Opensc: Certificates not visible in Keychain @ Catalina Beta 8

[meshyamsundar]

Problem Description

We are using OpenSc 19 in Mac machines and we are using the Certificate in PKI card to encrypt , decrypt and also to connect VPN,
Post upgrade to Catalina we are not able to view the certificate in Keychain.
Smart card is detected but Certificate as or missing in Keychain.
OpenSC-Issue-Collector.log

Proposed Resolution

Steps to reproduce

Logs

[mouse07410]

Can you access the keys/certs on the card via pkcs11-tool tool?

AFAIK, Catalina removed components necessary to run CDSA-based apps. That means, OpenSC.tokend cannot run on it. Which, in turn, means that there's no way to view the card as another keychain via Keychain Access app, AFAIK.

[frankmorgner]

I need to verify this, especially for the upcoming release.

Could you check if https://github.com/frankmorgner/OpenSCToken/releases/tag/v1.1 is working for you?

[gbil]

I need to verify this, especially for the upcoming release.

Could you check if https://github.com/frankmorgner/OpenSCToken/releases/tag/v1.1 is working for you?

Under catalina beta 8 (19A558d) after installing it (in parallel with OpenSC) it crashes ctkahp whenever I insert the card

[frankmorgner]

Catalina is still in Beta, I cannot test it, sorry. If nobody else looks at this issue, we'll postpone it for the next OpenSC release (when Catalina will hopefully be out).

On Mojave, I verified OpenSCToken (and OpenSC) to work as expected with my cards. Your crash may be fixed by https://github.com/frankmorgner/OpenSCToken/pull/10. Please report if you have more input, for example a backtrace or similar.

[frankmorgner]

By the way, you should also try testing with pkcs11-tool --test --login as suggested above

[thkl]

pkcs11-tool --list-objects shows all the certificates on the card ...

[frankmorgner]

can you use your card in Safari/Chrome?

[gbil]

By the way, you should also try testing with pkcs11-tool --test --login as suggested above
It lists all the certificates on the card

can you use your card in Safari/Chrome?
Yes

This issue still remains in Catalina Beta 9 which was just released

[frankmorgner]

So there's actually no problem with the functionality, it's just not visible in Keychain. Please open a bug at the Apple support; keychain hasn't been updated in a while to support mapOS new APIs for tokens...

[gbil]

So there's actually no problem with the functionality, it's just not visible in Keychain. Please open a bug at the Apple support; keychain hasn't been updated in a while to support mapOS new APIs for tokens...

I have to take back my previous statement that I can use the card in Safari/Chrome, that was the result of having a soft PKI installed in the keychain

removing it results on no app detecting the card
pkcs11-tool --test --login still lists the certificates and of course I can use the card in Firefox

[mouse07410]

Do this: security smartcards token -l. If the output is

$ security smartcards token -l
    "com.apple.pivtoken"
$ 

then do

$ sudo security smart cards token -e com.apple.pivtoken

Then try security list-smartcards. You should get something like:

$ security list-smartcards
com.apple.pivtoken:411xxxxxxxxxxxxxxxxxxxxxx
$ 

If you get something like

$ security list-smartcards
No smartcards found.
$ 

instead - I don't know what to do next. But if you do get your token listed - try Safari again.

...Keychain Access hasn't been updated in a while to support mapOS new APIs for tokens...

@frankmorgner one of the Apple engineers told me that this was deliberate - they did not want to expose tokens through Keychain Access.

[gbil]

$ security smartcards token -l
No output

$ sudo security smart cards token -e com.apple.pivtoken
Token is already enabled

Then try security list-smartcards. You should get something like:
No smartcards found

I don't know why, need to check with some colleagues on what they get if it is just on my side

@frankmorgner one of the Apple engineers told me that this was deliberate - they did not _want_ to expose tokens through Keychain Access.

I assume in order to push people over to the crypto token access

[mouse07410]

No smartcards found

This means that pivtoken does not recognize your card (or, something in the chain that leads to pivtoken fails). Perhaps there's something in the logs?

What kind of card/token is it? Is it a true PIV? OpenSC is far more tolerant, and supports many more variants of tokens than Apple native tools.

[thkl]

I've made the OpenSCTokenApp run in the XCode Debugger.

The App is able to read all certificates from the card .. but at the time it tries to insert the TKTokenKeychainItems into TKTokenKeychainContents.

