Christophe, Thanks for the reply. I actually saw your FAQ quite a while back, (thank you, it helped a great deal while writing our ie support).
I have a few questions. By adding the OCF jar's to the applets ARCHIVE tag, they will also be downloaded from web server, correct? Does this mean I need to sign those jars too? Or is it ok for my applet to call/reference unsigned jars? In any case, I am going to do some digging and am reading more about the new java security model. I see now that with the policy file, I can definitely get to native calls, and I see that if I sign the jar's, and fix the policy file, it should work. It seems less than ideal. In the most generic case, I would want the reader and the client OCF configuration to be totally hidden from the applet, and set up by the user in the vm. lawrence -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Christophe Muller Sent: Thursday, January 09, 2003 2:12 AM To: Lawrence Chang Cc: [EMAIL PROTECTED] Subject: Re: [OCF] OCF/PCSC Bridge and Netscape 7 Hello, Lawrence Chang wrote: > netscape 7 supports java only thru the sun java plug-in 1.4. > [...] > User classpaths are not part of the jvm running in the browser, > and I do not believe native calls are allowed. This seems strange for me.. a couple of years ago I made tests with 1.2 JDKs (but Java2 security model hasn't change radically, from what I know (?)) and using javax.comm, but I didn't notice what you say. In fact in both cases (i.e., PC/SC bridgle DLL and Javax.comm implementation for the platform DLL), you will have to specify that the applet can load these libraries. So, I have specified the paths relatively to Java Home. I also specified that the applet can read an "opencard.properties" file in the user's Home directory (which is differently located on Windows than on Unix of course). I have attached my .java.policy file to give an idea of the settings (file access rights, serial ports, etc. It is tailored for Linux and Comm API but the principles should be the same. > Will moving towards a terminal that uses the javax.comm > stuff help? I don't think so. Using a pure java CardTerminal, when available, would be 1) more portable across platforms and OSes, and 2) easier to install, because instead of installing both OCF and PC/SC (depending on the type of Windows) and both OCF drivers (the bridge, configured in opencard.properties) and PC/SC drivers (your PC/SC reader driver, configured graphically in a contral panel icon for Gemplus readers but I don't know how for others); instead of all this, you would have just the OCF parts to set.. But I don't believe that you have less security properties to set for Java.. In fact, there is a mismatch between the Comm API java part and teh Java2 security scheme! It has been fixed for Solaris and Linux implementations but not yet for Windows (but there is a workaround, see the FAQ below). A couple of refs to my FAQ on applets using OCF: FAQ: <http://www.gemplus.fr/techno/opencard/faqs/applets-faq.html> How do I specify the multiple jar files needed for my applet? <http://www.gemplus.fr/techno/opencard/faqs/applets-faq-qna.html#q3.0.9> A good article on the same subject by Xavier Lorphelin: <http://www.smartcardcentral.com/technical/articles/jsource/article9907.pdf> Hope it'll help. Cheers, Christophe. = "Security is like an onion. It's made up of several layers = = and makes you cry." --Howard Chu = -- ------------------------------------------------------------- [EMAIL PROTECTED] - Gemplus Research Lab Phone: +33 4-42-36-57-83 | Disclaimer: I don't speak for Gemplus Gemplus doesn't speak for me... it is better that way! ------------------------------------------------------------- --- > Visit the OpenCard web site at http://www.opencard.org/ for more > information on OpenCard---binaries, source code, documents. > This list is being archived at http://www.opencard.org/archive/opencard/ ! To unsubscribe from the [EMAIL PROTECTED] mailing list send an email ! to ! [EMAIL PROTECTED] ! containing the word ! unsubscribe ! in the body.
