Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Jeffrey Hutzelman
--On Thursday, January 29, 2009 03:36:42 AM +0100 Peter Stuge wrote: > Jeffrey Hutzelman wrote: >> the USB device is entirely in the card. > > They are nice. I was building my own expresscard egate adapter for a > while there. That sounds like a useful item, and hopefully not too tricky. Too ba

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Peter Stuge
Jeffrey Hutzelman wrote: > the USB device is entirely in the card. They are nice. I was building my own expresscard egate adapter for a while there. //Peter ___ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www.opensc-project.o

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Jeffrey Hutzelman
--On Thursday, January 29, 2009 02:58:53 AM +0100 Peter Stuge wrote: > Jeffrey Hutzelman wrote: >> Something like the Reflex "reader" which is really just an egate >> adapter. > > I don't think there is a USB device until the egate is inserted. That's correct. The adapter is just a very funny

Re: [opensc-devel] current status?

2009-01-28 Thread Peter Stuge
Jeffrey Hutzelman wrote: > if you think disabling off-card key generation by default is the > better choice, and no one else objects, then let's try it. I like that too. //Peter ___ opensc-devel mailing list opensc-devel@lists.opensc-project.org http:/

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Peter Stuge
Jeffrey Hutzelman wrote: > Something like the Reflex "reader" which is really just an egate > adapter. I don't think there is a USB device until the egate is inserted. //Peter ___ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://w

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Stanislav Brabec
Andreas Jellinghaus wrote: > > We need a "category" string that covers both and use it for both, > > otherwise we will have problems in defining generic rules (especially in > > case, when we know, that it is ISO 7816 device, but don't know, which > > one). > > > > Possibilities: > > iso7816 = smar

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Alon Bar-Lev
On 1/28/09, Andreas Jellinghaus wrote: > someone has a group "usb"? ouch. I don't like this proposal. Gentoo has. > people might think "lets add a user to that group, like we do with audio > and video, so people can use usb devices". if then this would be implemented > like alon suggested, a

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Stanislav Brabec
Andreas Jellinghaus wrote: > Am Mittwoch 28 Januar 2009 18:06:33 schrieb Alon Bar-Lev: > > On 1/28/09, Andreas Jellinghaus wrote: > > > > - Define policy for ACL (see freedesktop Bugzilla) > > > > > > root,root 0600 is fine with me. distributions could create some system > > > account, and use th

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Andreas Jellinghaus
Am Mittwoch 28 Januar 2009 18:06:33 schrieb Alon Bar-Lev: > On 1/28/09, Andreas Jellinghaus wrote: > > > - Define policy for ACL (see freedesktop Bugzilla) > > > > root,root 0600 is fine with me. distributions could create some system > > account, and use that system account for such usb devices

Re: [opensc-devel] patch for Rutoken

2009-01-28 Thread Andreas Jellinghaus
Hi Aleksey, can you also edit the wiki page, and document what this change means for users? e.g. do people need to delete and re-initialize their tokens? is there a security issue with the way the tokens were used earlier. thanks! also, do you know any resellers of the rutoken in eu? Regards,

Re: [opensc-devel] current status?

2009-01-28 Thread Andreas Jellinghaus
Am Mittwoch 28 Januar 2009 08:27:16 schrieb Jeffrey Hutzelman: > > your commend on "no so pin" is strange - "pkcs15+onepin" option is > > exactly the way opensc initializes a card to have a single pin (i.e. no > > sopin). > > I think I was talking about the difference between '-p pkcs15+onepin' and

[opensc-devel] new EXPERIMENTAL SCA release

2009-01-28 Thread JP Szikora
Hi, I just compiled a new SCA test release for MacOSX, based on opensc-0.11.6-svn-r3639. http://www.opensc-project.org/files/sca/experimental/sca-0.2.5-pre1.dmg Cheers, Jean-Pierre ___ opensc-devel mailing list opensc-devel@lists.opensc-project.org

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Alon Bar-Lev
On 1/28/09, Andreas Jellinghaus wrote: > > - Define policy for ACL (see freedesktop Bugzilla) > > root,root 0600 is fine with me. distributions could create some system > account, > and use that system account for such usb devices and run pcscd and openct > under these accounts (if that works

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Andreas Jellinghaus
> We need a "category" string that covers both and use it for both, > otherwise we will have problems in defining generic rules (especially in > case, when we know, that it is ISO 7816 device, but don't know, which > one). > > Possibilities: > iso7816 = smart_chip* ok, but then please name it "sma

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Jeffrey Hutzelman
--On Wednesday, January 28, 2009 03:41:49 PM +0100 Ludovic Rousseau wrote: (mostly I'm agreeing with Ludovic here and adding a few comments of my own) > 2009/1/28 Stanislav Brabec : >> We need a "category" string that covers both and use it for both, >> otherwise we will have problems in defin

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Ludovic Rousseau
2009/1/28 Stanislav Brabec : > We need a "category" string that covers both and use it for both, > otherwise we will have problems in defining generic rules (especially in > case, when we know, that it is ISO 7816 device, but don't know, which > one). > > Possibilities: > iso7816 = smart_chip* Ple

Re: [opensc-devel] current status?