Token.m Line 199

 [self.keychainContents fillWithItems:items];

/System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp is crashing ...

Thread 2 Crashed:: Dispatch queue: com.apple.root.default-qos.overcommit
0   com.apple.security              0x00007fff56a03bf5 SecKeyRunAlgorithmAndCopyResult + 166
1   com.apple.security              0x00007fff56a05804 SecKeyIsAlgorithmSupported + 100

maybe this the reason the certificates are not visible in Keychain Access and will help

[frankmorgner]

While being at this issue already, you may want to play around with dispatching this operation to the background...

[thkl]

hmm nope .. ctkahp is crashing no matter what queue (main_queue or my own background queue) i use ...

[thkl]

ok it looks like,let the crash beside, the keychain knows then about the certificates on the card. When i open Safari and make a try to login to a side, which depends on a certificate login, Safari shows a list of valid certs. The one on my card is in that list. But then there is no PIN Dialog (on mojave the keychain has asked for the pin). When debugging the OpenSCTokenApp stops at

TokenSession.m tokenSession:(TKTokenSession *)session supportsOperation:(TKTokenOperation)operation usingKey:(TKTokenObjectID)keyObjectID algorithm:(TKTokenKeyAlgorithm *)algorithm ...

Stepping thru:

if (!alg_info || ((alg_info->flags & minimum_flags) != minimum_flags))
        return NO;

returns NO ...

Unfortunally my knowledge about all the "low level c crypto stuff" is limited and i'm stuck at this point to find the root cause

[frankmorgner]

That's normal: ctkd probes a number of algorithms to check if they are supported for that particular key. In my tests, kSecKeyAlgorithmRSASignatureRaw was always used even though the token driver returns that some of the other algorithms are supported (and some not).

I don't have more ideas regarding the crash, though.

[Tionit]

What would be important now, is it a concrete OpenSC issue or has Apple implemented a bug? I am now experiencing a constant crash under Catalina Beta 9 as soon as a CardOS smart card is inserted.

[Tionit]

The problem also exists under Beta 10: The crash of "ctkahp" also occurs under macOS Catalina 10.15 beta 10 (19A578c) as soon as a smart card (with CardOS) is inserted.

[Tionit]

I reported the problem to Apple and collected crash logs and system diagnostics and sent them to Apple. Apple Engineering analyzed the problem and gave the following feedback:

"_I have heard back from our engineering, and they advise it is not caused by apple software. As the crash is caused by OpenSCToken that is trying to use the same objectID for both the certificate and the private key._"

Can the problem with the objectID be solved now? //cc @frankmorgner
Thank you!

[frankmorgner]

It's not documented that the ID needs to be unique across all object types, let alone that (invalid) data must not crash a system service. This must definitely be fixed on Apple's side.

However, we can, of course make the ID unique if that's needed.

[frankmorgner]

A Patch could look something like this, but I don't currently have the possibility to test this:
```diff
diff --git a/OpenSCToken/Token.m b/OpenSCToken/Token.m
index 504c09d..ec80ede 100644
--- a/OpenSCToken/Token.m
+++ b/OpenSCToken/Token.m
@@ -27,6 +27,24 @@

#import "Token.h"

+#define TYPE_CERT 0x01
+#define TYPE_PRIV 0x02
+
+static NSData* data idToData(u8 type, struct sc_pkcs15_id *p15id)
+{

• NSData *data = nil;
• if (p15id) {
• u8 *p = malloc(p15id->len+1);
• if (p) {
• *p = type;
• memcpy(p+1, p15id->value, p15id->len);
• data = [NSData dataWithBytes:p length:p15id->len+1];
• free(p);
• }
• }
• return data;
  +}
  +

@implementation TKTokenKeychainItem(OpenSCDataFormat)

@@ -123,7 +141,7 @@
continue;
}
NSData* certificateData = [NSData dataWithBytes:(const void )cert->data.value length:sizeof(unsigned char)cert->data.len];
- NSData* certificateID = [NSData dataWithBytes:cert_info->id.value length:cert_info->id.len];
+ NSData* certificateID = idToData(TYPE_CERT, cert_info->id);
NSString certificateName = [NSString stringWithUTF8String:objs[i]->label];
id certificate = CFBridgingRelease(SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef)certificateData));
if (certificateData == nil || certificateID == nil || certificateName == nil || certificate == NULL) {
@@ -146,7 +164,7 @@
continue;
}
struct sc_pkcs15_prkey_info *prkey_info = (struct sc_pkcs15_prkey_info *) prkey_obj->data;
- NSData keyID = [NSData dataWithBytes:prkey_info->id.value length:prkey_info->id.len];
+ NSData* keyID = idToData(TYPE_PRIV, prkey_info->id);
NSString keyName = [NSString stringWithUTF8String:objs[i]->label];
TKTokenKeychainKey *keyItem = [[TKTokenKeychainKey alloc] initWithCertificate:(__bridge SecCertificateRef)certificate objectID:keyID];
if (keyID == nil || keyName == nil || keyItem == nil) {
diff --git a/OpenSCToken/TokenSession.m b/OpenSCToken/TokenSession.m
index 538a2b2..5f3fc07 100644
--- a/OpenSCToken/TokenSession.m
+++ b/OpenSCToken/TokenSession.m
@@ -32,6 +32,10 @@ static struct sc_pkcs15_id dataToId(NSData data)
struct sc_pkcs15_id p15id;
p15id.len = [data length];
memcpy(p15id.value, [data bytes], p15id.len);
+ if (p15id.len > 0) {
+ p15id.len--;
+ memmove(p15id.value, p15id.value+1, p15id.len);
+ }
return p15id;
}
```

