Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
RE: [Muscle] Sun PKCS 11 (jdk 1.5) and Muscle
From: Scott Guthery (sgutherymobile-mind.com)
Date: Tue Mar 09 2004 - 05:59:22 CST
Of course the problem is not the raw technology but European engineering which is really more like interior decorating. There are two implementations of card PKCS#11,
one Japanese and one American, that put the PKCS#11 API at the card edge; no muss, no fuss. In fact, one could argue that the token edge is where PKCS#11 should have been all along so that all its computin' is done inside the secure boundary.
IMHO, as always.
From: Peter Williams [mailto:home_pwmsn.com]
Sent: Mon 3/8/2004 9:55 PM
Subject: Re: [Muscle] Sun PKCS 11 (jdk 1.5) and Muscle
lets be clear: to sign a SSL client authentication message ,we must
1. use NSS API, which maps onto
2. the JCA API, which calls a
3. PKCS11 API card abstraction, which loads a PKCS11 provider, which calls the MSC API...
4. which translates C calls into CardEdge APDUs, which calls
5. MSC IFD API and its slot management abstraction , which calls
6. the PCSC API for slot/resource and mutex/thread management
7. which loads an IFD driver for the lun and operates the T0/T1 TPDU2APDU state machine, which
8. wraps the TPDU in either TLP224 or Gemplus T1-like host->reader block transfer protocol, which
9. interfaces to the USB service access point for a pre-enumated CCID NSAP
10. which on the reader must pass across a transport bridge, via a host<->controller<->UART A-layer dispatch loop, which adds events to a queue signalling
11. a T0/T1 protocol state machine handling T1 block or T0 async timeouts on a 7816 UART, which
11.5 pass across either a French or German encoding of bit levels and bit ordering, which
12. traverses an inverse path up the ICC stack
13. through the javacard OS io drivers (elide several layers)
14. to the applet/APDU dispatch interface...to
15. finally, a method in the CardEdge class (written in Java), which
16. calls the JCA, whose provider invoke a software RSA library - written in C probably -
17, which makes trusted kernel call to access the 16bit exponentiator co-processor.
And this is only the Unix path. On Windows, add smartcard API drivers and CAPI providers...and the interaction between these two
Ever wonder why smartcards dont take off, apart from being a $30 cost per head??
>From: "Wan-Teh Chang"
>Subject: Re: [Muscle] Sun PKCS 11 (jdk 1.5) and Muscle
>Date: Mon, 8 Mar 2004 17:58:38 -0800
>Christian Schneider wrote on 3/8/2004, 2:39 PM:
> > I am currently searching for a java to pkcs#11 mapping. Besides the
> > solution from IBM which does not seem to work with the muscle pkcs#11
> > library I have not found any library.
> > The new solution from sun is probably not yet ready for use. Is there
> > any other good java pkcs#11 interface for muscle?
>supports PKCS #11 and can be used as a JCA provider.
>Portions of JSS are implemented by JNI calls into the
>NSS libraries (http://www.mozilla.org/projects/security/pki/nss/).
>In particular, the management of PKCS #11 modules is
>done in NSS.
>Muscle mailing list
Store more e-mails with MSN Hotmail Extra Storage – 4 plans to choose from! <http://g.msn.com/8HMAENUS/2737??PS=> _______________________________________________ Muscle mailing list Musclelists.musclecard.com http://lists.musclecard.com/mailman/listinfo/muscle
Muscle mailing list