Opensc: Unsuported Aladdin eToken PRO USB 72k Java

[ieugen]

Hello,

I have a smart card for digital signatures bought from one of our national providers and I wish to use it in Debian GNU/Linux 8. Unfortunately I haven't been able to do so. I've spent the last few days. I need it because I wish to submit my tax forms online, and I'm required to sign them with an approved device.

The card is sold by DigiSign Romania.
Card technical description (Romanian)
Windows drivers for card

In hopes of better support in the future, I'm giving some information bellow:

lsusb

Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 009: ID 12d1:1569 Huawei Technologies Co., Ltd. 
Bus 001 Device 005: ID 1bcf:2c08 Sunplus Innovation Technology Inc. 
Bus 001 Device 004: ID 8087:07da Intel Corp. 
Bus 001 Device 003: ID 08ff:168f AuthenTec, Inc. AES1660 Fingerprint Sensor
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 022: ID 18d1:4ee3 Google Inc. Nexus 4 (tether)
Bus 003 Device 027: ID 0529:0620 Aladdin Knowledge Systems Token JC
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

opensc-tool -l

# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Aladdin eToken PRO USB 72K Java [Main Interface] 00 00

opensc-tool -a

Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
3b:d5:18:00:81:31:fe:7d:80:73:c8:21:10:f4

opensc-tool -n

Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
Unsupported card

opensc-tool --info

OpenSC 0.14.0 [gcc  4.9.2]
Enabled features: zlib readline openssl pcsc(libpcsclite.so.1)

pcscd --version

pcsc-lite version 1.8.13.
Copyright (C) 1999-2002 by David Corcoran <[email protected]>.
Copyright (C) 2001-2011 by Ludovic Rousseau <[email protected]>.
Copyright (C) 2003-2004 by Damien Sauveron <[email protected]>.
Report bugs to <[email protected]>.
Enabled features: Linux x86_64-pc-linux-gnu serial usb libudev usbdropdir=/usr/lib/pcsc/drivers ipcdir=/var/run/pcscd configdir=/etc/reader.conf.d

pkcs15-tool -D

Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
Failed to connect to card: Card is invalid or cannot be handled

[e3krisztian]

I have the same card and same problem.
Ubuntu 14.04.2 LTS, Trusty Tahr

$ lsusb | fgrep Ala
Bus 004 Device 002: ID 0529:0620 Aladdin Knowledge Systems Token JC

This card is mentioned here as working: https://github.com/OpenSC/OpenSC/wiki/Aladdin-eToken-PRO

I found these from 2010 relevant (there is a hint on how to make it work):
https://www.mail-archive.com/[email protected]/msg06228.html
https://www.mail-archive.com/[email protected]/msg06229.html

While https://pcsclite.alioth.debian.org/ccid/unsupported.html:

_The token does not work after a warm reset. See http://www.opensc-project.org/pipermail/opensc-devel/2009-April/012128.html_

what is warm reset?
plugged in after boot?

Unfortunately the link does not work maybe it is one of the emails in this thread:
https://www.mail-archive.com/opensc-devel%40lists.opensc-project.org/msg03808.html

more discussion on the same card:
https://www.mail-archive.com/search?l=opensc-devel%40lists.opensc-project.org&q=aladdin+72k&submit.x=0&submit.y=0

[LudovicRousseau]

I also have such a token:

Bus 001 Device 095: ID 0529:0620 Aladdin Knowledge Systems Token JC

$ opensc-tool -a
Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
3b:d5:18:00:81:31:fe:7d:80:73:c8:21:10:f4

I have the same ATR as @ieugen. From the source code I found:
in NEWS

New in 0.11.0; 2006-05-01; Andreas Jellinghaus
* renamed "etoken" driver to "cardos", as it really is a generic
  driver for Siemens CardOS M4, including but not limited to Aladdin eTokens.