[Tionit]

To make the project work, I had to add the address (&) to the following two lines:

NSData* certificateID = idToData(TYPE_CERT, &cert_info->id);
NSData* keyID = idToData(TYPE_PRIV, &prkey_info->id);

After that ctkahp doesn't crash anymore. Tried with Catalina Golden Master Build.

Unfortunately the use of the certificates does not work yet:
In Safari I can select the Authentication Certificate, but the authentication fails.
In Outlook I see the PKI certificates. Unfortunately the encryption of an email fails.

@frankmorgner Any idea what the problem is?

[thkl]

ok, the crash is gone .. but unfortunately Safari is not able to login.

in tokenSession:: signData:: usingKey:: algorithm::error the line

int r = sc_pkcs15_compute_signature(self.OpenSCToken.p15card, prkey_obj, algorithmToFlags(algorithm), [dataToSign bytes], [dataToSign length], (unsigned char *) [out bytes], [out length]);

returns a value below zero ... maybe the driver has no access to the private key ... as far as i understand the flow of the pcks11-tool for singing data, there must be a login, using the pin, to the card first ?

[Tionit]

I have now got OpenSCToken running under the final version of macOS 10.15 Catalina.

Here are the two files that only have to be exchanged in the project, then it works with Catalina:
OpenSCToken.zip

@frankmorgner Your suggestion was basically correct, there was another problem with the authID that is passed as TKTokenOperationConstraint and was incorrectly converted with the new byte prefix. Can you please include the changes and make a new release available? Thank you very much!

[avvRobertoAlma]

I'm interested on this subject too.
I tried all day with current release of OpenSCToken and catalina.
I confirm that i was able to login using pkcs11-tool --login --test command.
When i try to login with safari/chromium the popup with the certificate appears, but as in the case reported by @thkl no request for PIN is shown.
I look forward to next release, cause i have an electron app which is based on that form of authentication.

[frankmorgner]

@Tionit , thanks for testing. I've expanded the previous approach to extend to authentication objects (constraints), please check out https://github.com/frankmorgner/OpenSCToken/pull/15

[avvRobertoAlma]

@frankmorgner and @Tionit
I tried to clone and compile repo uniqueId of OpenSCToken (i also have OpenSC installed).

There were some errors in the compilations, with reference to some pointers (there is an issue on OpenSCTokenApp)

I have a smartcard (Italian CNS) supported by OpenSC but i never was able to authenticate to websites requiring smartcard authentication with Mac Os Catalina (no problem with Mojave).

This is output of security list-smartcards
org.opensc-project.mac.opensctoken.OpenSCTokenApp.OpenSCToken:6120018020884007

This is output of system-profiler SPSmartCardsDataType

SmartCards:

    Readers:

      #01: Gemalto PC Twin Reader (ATR:{length = 24, bytes = 0x3bdf18008131fe7d006b020c0182011101434e53103180fc})

    Reader Drivers:

      #01: org.debian.alioth.pcsclite.smartcardccid:1.4.31 (/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle)
      #02: com.bit4id.smartcardccid:1.4.22 (/Library/bit4id/ccid/ifd-ccid.bundle)

    Tokend Drivers:

