc|
|
||||
================================================================================
|
||||
|
||||
The compiled `Windows binaries`_ of |vpicc| include OpenPACE. The other
|
||||
dependencies listed above need to be installed seperately. You can start the
|
||||
|vpicc| via :command:`python.exe vicc.py`. On all other systems an executable
|
||||
script :command:`vicc` is installed using the autotools.
|
||||
|
||||
The |vpicc| option :option:`--help` gives an overview about the command line
|
||||
switches:
|
||||
|
||||
.. program-output:: vicc --help
|
||||
|
||||
.. versionadded:: 0.7
|
||||
We implemented :command:`vpcd-config` which tries to guess the local IP
|
||||
address and outputs |vpcd|'s configuration. |vpicc|'s options should be
|
||||
chosen accordingly (:option:`--hostname` and :option:`--port`)
|
||||
:command:`vpcd-config` also prints a QR code for configuration of the
|
||||
:ref:`remote-reader`.
|
||||
|
||||
When |vpcd| and |vpicc| are connected you should be able to access the card
|
||||
through the PC/SC API. You can use the :command:`opensc-explorer` or
|
||||
:command:`pcsc_scan` for testing. In Virtual Smart Card's root directory we also
|
||||
provide scripts for testing with npa-tool_ and PCSC-Lite's smart card
|
||||
reader driver tester.
|
||||
|
||||
|
||||
.. include:: questions.txt
|
||||
|
||||
|
||||
********************
|
||||
Notes and References
|
||||
********************
|
||||
|
||||
.. target-notes::
|
||||
|
||||
.. [#footnote1] With VS 2013 and WDK 8.1 no Windows XP driver can be build. You need to use an older version of VS with WDK 7.1.0.
|
||||
.. [#footnote2] Note that WudfUpdate_01009.dll for 32 bit will be around 1795 KB and for 64 bit around 2102 KB big.
|
||||
|
||||
.. _cyberflex-shell: https://github.com/henryk/cyberflex-shell
|
||||
.. _PCSC-lite: http://pcsclite.alioth.debian.org/
|
||||
.. _Python: http://www.python.org/
|
||||
.. _pyscard: http://pyscard.sourceforge.net/
|
||||
.. _PyCrypto: http://pycrypto.org/
|
||||
.. _PBKDF2: https://www.dlitz.net/software/python-pbkdf2/
|
||||
.. _readline: https://docs.python.org/3.3/library/readline.html
|
||||
.. _PyReadline: https://pypi.python.org/pypi/pyreadline
|
||||
.. _PIL: http://www.pythonware.com/products/pil/
|
||||
.. _OpenPACE: https://github.com/frankmorgner/openpace
|
||||
.. _libqrencode: https://fukuchi.org/works/qrencode/
|
||||
.. _`Fabio Ottavi's UMDF Driver for a Virtual Smart Card Reader`: http://www.codeproject.com/Articles/134010/An-UMDF-Driver-for-a-Virtual-Smart-Card-Reader
|
||||
.. _`Windows Driver Kit 8.1 and Visual Studio 2013`: http://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx
|
||||
.. _`DevCon's source code`: https://github.com/Microsoft/Windows-driver-samples/tree/master/setup/devcon
|
||||
.. _`Microsoft's Kernel-Mode Code Signing Walkthrough`: http://msdn.microsoft.com/en-us/library/windows/hardware/dn653569%28v=vs.85%29.aspx
|
||||
.. _`Windows binaries`: https://github.com/frankmorgner/vsmartcard/releases/download/virtualsmartcard-0.7/virtualsmartcard-0.7_win32.zip
|
||||
.. _npa-tool: https://github.com/frankmorgner/OpenSC
|
||||
126
docs/_sources/virtualsmartcard/api.txt
Normal file
126
docs/_sources/virtualsmartcard/api.txt
Normal file
@@ -0,0 +1,126 @@
|
||||