So I looked in src/libopensc/card-cardos.c and found that my ATR is not listed.
I add it:

--- /tmp/6NKfrL_card-cardos.c   2015-06-25 15:49:02.499224301 +0200
+++ src/libopensc/card-cardos.c 2015-06-25 15:47:22.487223750 +0200
@@ -58,6 +58,7 @@ static struct sc_atr_table cardos_atrs[]
    { "3b:d2:18:02:c1:0a:31:fe:58:c8:0d:51", NULL, NULL, SC_CARD_TYPE_CARDOS_M4_4, 0, NULL},
    /* CardOS v5.0 */
    { "3b:d2:18:00:81:31:fe:58:c9:01:14", NULL, NULL, SC_CARD_TYPE_CARDOS_V5_0, 0, NULL},
+   { "3b:D5:18:00:81:31:FE:7D:80:73:C8:21:10:F4", NULL, NULL, SC_CARD_TYPE_CARDOS_M4_4, 0, NULL},
    { NULL, NULL, NULL, 0, 0, NULL }
 };

But the token is not really more supported. It looks like it is recognized.

$ opensc-tool -n
Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
CardOS M4

But not at the PKCS#15 level:

$ pkcs15-tool -D
Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
PKCS#15 binding failed: Unsupported card

And not by cardos-tool:

$ cardos-tool -i
Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
3b:d5:18:00:81:31:fe:7d:80:73:c8:21:10:f4
Some error occurred. Use '-v' several times to enable debug output.

Formatting did not solve the issue:

$ cardos-tool -f
Using reader with a card: Aladdin eToken PRO USB 72K Java [Main Interface] 00 00
Some error occurred. Use '-v' several times to enable debug output.

My conclusion is that this token is _NOT_ supported.

[frankmorgner]

We would be happy to add this card.

If you have some working code we are happy to review a PR. See also https://github.com/OpenSC/OpenSC/wiki/Adding-a-new-card-driver

[e3krisztian]

I have modified https://github.com/OpenSC/OpenSC/wiki/Aladdin-eToken-PRO to warn users that some Aladdin eToken cards are not working, with a reference to this issue.

Why is this issue closed?

[frankmorgner]

1. there has been no progress since half a year
2. nobody is trying to fix this problem

I'd add a "won't fix" label if there was one.

You may reopen the issue if you want to work on 1. or 2.

Also, you're welcome to make a PR with a fix

[ieugen]

I've started working on the driver. I'm following the tutorial from [1] however, when I run
** ./bootstrap ** I get:

libtoolize: copying file `m4/lt~obsolete.m4'
autoreconf: running: /usr/bin/autoconf --force
configure.ac:104: error: possibly undefined macro: AC_DEFINE
      If this token and others are legitimate, please use m4_pattern_allow.
      See the Autoconf documentation.
configure.ac:236: error: possibly undefined macro: AC_MSG_ERROR
configure.ac:329: error: possibly undefined macro: AC_CHECK_LIB
autoreconf: /usr/bin/autoconf failed with exit status: 1

I'm running Debian Jessie.

[1] https://github.com/OpenSC/OpenSC/wiki/Adding-a-new-card-driver

[carlosbpaiva]

I have the same problem - the only way I got the Aladdin eToken PRO USB 72K Java to work was installing the proprietary package which I got from here: https://r3blog.nl/downloads/SAC8_Linux.zip
The post where I foud instruction to setup the token: https://r3blog.nl/index.php/etoken-pro-72k/
After that, worked OK

[WebArtsAG]

Hi everyone... Is there also a driver for MacOS X? As the drivers SAC8_Linux.zip are binary?!

[frankmorgner]

You should ask that where you got the proprietary Linux driver from. It's not related to OpenSC.

[WebArtsAG]

@frankmorgner yes, thank you – sorry :)

[ieugen]

I have collected more information about the token. I made it work on Debian 8 by installing the proprietary drivers (updated for Debian 8). They work with pcscd.

