7

Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do email encryption and SSH authentication.

It seems most of these readers are geared towards the DOD CAC or Federal PIV infrastructure. I do not need to integrate with these things - I want to own the root CA or just manually put everybody's public keys in some kind of directory.

What are the different kinds of commercially available smart cards, and what do I need to stick to (or steer clear of) to get something working reliably at small scale using open source software? It seems the many vendors have different implementations and it's not clear how interoperable they are (if it all) outside of their enterprisey Windows-based software.

Basically, I'm looking to do something similar to what the Yubikey Neo does, but with generic cards (ideally having multiple suppliers) and readers. I understand specific product recommendations are off topic, just looking for a rundown on what words to look/search for to find cards that can be used for this purpose.

Terms I've come across:

  • ISO7816 seems to be a standard electrical interface, but I'm not sure whether this means all ISO7816-compliant cards and readers are interoperable at a software level.

  • CCID seems to be a standard protocol overlaid on USB for communication with card readers.

  • PKCS#11 and PCKS#15 seem to be higher-level public key crypto primitives that i.e. Thunderbird can consume from a smart card.

Can I just use any ISO7816 cards and readers compatible with both CCID and ISO7816, or is there more to it then that?

Improve this question

3 Answers 3

Reset to default
1

I'm really keen on what the Yubikey Neo does because it has so many open / generic modes (such that I've bought two), including presenting a CCID interface, OpenPGP supporting application on the card, and offering open source and specification U2F support.

I think what you're ultimately looking for is CCID + a card with the appropriate applets. OpenPGP cards may be enough for this.

Improve this answer
2
  • 1
    I agree that the Yubikey Neo looks very attractive, but I'd rather not get locked into a proprietary solution of I can avoid it. OpenPGP looks interesting but there appears to be a single supplier in Germany that currently only takes orders by email. I am in the U.S. and would prefer to buy something without paying international shipping - ideally something that I can buy from multiple suppliers. I ordered a generic-looking card on Amazon with my reader and I'll see if it works :).
    – jacobbaer
    Commented Sep 2, 2015 at 1:35
  • Well, I'll say again from being a huge fan of Yubikey that I think it's entirely worth it and I'm excited by the openness: U2F and PGP being open standards with hardware can be acquired elsewhere (namely, the cards). U2F vendor list: fidoalliance.org/certification/fido-ready
    – Jeff Ferland ♦
    Commented Sep 2, 2015 at 2:02
1

I'm experimenting with smart cards and I've had some success by making a small PKI and using an OpenSC-supported card (in my case it's an OpenPGP card but the PGP side does not matter so any PKI card will do). Using OpenSC ensures your card will be compatible across all major platforms since they provide their middleware for both Windows, Mac and Linux, and provide PKCS11 modules which can be used with Firefox and most other applications like SSH. For better Windows compatibility (Internet Explorer can't use OpenSC for example) it would be best to have cards both supported by OpenSC and that have their own drivers for Windows, so applications that use CAPI (Internet Explorer, Outlook, and even for login) can use them as well.

First, set up a certificate authority. This set of tutorials provides clean and readable OpenSSL config files - experiment for a few days/weeks first - running a secure PKI is not easy and you must take a lot of precautions. In production for a small business I would recommend using a PKI smart card to store the CA's private key as well - OpenSC provides a PKCS11 module and OpenSSL can take advantage of that. Store that card in a safe place next to other valuable assets, and only take it out when you need to issue a new certificate, if possible in presence of someone else so you have an audit trail and to avoid rogue employees misusing the CA card. If you do follow that link I suggest looking at the advanced/expert tutorials - while the "simple" one may look tempting it's lacking critical parts like CRLs and OCSP, and you'll definitely need those should you need to revoke certs (card lost/stolen, fired employee, etc).

Once you have the CA set up, initialize the cards, change the PINs and generate keys (look into OpenSC's documentation), then generate a CSR (using OpenSSL with the OpenSC PKCS11 module as OpenSC itself does not provide a tool for this) and sign that with your CA. Finally put the resulting certificate onto the card and you're good to go.

Keep in mind though that for email encryption if you do use a smart card, your employees will not be able to decrypt their mails when on a mobile device or any device that doesn't have a card reader (unless you generate the private key outside of the card and then allow them to import it on the phone, but that would negate the main advantage of the cards as the key can now be silently stolen using malware).

Improve this answer
0

It appears the answer is: Use JavaCard. While individual smart card manufacturers all have proprietary crypto management software, you can use GlobalPlatform to load an OpenSC-compatible applet onto any blank JavaCard and get yourself white-box PKCS#11 functionality.

Buying a couple of JavaCards now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .