Telesec GmbH, Deutsche Post and Kobil GmbH are german companies that sell TCOS based preformatted cards, i.e NetKey E4 cards, SignTrust cards and Smartkey cards. All these cards have a TCOS 2.02 operationg system and an almost PKCS#15 compatible file-layout. OpenSC has read-only support for these kind of cards.
If OpenSC would fully support TCOS, one could erase the preformatted card and initialize the card with a PKCS#15 filesystem. This is not possible right now as OpenSC lacks support for initializing a PKCS#15 layout on an empty card with TCOS operation system.
The good news are: With the help of an emulation layer OpenSC can use cards that are almost PKCS#15 compatible. For the above mentioned cards such an emulation layer exists. The emulation cannot store certificates, keys or pins on the card, but you can use whatever is visible through the emulation layer.
If you know of other TCOS based cards and are willing to help, please post information on the mailing list. You might also send "opensc-tool -f" output to me, maybe I can extend the emulation such that it works with your card as well.
NetKey E4 cards contain different directories with different applications. Only one of these (i.e. directory DF01) is made visible through the NetKey emulation layer. This directory contains 3 private keys, 3 public keys, 3 read only certificates, 6 empty certificate files, 2 local PINs and one signature-counter.
pkcs15-tool -c
will list all certificates. It will not list the empty certificate files. Here's the output for a new NetKey E4 card:
$ pkcs15-tool -c X.509 Certificate [Telesec Signatur Zertifikat] Flags : 0 Authority: no Path : DF01C000 ID : 01 X.509 Certificate [Telesec Authentifizierungs Zertifikat] Flags : 0 Authority: no Path : DF01C100 ID : 02 X.509 Certificate [Telesec Verschlüsselungs Zertifikat] Flags : 0 Authority: no Path : DF01C200 ID : 03
The read-only certificates are signed by a certificate of german Telekom AG and all have the same CN. Here's some output that shows one of them:
$ pkcs15-tool -r 01 | openssl x509 -noout -text -certopt no_pubkey,no_sigdump Certificate: Data: Version: 3 (0x2) Serial Number: 13356238 (0xcbccce) Signature Algorithm: ripemd160WithRSA Issuer: C=DE, O=Deutsche Telekom AG/0.2.262.1.10.7.20=1, CN=NKS CA 21:PN Validity Not Before: Jan 31 08:43:51 2003 GMT Not After : Jan 31 08:43:51 2006 GMT Subject: C=DE/0.2.262.1.10.7.20=1, CN=NKS 03 A 02707 X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Non Repudiation
The public-keys are record-based transparent files and cannot be used for cryptographic operations. They are on the card for convenience only. OpenSC extracts the public keys from the certificates and does not use the public key files.
The Signature-Key can do signature-operations only. All other private keys can be used for decryption- and signature operations.
You (and OpenSC) dont see the empty certificate files through the emulation layer. One consequence of this is, that you cannot store your own certificates into these files with pkcs11-tool or pkcs15-init.
You must use opensc-explorer and store the certificate directly into the right position or use netkey-tool, a small program, that I wrote exactly for that purpose.
In general (and in particular with TCOS-cards) it's a lot more complicated to create a new file on a smartcard than updating an existing one. That's the reason why there are empty certificate files on a NetKey card. They contain 1536 0xFF-bytes and you can overwrite them with your own certificate (if your certificate has at most 1536 bytes).
netkey-tool can do other !NetKey-card specific things as well. In particular it will display your initial PUK value and all certificates (including the emtpy ones, which are invisible to pkcs15-tool). As of this writing (September 2005) netkey-tool is included in the CVS-version only.
SignTrust cards contain three directories. Each of them contain one certificate, one private key and one PIN.
All Keys can be used for decryption- and signature operations. As with all TCOS cards one could store additional certificates on a SignTrust card. But since there are no empty files on the card (as with NetKey cards) the emulations layer does not support this.
There are two sorts of Kobil Smartkey cards. The first one are !Netkey E4 cards with one additional directory where Kobil stores a Windows 2000 logon certificate. The emulation detects this kind of Smartkey cards as a NetKey card.
The second one has a Kobil specific undocumented layout. The emulation tries its best to support this kind of card.