.. |vpicc| replace:: :abbr:`vpicc (virtual smart card)`
|
||||
.. |vpcd| replace:: :abbr:`vpcd (virtual smart card reader)`
|
||||
.. |APDU| replace:: :abbr:`APDU (Application Protocol Data Unit)`
|
||||
.. |SWs| replace:: :abbr:`SWs (status bytes SW 1 and SW 2)`
|
||||
.. |SAM| replace:: :abbr:`SAM (Secure Access Module)`
|
||||
|
||||
.. _virtualsmartcard-api:
|
||||
|
||||
*****************************
|
||||
Creating a Virtual Smart Card
|
||||
*****************************
|
||||
|
||||
|vpcd| communicates over a socked with |vpicc| usually on port ``0x8C7B``
|
||||
(configurably via :file:`/etc/reader.conf.d/vpcd`). So you can connect
|
||||
virtually any program to the virtual smart card reader, as long as you respect
|
||||
the following protocol:
|
||||
|
||||
.. _vpcd-commands:
|
||||
|
||||
============= ==================== ============= =============
|
||||
|vpcd| |vpicc|
|
||||
---------------------------------- ---------------------------
|
||||
Length Command Length Response
|
||||
============= ==================== ============= =============
|
||||
``0x00 0x01`` ``0x00`` (Power Off) (No Response)
|
||||
``0x00 0x01`` ``0x01`` (Power On) (No Response)
|
||||
``0x00 0x01`` ``0x02`` (Reset) (No Response)
|
||||
``0x00 0x01`` ``0x04`` (Get ATR) ``0xXX 0xXX`` (ATR)
|
||||
``0xXX 0xXX`` (APDU) ``0xXX 0xXX`` (R-APDU)
|
||||
============= ==================== ============= =============
|
||||
|
||||
The communication is initiated by |vpcd|. First the length of the data (in
|
||||
network byte order, i.e. big endian) is sent followed by the data itself.
|
||||
|
||||
|
||||
===================================
|
||||
Documentation to Virtual Smart Card
|
||||
===================================
|
||||
|
||||
.. toctree::
|
||||
|
||||
api/virtualsmartcard
|
||||
|
||||
|
||||
========
|
||||
Examples
|
||||
========
|
||||
|
||||
---------------------------------------
|
||||
Implementing a ISO 7816 like Smart Card
|
||||
---------------------------------------
|
||||
|
||||
|vpicc| includes an emulation of a card acting according to ISO 7816. This
|
||||
includes all standard commands for file management and secure messaging.
|
||||
|
||||
Let's assume we want to create a cryptoflex card, that acts mostly according to
|
||||
ISO 7816. In this example we only want to add little things that differ from
|
||||
ISO 7816. But as for most complex software you need to know where you need to
|
||||
hook into. Here we only want to give an overview to the design, the complete
|
||||
details can be found in section `Documentation to Virtual Smart Card`_.
|
||||
|
||||
Back to the cryptoflex example.
|
||||
:class:`~virtualsmartcard.VirtualSmartcard.VirtualICC` provides the connection
|
||||
to the virtual smart card reader. It fetches an |APDU| and other requests from
|
||||
the |vpcd|. In :class:`~virtualsmartcard.VirtualSmartcard.VirtualICC` an |APDU|
|
||||
is only a buffer that is forwarded to the smart card OS. First we modify
|
||||
:class:`~virtualsmartcard.VirtualSmartcard.VirtualICC` to recognize a new type
|
||||
``"cryptoflex"`` and to load
|
||||
:class:`~virtualsmartcard.cards.cryptoflex.CryptoflexOS`. The
|
||||
:class:`~virtualsmartcard.CardGenerator` is used to create a file system and a
|
||||
|SAM| specific to the cryptoflex (we come back to this later).
|
||||
|
||||
.. literalinclude:: virtualsmartcard/VirtualSmartcard.py
|
||||
:pyobject: VirtualICC.__init__
|
||||
:emphasize-lines: 35-37
|
||||
|
||||
Responses from our cryptoflex card look the same as for the 7816 card. But when
|
||||
a command was successfull (or not) there is a little difference in what is
|
||||
returned. So we need to edit
|
||||
:class:`~virtualsmartcard.cards.cryptoflex.CryptoflexOS.formatResult`, which is
|
||||
called to encode the |SWs| and the resulting data.
|
||||
|
||||
.. literalinclude:: virtualsmartcard/cards/cryptoflex.py
|
||||
:pyobject: CryptoflexOS.formatResult
|
||||
|
||||
Note that this also requires some insight knowledge about how
|
||||
:class:`~virtualsmartcard.VirtualSmartcard.Iso7816OS` works.
|
||||
|
||||
The previously created |SAM| handles keys, encryption, secure messaging and so
|
||||
on (we will not go into more details here). The file system creates, selects
|
||||
and reads contents of files or directories. File handling for our cryptoflex
|
||||
card is similar to ISO 7816, but the meaning of P1, P2 and the |APDU| data is
|
||||
completely different when creating a file on the smart card. So we derive
|
||||
:class:`~virtualsmartcard.cards.cryptoflex.CryptoflexMF` from
|
||||
:class:`~virtualsmartcard.SmartcardFilesystem.MF` and modify
|
||||
:class:`~virtualsmartcard.cards.cryptoflex.CryptoflexMF.create` to our needs.
|
||||
|
||||
.. literalinclude:: virtualsmartcard/cards/cryptoflex.py
|
||||
:pyobject: CryptoflexMF.create
|
||||
|
||||
As you can see it is quite simple to extend the virtual smart card to your
|
||||
requirements. Simply overwrite those functions, that differ from ISO 78166. But
|
||||
as said before, the virtual smart card is quite complex and you might have to
|
||||
read some documentation or even source code to find out where it's best to do
|
||||
your modifications...
|
||||
|
||||
|
||||
----------------------------------
|
||||
Implementing an Other Type of Card
|
||||
----------------------------------
|
||||
|
||||
If you have a card entirely different to ISO 7816, you surely want to avoid all
|
||||
magic that is done while parsing a buffer (an |APDU|). As example we will
|
||||
connect to an other smart card using PC/SC and forward it to |vpcd|.
|
||||
|
||||
As before with the cryptoflex card, we let
|
||||
:class:`~virtualsmartcard.VirtualSmartcard.VirtualICC` recognize the new type
|
||||
``"relay"``. :class:`~virtualsmartcard.cards.Relay.RelayOS` overwrites all
|
||||
main functions from the template
|
||||
:class:`~virtualsmartcard.VirtualSmartcard.SmartcardOS`. Its functions correspond
|
||||
to the :ref:`commands sent by vpcd <vpcd-commands>`. If you know how to use
|
||||
`pyscard <http://pyscard.sourceforge.net/>`_ then the rest is pretty straight
|
||||
forward, but see yourself...
