OpenSC/OpenSC — pull request #305 by philipWendland (2014-10-19 21:17:29+00:00)
Title: Add support for the IsoApplet Java Card applet

Please note: depends on #294, #296 and #304 to be merged, or fixed otherwise.

The IsoApplet is an Open Source Java Card applet targeting newer (>= 2.2.2) Java Cards. It aims for Iso7816-comliance, but tries to find a balacance between standard-compliance ant not overcomplicating things.

The Applet has a Iso7816-filesystem that can hold PKCS#15 structures. The driver supports full read/wirte support, i.e. pkcs15-init --create-pkcs15 will create the PKCS#15 files on the smartcard.

It supports on-card-generation as well as private key import. RSA 2048 bit, and BrainpoolP192r1 and Prime256v1 for ECDSA are supported.
The applet returns the API version upon selection, so if mayor things change, the driver can identify the API to use (or even not match). (Looking forward to see some Java Card >= 3.0.2 cards for the ECC improvements, IMHO a big problem of the version 2.2.2 is that the host can not do the hashing..)

I've tested the applet on 3 different Java Cards, all worked out of the box. Obviously, not all work with extended APDUs or ECC, but RSA 2048 bit with short apdus always worked.

Performed tests:

RSA:
- Encryption/Decryption using OpenSSL (and engine_pkcs11)
- Signing/Verifying using OpenSSL
- Authentication via OpenSSH
- Sign/verify with GnuPG

ECC:
Application tests are difficult, PKCS11-support for ECC seems to be very scarce.
However, I can verify signatures generated by pkcs11-tool using OpenSSL.
Only Prime256v1 though, the brainpool curve is not supported yet.

Others:
- Recognized by Firefox

Currently, the Applet AID is random. Is this a blocker?
If so, does anyone have experience with obtaining unique AIDs (costs, time)?
I suspect, as a student, I lack the resources for that.
Does anyone have spare AIDs? Or don't you get "blocks" of AIDs?

Thank you.

URL: https://github.com/philipWendland/IsoApplet