2009-01-28 Thread Ludovic Rousseau
2009/1/28 Jeffrey Hutzelman : > --On Thursday, January 08, 2009 11:40:54 AM +0100 Andreas Jellinghaus > wrote: >> also it would be good to push the new release to debian and friends, >> as they didn't update opensc for quite some time - I guess because >> the build process was changed and some cha

Re: [opensc-devel] HAL proposal for smart cards (clarification)

2009-01-28 Thread Stanislav Brabec
Andreas Jellinghaus wrote: > Am Dienstag 27 Januar 2009 19:14:31 schrieb Stanislav Brabec: > > Ludovic Rousseau wrote: > > > 2009/1/23 Stanislav Brabec : > > > > I don't know, whether multi-slot devices use more USB devices, more USB > > > > interfaces or only one interface and multi-slot protocol.

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Martin Paljak
On 28.01.2009, at 14:46, Alon Bar-Lev wrote: > On 1/28/09, Martin Paljak wrote: >> You could blame Apple for this, but in real life there are many >> such tweaks >> in OS X. > > Sure I can blame apple. PC/SC is Microsoft API, the API is fixed and > apple cannot modify entry points. In theory i

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Alon Bar-Lev
On 1/28/09, Martin Paljak wrote: > You could blame Apple for this, but in real life there are many such tweaks > in OS X. Sure I can blame apple. PC/SC is Microsoft API, the API is fixed and apple cannot modify entry points. > > I don't see how adding another corner case to deal with OS X make

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Martin Paljak
On 28.01.2009, at 13:43, Alon Bar-Lev wrote: >> I assume there was actually some specific reason for the change, and >> perhaps we'll hear about it when Andreas has a chance to respond. > > I did answer. The reason is to have the same code in OpenSC that is > working in POSIX, Windows. While using

Re: [opensc-devel] patch for Rutoken

2009-01-28 Thread Alon Bar-Lev
Can you please update the openct trunk so that Rutoken use the new event interface? The new event interface eliminate the need to poll the device. A simple sample is available for eToken[1], more complex sample is available for CCID [2]. Due to linux bug, you need kernel 2.6.28 with CONFIG_USB_DEVI

Re: [opensc-devel] patch for Rutoken

2009-01-28 Thread Alon Bar-Lev
Thanks. Applied. On 1/28/09, Aktiv Co. Aleksey Samsonov wrote: > Hello. > I propose the attached patch for "Rutoken S" codes. > Changes: > - use PKCS#15 (not builtin PKCS#15 emulator) > - rutoken.profile (add privdata) > - correct using ACL > - correct erase procedure > > __

[opensc-devel] patch for Rutoken

2009-01-28 Thread Aktiv Co. Aleksey Samsonov
Hello. I propose the attached patch for "Rutoken S" codes. Changes: - use PKCS#15 (not builtin PKCS#15 emulator) - rutoken.profile (add privdata) - correct using ACL - correct erase procedure bin0MSZ0ZoczJ.bin Description: application/gzip ___ opensc-d

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Alon Bar-Lev
On 1/28/09, Jeffrey Hutzelman wrote: > --On Wednesday, January 28, 2009 12:51:05 PM +0200 Alon Bar-Lev > wrote: > > > > > > > It assumes the pcsclite library is in a particular location, instead of > > > searching for it. This means it will fail to find libpcsclite on a > > > system where it

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Jeffrey Hutzelman
--On Wednesday, January 28, 2009 12:51:05 PM +0200 Alon Bar-Lev wrote: >> It assumes the pcsclite library is in a particular location, instead of >> searching for it. This means it will fail to find libpcsclite on a >> system where it is installed in /usr/local, for example. Further, the >>

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Alon Bar-Lev
On 1/28/09, Jeffrey Hutzelman wrote: > > * PC/SC library is dynamic linked no longer compile time dependency. > > > WHY > > What was wrong with using pkg-config to find the library, and then linking > against it? This approach is broken in several ways: > > It assumes the pcsclite library

Re: [opensc-devel] OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11

2009-01-28 Thread Jeffrey Hutzelman
--On Thursday, July 31, 2008 05:40:40 PM +0200 Andreas Jellinghaus wrote: > Changes in OpenSC 0.11.5 released 2008-07-31 > * PC/SC library is dynamic linked no longer compile time dependency. WHY What was wrong with using pkg-config to find the library, and then linking against it? This