Some output:

Dec 29 01:49:32 daos-mobile kernel: [34733.874749] usb 3-1: USB disconnect, device number 18
Dec 29 01:49:34 daos-mobile kernel: [34736.308131] usb 3-1: new full-speed USB device number 19 using xhci_hcd
Dec 29 01:49:35 daos-mobile kernel: [34736.437805] usb 3-1: New USB device found, idVendor=0529, idProduct=0620
Dec 29 01:49:35 daos-mobile kernel: [34736.437808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Dec 29 01:49:35 daos-mobile kernel: [34736.437810] usb 3-1: Product: Token JC
Dec 29 01:49:35 daos-mobile kernel: [34736.437811] usb 3-1: Manufacturer: Aladdin
Dec 29 01:49:35 daos-mobile kernel: [34736.437950] usb 3-1: ep 0x83 - rounding interval to 1024 microframes, ep desc says 2040 microframes
dec 29 01:49:35 daos-mobile mtp-probe[31858]: checking bus 3, device 19: "/sys/devices/pci0000:00/0000:00:14.0/usb3/3-1"
dec 29 01:49:35 daos-mobile mtp-probe[31858]: bus: 3, device: 19 was not an MTP device
dec 29 01:49:35 daos-mobile pcscd[31603]: 20765935 APDU: 00 A4 04 00 0F D2 33 00 00 00 45 73 74 45 49 44 20 76 33 35
dec 29 01:49:35 daos-mobile pcscd[31603]: 00096250 SW: 6A 82
dec 29 01:49:35 daos-mobile pcscd[31603]: 00004891 APDU: 00 CA DF 30 05
dec 29 01:49:35 daos-mobile pcscd[31603]: 00004991 SW: 67 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00005637 APDU: 00 A4 04 00 05 A0 00 00 00 01
dec 29 01:49:35 daos-mobile pcscd[31603]: 00006317 SW: 6A 82
dec 29 01:49:35 daos-mobile pcscd[31603]: 00010226 APDU: 00 A4 04 00 09 A0 00 00 03 08 00 00 10 00 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00006190 SW: 6A 82
dec 29 01:49:35 daos-mobile pcscd[31603]: 00010257 APDU: 00 A4 04 00 09 A0 00 00 03 08 00 00 10 00 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00006255 SW: 6A 82
dec 29 01:49:35 daos-mobile pcscd[31603]: 00046995 APDU: 80 1C 00 00 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00095035 SW: 6D 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00000070 APDU: 00 A4 04 00 07 A0 00 00 03 12 02 02 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00005277 SW: 6F 10 84 07 A0 00 00 03 12 02 02 A5 05 9F 65 02 02 12 90 00
dec 29 01:49:35 daos-mobile pcscd[31603]: 00000061 APDU: 80 17 00 00 20
dec 29 01:49:35 daos-mobile pcscd[31603]: 00010465 SW: B8 66 46 FD 5B A5 A3 34 D3 A2 AB F4 36 EA 63 8D 3D AD 14 CB 6A 5E AB 90 5C 71 EF E6 8B 54 F1 21 90 00

If needed I can post the full pcscd debug log.

NOTE: There is a bug in the Debian config/pcscd. If you take the token out and put it back it will not be visible. To fix this you need to tell pcscd to run with --apdpu option. I've added the option to my systemd file like below. It kind of makes no sense because --apdpu is supposed to print stuff but I imagine it slows things down a bit and makes the requests to the hardware after it has time to initialize. This is just a guess however. Maybe @LudovicRousseau can shed some light into this.

cat /lib/systemd/system/pcscd.service 
[Unit]
Description=PC/SC Smart Card Daemon
Requires=pcscd.socket

[Service]
ExecStart=/usr/sbin/pcscd --foreground --auto-exit --apdu
ExecReload=/usr/sbin/pcscd --hotplug

[Install]
Also=pcscd.socket

[beholders-eye]

@ieugen, which version of pcscd and libpcsclite are you using? I'm using the last one (1.8.16) and I'm still getting:

... pcscd[947]: 00000005 winscard.c:1633:SCardTransmit() Card not transacted: 0x80100016 ... pcscd[947]: 00005638 ifdwrapper.c:550:IFDTransmit() Card not transacted: 612

I've installed SAC8_Linux.zip.

Thanks in advance.

[ieugen]

I'm using Debian stable versions 1.18.13 .
I also have installed the SAC 9 and it works fine but it was very hard for me to get the package as it is not easily available to download.

I can give teamvier access to my system for developers who need to find out details about implementing this token in pcscd / opensc.

[1] https://packages.debian.org/jessie/pcscd
[2] https://packages.debian.org/jessie/libpcsclite1

[beholders-eye]

Did you get this SAC 9 with Aladdin?

[ieugen]

Not exactly. I went to all of the local providers/sellers of tokens and asked for one that worked with Debian/Linux . One of them gave me the driver but it was not the one from which I bought it. [1]

[1] http://netdava.com/downloads/sac_9.0.43_Debian_Ubuntu_Linux.zip

[qsantos]

Same issue with a device engraved "eToken PRO 72K (Java)", with identical USB vendorID and productID, but presented as:

Using reader with a card: SafeNet eToken 5100 [Main Interface] 00 00
Unsupported card

Installing SAC8_Linux.zip does not seem to have helped.

[ieugen]

@qsantos have you tried version 9 from the link I gave?

[dengert]

Is it a requirement that you use the token used for your taxes with its existing certificates and keys?
If not, I would suggest buying some other card that has Linux, Windows and MacOS support either from the
vendor or open source.

If you need to use that card, you either need to find documentation on the application that is used
on that card. A card is like a computer, the ATR describes some attributes about card, but not the
program it is running. Many governments that issue cards to citizens have some public documentation
on how the application on the card works. It usually describes the APDUs and file formats.

If you can find a working PKCS#11 module, great. The SAC file I looked contained /usr/lib/libeTPkcs11.so.
Based on the SafenetAuthenticationClient. Look for other SafenetAuthenticationClient packages from
GemAlto. The module is a PKCS#11 module. Mozilla, SSH and PAM can use PKCS#11 modules so its a good standard
to use.

OpenSC has many utilities that can work directly with most PKCS#11 modules and OpenSC has its own opensc-pkcs11.so
that can work with cards (with selected applications) that OpenSC supports.
(OpenSC also has utilities and other drivers that bypass PKCS#11 and only work with cards supported by OpenSC.)

All smartcard middleware use PCSC, this includes Windows, Linux and Mac. If you need to write OpenSC support for
some card and application a APDU trace of a working card can help. If the card works on Windows a USB trace with
the APDUs can also help. But some cards are now using Secure Messaging so the data in these traces is encrypted
and not very helpful.

On 5/1/2016 4:40 PM, Ioan Eugen Stan wrote:

@qsantos https://github.com/qsantos have you tried version 9 from the link I gave?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub https://github.com/OpenSC/OpenSC/issues/461#issuecomment-216074568

Douglas E. Engert [email protected]

[qsantos]

@ieugen I had omitted testing with this version; opensc-tool -l does detect my token now. Thanks a lot!

[dengert]

One of the best tests you could do, is to run pkcs11-tool --module /usr/lib/libeTPkcs11.so -O
(or whatever the module that you are working with.) This would show if the vendor's PKCS#11 lib works. Other pkcs11-tool commands could be tested too.

if it does, then run pcscd -d -a 2> /tmp/pcscd.trace
This would show the APDU commands used by the module to find the objects on the card.
(Note it will show your PIN too.)

[qsantos]

/usr/lib/libeTPkcs11.so makes both pkcs11-tool and Thunderbird crash:

~% pkcs11-tool --module /usr/lib/libeTPkcs11.so -O                   
pkcs11-tool: CRYPTO/Crypto.c:247: init_openssl_crypto: Assertion `lib' failed.
zsh: abort      pkcs11-tool --module /usr/lib/libeTPkcs11.so -O

However, /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so seems to be accepted by Thunderbird (token shows up), and makes pkcs11-tool exit normally (and even make the token blink!).

~% pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -O
No slot with a token was found.

Thus pcscd, does nothing either:

~# pcscd -d -a 
~# echo $?     
1

At least opensc-tool does work:

~% opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             AKS ifdh [Main Interface] 00 00

I'll keep looking around. I am not even sure what I am looking for: should "Log In" become enabled in Mozilla's "Security devices" interface?

Anyway, your help is greatly appreciated!

[dengert]

On 5/2/2016 1:40 PM, Quentin Santos wrote:

|/usr/lib/libeTPkcs11.so| makes both pkcs11-tool and Thunderbird crash:

|~% pkcs11-tool --module /usr/lib/libeTPkcs11.so -O pkcs11-tool: CRYPTO/Crypto.c:247: init_openssl_crypto: Assertion `lib' failed. zsh: abort pkcs11-tool --module /usr/lib/libeTPkcs11.so -O |

OK, libeTPkcs11.so was part of the SAC package someone else said might work. It might be the wrong module.

Use the ldd command to look at each program and module to see what libraries they need.
Also make sure all are 64 bit or all are 32 bit.

CRYPTO/Crypto.c:247 does not sound like it in part of OpenSC,
It may be part of libeTPkcs11.so.

init_openssl_crypto sounds like it is looking for some version of OpenSSL.
Maybe it is looking in the wrong place,
you may need to set environment LD_LIBRARY_PATH= with the paths to missing libs.

OpenSC also has a PKCS#11 SPY module to trace PKCS#11 calls.

OpenSC has a opensc.conf with a debug = and debug_output =
Only works with OpenSC tools and modules.

However, |/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so| seems to be accepted by Thunderbird (token shows up), and makes pkcs11-tool exit normally (and even make the token blink!).

|~% pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -O No slot with a token was found. |

Thus |pcscd|, does nothing either:

|~# pcscd -d -a ~# echo $? 1 |

pcscd is normally a system process, as root you may have to kill it first then restart with options.
If using all OpenSC programs and module, the opensc.conf debug= will give a lot more info then the pcscd trace.

At least |opensc-tool| does work:

|~% opensc-tool -l # Detected readers (pcsc) Nr. Card Features Name 0 Yes AKS ifdh [Main Interface] 00 00 |

Yes but it did not get very far.
The opensc.conf debug= or add a few -v -v -v to any opensc program.

I'll keep looking around. I am not even sure what I am looking for: should "Log In" become enabled in Mozilla's "Security devices" interface?

The Mozilla Security Devices are really PKCS#11 modules. If you can't get some GemAlto or OpenSC's opensc-pkcs11.so
using pkcs11-tool to even find the token, then Mozilla won't find it either.

Anyway, your help is greatly appreciated!

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub https://github.com/OpenSC/OpenSC/issues/461#issuecomment-216323155

Douglas E. Engert [email protected]

[qsantos]

I just tried PAC 8.1 and now everything works (using /usr/lib64/libeTPkcs11.so):

• # pkcs11-tool --module /usr/lib64/libeTPkcs11.so -t does show the device
• # pkcs11-tool --module /usr/lib64/libeTPkcs11.so -O does list the certificates on the device
• Mozilla does enable 'Log in' once I add /usr/lib64/libeTPkcs11.so

Thanks a lot for giving directions and helping me with making it work!

[evereklili]

Here is Turkey. My name is Omer(evereklili) www.omerdogu.com.tr.
I using Kali-Lİnux(Debian base) and Alaaddin etoken using. But problem is Java and Java program different directory? because for example vatandas.uyap.gov.tr/vatandas/ or https://giris.turkiye.gov.tr/Giris/Elektronik-Imza . I live problem because my computer reading (mozilla firefox or Icedo... (thunderbird) my certificate and https://giris.turkiye.gov.tr/Giris/Elektronik-Imza do not entered. ...Plase help me..

