1

Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN.

Is it anyhow possible to do the following?

  • Run some console tool
  • Tool ideally asks for PIN directly or at least triggers the standard dialog
  • Auth information can be submitted to the secure location site

I have tried so far OpenSC but it says the card is not supported.

This question focuses on how to perform the auth part with the PKI card, not how to use the API of the secured site.

UPDATE

Some findings so far based on @phl's answer.

To check for functions offered by the card's driver, I did the following.

# explore Debian package of the driver installer
dpkg -c <filename>.deb | grep .so

# list functions offered by the library and search for the target function
nm -D <library> | grep C_GetFunctionList

Here it was!

<hexvalue> T C_GetFunctionList

Then, I have tried to call this function from Python/ctypes.

from ctypes import *
cardfun1 = cdll.LoadLibrary("xxxxyyy.so")
print(cardfun1.C_GetFunctionList(None))

And the output is: 7. What then?!

Also, my impression is that is should be somehow possible to combine OpenSSL with the driver but in examples I can find so far people use the card to store the SSH key.

CONCLUSION

While OpenSSL is not possible with this card (no exported function bind_engine), with PyKCS11 it is anyway possible to use card's PIN and call its security functions. So the hint by @phl is the answer.

session = pkcs11.openSession(slot, CKF_SERIAL_SESSION | CKF_RW_SESSION)
session.login(<PIN>)
2

If your smart card supports PKCS#11, you have a PKCS#11 library/smartcard driver for your card. This library must export the PKCS#11 C_GetFunctionList function. You can link the library to the command line tool you want to develop and use the PKCS#11 API (PKCS#11 standard) to perform the authentication.

  • "export function.. link library" ..this sounds like C development? If I'd be able to find that driver library file, how would I test test that it links and the function is there? – J. Doe Oct 25 '18 at 10:50
  • @phil, I have found the exported function and I think linked the library in Python. Please share where to go from there. – J. Doe Oct 25 '18 at 15:35
  • 1
    try the Python PKCs#11 wrapper PyKCS11. With this python module you can load the library and use the PKCS#11 function through the provided python api. In C you would call the following functions C_GetFunctionList, C_Initialize, C_GetSlotList, C_OpenSession, C_Login – phl Oct 25 '18 at 16:21
  • 1
    @J. Doe OpenSSL: maybe you can use the library also as openssl engine. If so the library should export a function called bind_engine. You can try to load the library as openssl engine with openssl engine -c -t path-to-the-lib – phl Oct 25 '18 at 17:15
  • these are very helpful hints. Though, openssl is not possible as the function bind_engine is absent, but pykcs11 is what I will investigate. Thank you very much! – J. Doe Oct 26 '18 at 11:19
0

Your question is a bit shallow, but yes, it is possible, but you'll probably have to code that yourself.

Depending on site you are using, you might get lucky and find some github repo of someone who already figured out how to auth for that site through the CLI.

If you are on Linux/Mac, take a look at gnuPG, pinentry and cURL. Using your scripting language of choice you'll be able to hack something together to create the appropriate request to the webserver for authorisation.

  • thank you; I have extended more details; my problem is as it seems to me more the card than the site. – J. Doe Oct 24 '18 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.