      #01: com.apple.tokend.opensc:1.0 (/Library/Security/tokend/OpenSC.tokend)
      #02: com.apple.tokend.bit4tokend:1.0 (/Library/bit4id/tokend/10.6/BIT4ID.tokend)

    SmartCard Drivers:

      #01: com.apple.CryptoTokenKit.pivtoken:1.0 (/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/pivtoken.appex)
      #02: org.opensc-project.mac.opensctoken.OpenSCTokenApp.OpenSCToken:1.1 (/Users/Roberto/Library/Developer/Xcode/DerivedData/OpenSCTokenApp-gqjhksedeubjxbelwmozoescrkwy/Build/Products/Debug/OpenSCTokenApp.app/Contents/PlugIns/OpenSCToken.appex)

    Available SmartCards (keychain):

        com.apple.setoken:aks:

        org.opensc-project.mac.opensctoken.OpenSCTokenApp.OpenSCToken:6120018020884007:

          #01: Kind: private RSA 1024-bit, Certificate: {length = 20, bytes = 0x5b83d4e48792badcf270b03f2ec58f3b9339ab53}, Usage: Sign Decrypt Unwrap 
Valid from: 2018-11-13 11:51:11 +0000 to: 2024-11-13 11:50:41 +0000, SSL trust: NO, X509 trust: YES 

-----BEGIN CERTIFICATE-----
MIIFojCCBIqgAwIBAgIDRrfeMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAklUMRcwFQYDVQQKEw5BY3RhbGlzIFMucC5BLjEiMCAGA1UECxMZU2Vydml6aSBkaSBDZXJ0aWZpY2F6aW9uZTElMCMGA1UEAxMcUmVnaW9uZSBMYXppbyAtIENBIENpdHRhZGluaTAeFw0xODExMTMxMTUxMTFaFw0yNDExMTMxMTUwNDFaMIGoMQswCQYDVQQGEwJJVDEXMBUGA1UEChMOQWN0YWxpcyBTLnAuQS4xFjAUBgNVBAsTDVJFR0lPTkUgTEFaSU8xRzBFBgNVBAMTPkxNQVJSVDg1UjExSDUwMUsvNjEyMDAxODAyMDg4NDAwNy5FZTdxb3lrVlFabjFnMkJ4V0ozSVJwamR1SG89MRAwDgYDVQQqEwdST0JFUlRPMQ0wCwYDVQQEEwRBTE1BMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDyEvlbrI98h0FfD+cH8da+UIah9GtvTGrsFiIMLNstQbdeRC1XFf9Kze0hOqTGw48NPM1Tt7bI8QqPWn1992cKQVT2WBuJ64+A6C/z1tp8HOmcfS+BscEk2EhKOX7e1HJE25h/u11M5I1yK0uHtoDYyKHCrk+uwsogBnX+N5CxDQIDAQABo4ICjTCCAokwDgYDVR0PAQH/BAQDAgeAMIH5BgNVHSAEgfEwge4wgawGBStMEAIBMIGiMIGfBggrBgEFBQcCAjCBkhqBj0lkZW50aWZpZXMgWC41MDkgYXV0aGVudGljYXRpb24gY2VydGlmaWNhdGVzIGlzc3VlZCBmb3IgdGhlIGl0YWxpYW4gTmF0aW9uYWwgU2VydmljZSBDYXJkIChDTlMpIHByb2plY3QgaW4gYWNjb3JkaW5nIHRvIHRoZSBpdGFsaWFuIHJlZ3VsYXRpb24uMD0GBiuBHwYFATAzMDEGCCsGAQUFBwIBFiVodHRwczovL3BvcnRhbC5hY3RhbGlzLml0L0luZm8vcG9saWN5MB0GA1UdDgQWBBR2ASEQ7I4TLoJb+osODU64kJ55sjCB5AYDVR0fBIHcMIHZMEmgR6BFhkNodHRwOi8vY3JsMDIuYWN0YWxpcy5pdC9SZXBvc2l0b3J5L0NOU19STEEvUC9SL2dldExhc3RDUkw/bmFtZT1DUkw4MIGLoIGIoIGFhoGCbGRhcDovL2xkYXAwMi5hY3RhbGlzLml0L2NuJTNkQ1JMOCxvdSUzZFJlZ2lvbmUlMjBMYXppbyUyMC0lMjBDQSUyMENpdHRhZGluaSxvJTNkQWN0YWxpcyUyMFMucC5BLixjJTNkSVQ/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdDA/BggrBgEFBQcBAQQzMDEwLwYIKwYBBQUHMAGGI2h0dHA6Ly9vY3NwMDIuYWN0YWxpcy5pdC9WQS9DTlNfUkxBMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFGDPb640beamdJmabJ+jCixN5tXJMA0GCSqGSIb3DQEBBQUAA4IBAQA66BzcC2faiuRQ+BIpsFRTLsS7NZJY2A71dkIY+ESyZ6bDTyJpiOXfRFTjDEC+QoQmXRwUzs6JZLVyiyVxjawPUIAJoI18QnLxB1PheUJn3MLanYzMIRC0eYm0eviFnoZyu5RoOhlrw4C4ZEX5hXKBDPZpYOeS4sd9alv/9XsZuPB87F3MYe+EWGed9zKr3oX8kw81oKgXrDVwbXFTHDg+J7y8WcFoUguj/X1pcgJCAljQyAEh5sWDHhaISWorA6uAbAZCTYtUyqIWDhc8m3TtV6q1XQWQmtYwhO/gp1h+qC38KBUKyGAUW0uY+ofwTGBKuFKp4JAJMJ/AOK72dM37
-----END CERTIFICATE-----


    Available SmartCards (token):

        com.apple.setoken:aks:

        org.opensc-project.mac.opensctoken.OpenSCTokenApp.OpenSCToken:6120018020884007:

          #01: Kind: private RSA 1024-bit, Certificate: {length = 20, bytes = 0x5b83d4e48792badcf270b03f2ec58f3b9339ab53}, Usage: Sign Decrypt Unwrap 
Valid from: 2018-11-13 11:51:11 +0000 to: 2024-11-13 11:50:41 +0000, SSL trust: NO, X509 trust: YES 

-----BEGIN CERTIFICATE-----
MIIFojCCBIqgAwIBAgIDRrfeMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAklUMRcwFQYDVQQKEw5BY3RhbGlzIFMucC5BLjEiMCAGA1UECxMZU2Vydml6aSBkaSBDZXJ0aWZpY2F6aW9uZTElMCMGA1UEAxMcUmVnaW9uZSBMYXppbyAtIENBIENpdHRhZGluaTAeFw0xODExMTMxMTUxMTFaFw0yNDExMTMxMTUwNDFaMIGoMQswCQYDVQQGEwJJVDEXMBUGA1UEChMOQWN0YWxpcyBTLnAuQS4xFjAUBgNVBAsTDVJFR0lPTkUgTEFaSU8xRzBFBgNVBAMTPkxNQVJSVDg1UjExSDUwMUsvNjEyMDAxODAyMDg4NDAwNy5FZTdxb3lrVlFabjFnMkJ4V0ozSVJwamR1SG89MRAwDgYDVQQqEwdST0JFUlRPMQ0wCwYDVQQEEwRBTE1BMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDyEvlbrI98h0FfD+cH8da+UIah9GtvTGrsFiIMLNstQbdeRC1XFf9Kze0hOqTGw48NPM1Tt7bI8QqPWn1992cKQVT2WBuJ64+A6C/z1tp8HOmcfS+BscEk2EhKOX7e1HJE25h/u11M5I1yK0uHtoDYyKHCrk+uwsogBnX+N5CxDQIDAQABo4ICjTCCAokwDgYDVR0PAQH/BAQDAgeAMIH5BgNVHSAEgfEwge4wgawGBStMEAIBMIGiMIGfBggrBgEFBQcCAjCBkhqBj0lkZW50aWZpZXMgWC41MDkgYXV0aGVudGljYXRpb24gY2VydGlmaWNhdGVzIGlzc3VlZCBmb3IgdGhlIGl0YWxpYW4gTmF0aW9uYWwgU2VydmljZSBDYXJkIChDTlMpIHByb2plY3QgaW4gYWNjb3JkaW5nIHRvIHRoZSBpdGFsaWFuIHJlZ3VsYXRpb24uMD0GBiuBHwYFATAzMDEGCCsGAQUFBwIBFiVodHRwczovL3BvcnRhbC5hY3RhbGlzLml0L0luZm8vcG9saWN5MB0GA1UdDgQWBBR2ASEQ7I4TLoJb+osODU64kJ55sjCB5AYDVR0fBIHcMIHZMEmgR6BFhkNodHRwOi8vY3JsMDIuYWN0YWxpcy5pdC9SZXBvc2l0b3J5L0NOU19STEEvUC9SL2dldExhc3RDUkw/bmFtZT1DUkw4MIGLoIGIoIGFhoGCbGRhcDovL2xkYXAwMi5hY3RhbGlzLml0L2NuJTNkQ1JMOCxvdSUzZFJlZ2lvbmUlMjBMYXppbyUyMC0lMjBDQSUyMENpdHRhZGluaSxvJTNkQWN0YWxpcyUyMFMucC5BLixjJTNkSVQ/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdDA/BggrBgEFBQcBAQQzMDEwLwYIKwYBBQUHMAGGI2h0dHA6Ly9vY3NwMDIuYWN0YWxpcy5pdC9WQS9DTlNfUkxBMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFGDPb640beamdJmabJ+jCixN5tXJMA0GCSqGSIb3DQEBBQUAA4IBAQA66BzcC2faiuRQ+BIpsFRTLsS7NZJY2A71dkIY+ESyZ6bDTyJpiOXfRFTjDEC+QoQmXRwUzs6JZLVyiyVxjawPUIAJoI18QnLxB1PheUJn3MLanYzMIRC0eYm0eviFnoZyu5RoOhlrw4C4ZEX5hXKBDPZpYOeS4sd9alv/9XsZuPB87F3MYe+EWGed9zKr3oX8kw81oKgXrDVwbXFTHDg+J7y8WcFoUguj/X1pcgJCAljQyAEh5sWDHhaISWorA6uAbAZCTYtUyqIWDhc8m3TtV6q1XQWQmtYwhO/gp1h+qC38KBUKyGAUW0uY+ofwTGBKuFKp4JAJMJ/AOK72dM37
-----END CERTIFICATE-----

This is output of sc_auth identities

SmartCard: org.opensc-project.mac.opensctoken.OpenSCTokenApp.OpenSCToken:6120018020884007
Paired identities which are used for authentication:
5B83D4E48792BADCF270B03F2EC58F3B9339AB53    Roberto - CNS0 (LMARRT85R11H501K/6120018020884007.Ee7qoykVQZn1g2BxWJ3IRpjduHo=)

and this is output of pkcs11-tool --login --test:

pkcs11-tool --login --test
Using slot 0 with a present token (0x0)
Logging in to "PIN CNS0 (ROBERTO ALMA)".
WARNING: user PIN locked
Please enter User PIN: 
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (CNS0) 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
Verify (currently only for RSA)
  testing key 0 (CNS0)
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
Unwrap: not implemented
Decryption (currently only for RSA)
  testing key 0 (CNS0)  -- can't be used to decrypt, skipping
No errors

I tried but still does not work with chrome/safari

[Tionit]

@Tionit , thanks for testing. I've expanded the previous approach to extend to authentication objects (constraints), please check out frankmorgner/OpenSCToken#15

I just tested the pull request. Everything works now as expected under macOS Catalina. 👍🏼

I have tested authentication with Safari and Chrome and e-mail encryption and decryption with Outlook 16.31. It all worked correctly.

[frankmorgner]

You may still want to notify Apple that the error management in ctkahp needs fixing.

[drazenzubovic]

@frankmorgner, Thx for quick fix.

Where can we find the latest OpenSC_0.20.0.dmg ?

[Tionit]

You may still want to notify Apple that the error management in ctkahp needs fixing.

Yeah, I've already communicated that to Apple. Let's see what happens.

[cjn]

@frankmorgner , Please let us know if OpenSC_0.20.0.dmg is available.

[frankmorgner]

You can test the updated release candidate which installs the fixed OpenSCToken here https://github.com/OpenSC/OpenSC/releases/tag/OpenSC-0.20.0-rc3

[drazenzubovic]

@frankmorgner, I confirm the update made it possible to authenticate from the MacOS with certificates on the smartcard again.
However,
a) certificates are not visible in the Keychain (which possibly might stay like that?), and
b) pairing of certificate with the user now exits with the following error:

SmartCard pairing failed.
Cannot pair SmartCard with the current user.
The operation couldn’t be completed. (TKAuthenticationHintsProvider error -13 - The SmartCard certificate is not trusted.)

The same card/certificate works on the High Sierra!?

[frankmorgner]

Yes, it has been decided by apple that it will not be shown in keychain.

pairing works for me. only by debugging one could tell what's wrong...