|
||||
|
||||
.. literalinclude:: virtualsmartcard/cards/Relay.py
|
||||
:pyobject: RelayOS
|
||||
@@ -0,0 +1,10 @@
|
||||
CardGenerator Module
|
||||
====================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.CardGenerator
|
||||
.. automodule:: virtualsmartcard.CardGenerator
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
ConstantDefinitions Module
|
||||
==========================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.ConstantDefinitions
|
||||
.. automodule:: virtualsmartcard.ConstantDefinitions
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
CryptoUtils Module
|
||||
==================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.CryptoUtils
|
||||
.. automodule:: virtualsmartcard.CryptoUtils
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
SEutils Module
|
||||
==============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.SEutils
|
||||
.. automodule:: virtualsmartcard.SEutils
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
SWutils Module
|
||||
==============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.SWutils
|
||||
.. automodule:: virtualsmartcard.SWutils
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
SmartcardFilesystem Module
|
||||
==========================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.SmartcardFilesystem
|
||||
.. automodule:: virtualsmartcard.SmartcardFilesystem
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
SmartcardSAM Module
|
||||
===================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.SmartcardSAM
|
||||
.. automodule:: virtualsmartcard.SmartcardSAM
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
TLVutils Module
|
||||
===============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.TLVutils
|
||||
.. automodule:: virtualsmartcard.TLVutils
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
VirtualSmartcard Module
|
||||
=======================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.VirtualSmartcard
|
||||
.. automodule:: virtualsmartcard.VirtualSmartcard
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
HandlerTest Module
|
||||
==================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.cards.HandlerTest
|
||||
.. automodule:: virtualsmartcard.cards.HandlerTest
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
Relay Module
|
||||
============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.cards.Relay
|
||||
.. automodule:: virtualsmartcard.cards.Relay
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
cryptoflex Module
|
||||
=================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.cards.cryptoflex
|
||||
.. automodule:: virtualsmartcard.cards.cryptoflex
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
ePass Module
|
||||
============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.cards.ePass
|
||||
.. automodule:: virtualsmartcard.cards.ePass
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
nPA Module
|
||||
==========
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.cards.nPA
|
||||
.. automodule:: virtualsmartcard.cards.nPA
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,11 @@
|
||||
cards Package
|
||||
=============
|
||||
|
||||
.. toctree::
|
||||
|
||||
virtualsmartcard.cards.HandlerTest
|
||||
virtualsmartcard.cards.Relay
|
||||
virtualsmartcard.cards.cryptoflex
|
||||
virtualsmartcard.cards.ePass
|
||||
virtualsmartcard.cards.nPA
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
CardGenerator_test Module
|
||||
=========================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.tests.CardGenerator_test
|
||||
.. automodule:: virtualsmartcard.tests.CardGenerator_test
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
CryptoUtils_test Module
|
||||
=======================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.tests.CryptoUtils_test
|
||||
.. automodule:: virtualsmartcard.tests.CryptoUtils_test
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
SmartcardSAM_test Module
|
||||
========================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.tests.SmartcardSAM_test
|
||||
.. automodule:: virtualsmartcard.tests.SmartcardSAM_test
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
@@ -0,0 +1,10 @@
|
||||
tests Package
|
||||
=============
|
||||
|
||||
.. toctree::
|
||||
|
||||
virtualsmartcard.tests.CardGenerator_test
|
||||
virtualsmartcard.tests.CryptoUtils_test
|
||||
virtualsmartcard.tests.SmartcardSAM_test
|
||||
virtualsmartcard.tests.utils_test
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
utils_test Module
|
||||
=================
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.tests.utils_test
|
||||
.. automodule:: virtualsmartcard.tests.utils_test
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
18
docs/_sources/virtualsmartcard/api/virtualsmartcard.txt
Normal file
18
docs/_sources/virtualsmartcard/api/virtualsmartcard.txt
Normal file
@@ -0,0 +1,18 @@
|
||||
virtualsmartcard Package
|
||||
========================
|
||||
|
||||
.. toctree::
|
||||
|
||||
virtualsmartcard.cards
|
||||
virtualsmartcard.tests
|
||||
virtualsmartcard.CardGenerator
|
||||
virtualsmartcard.ConstantDefinitions
|
||||
virtualsmartcard.CryptoUtils
|
||||
virtualsmartcard.SEutils
|
||||
virtualsmartcard.SWutils
|
||||
virtualsmartcard.SmartcardFilesystem
|
||||
virtualsmartcard.SmartcardSAM
|
||||
virtualsmartcard.TLVutils
|
||||
virtualsmartcard.VirtualSmartcard
|
||||
virtualsmartcard.utils
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
utils Module
|
||||
============
|
||||
|
||||
.. inheritance-diagram:: virtualsmartcard.utils
|
||||
.. automodule:: virtualsmartcard.utils
|
||||
:members:
|
||||
:undoc-members:
|
||||
:inherited-members:
|
||||
:show-inheritance:
|
||||
:private-members:
|
||||
Reference in New Issue
Block a user