[evereklili]

problem is different directory pkcs11-tool --module /usr/lib64/libeTPkcs11.so -O (this code do not reading because system's do not see)
pkcs11-tool --module /usr/lib/libeTPkcs11.so -O this code (level is root) reading.

[evereklili]

pkcs11-tools ... change lib or lib64

[jcpunk]

I just got one of these, the v9 tool kit works with it. Adding lsusb output to help direct search results here.

$ lsusb -v
Bus 001 Device 003: ID 0529:0620 Aladdin Knowledge Systems Token JC
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0529 Aladdin Knowledge Systems
  idProduct          0x0620 Token JC
  bcdDevice            0.19
  iManufacturer           1 SafeNet
  iProduct                2 Token JC
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           93
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower               50mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass        11 Chip/SmartCard
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              4 eToken 5110 SC
      ChipCard Interface Descriptor:
        bLength                54
        bDescriptorType        33
        bcdCCID              1.10  (Warning: Only accurate for version 1.0)
        nMaxSlotIndex           0
        bVoltageSupport         7  5.0V 3.0V 1.8V 
        dwProtocols             3  T=0 T=1
        dwDefaultClock       4800
        dwMaxiumumClock      4800
        bNumClockSupported      0
        dwDataRate          12903 bps
        dwMaxDataRate       12903 bps
        bNumDataRatesSupp.      0
        dwMaxIFSD             254
        dwSyncProtocols  00000000 
        dwMechanical     00000000 
        dwFeatures       0001027C
          Auto activation on insert
          Auto voltage selection
          Auto clock change
          Auto baud rate change
          Auto parameter negotation made by CCID
          NAD value other than 0x00 accpeted
          TPDU level exchange
        dwMaxCCIDMsgLen       271
        bClassGetResponse      00
        bClassEnvelope         00
        wlcdLayout           none
        bPINSupport             0 
        bMaxCCIDBusySlots       1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval              16
Device Status:     0x0000
  (Bus Powered)

[pavebul]

dengert, thanks! "CRYPTO/Crypto.c:247: init_openssl_crypto: Assertionlibfailed." indeed means path failure.

strace:

open("/lib/x86_64-linux-gnu/libcrypto.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/libcrypto.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/libcrypto.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/usr/lib/libcrypto.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
munmap(0x7fc6ca9e9000, 104756)          = 0
write(2, "SACSrv: CRYPTO/Crypto.c:247: ini"..., 74SACSrv: CRYPTO/Crypto.c:247: init_openssl_crypto: Assertion `lib' failed.
) = 74

libcrypto in my Debian 9 is /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2

This dirty hack worked:
sudo ln -s /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 /usr/lib/libcrypto.so.6

[ghrt20]

I have a slightly different Alladdin eToken 72K Java:

bash-4.4# opensc-tool -a
Using reader with a card: AKS ifdh [Main Interface] 00 00
3b:d5:18:00:81:31:fe:7d:80:73:c8:21:10:f4

I've installed it on Slackware 14.2 x64 (current, in fact) with binary drivers version 10.0.32. Look for SAC_10_0_Post_GA_Linux.zip or SAC_10_0_Linux.zip.
You also need:
pcsc-lite-1.8.23, I used Slackbuild for 14.2, no changes required except updating the version. This script also takes care of setting up user and group for _pcscd_ and various empty directories.
opensc-0.17.2, same Slackbuild, I had to modify it a little bit: version of XSLT, a file (ChangeLog) was missing from package, updating the version. The script compiles by default without OpenCT support. If you already have OpenCT installed be sure to remove it. Also CCID driver tries to steal the eToken USB device, but it won't work.
Then I wrote some udev rules for permissions to USB device:

bash-4.4# cat /etc/udev/rules.d/01_etoken.rules 
# If not adding the device, go away
ACTION!="add", GOTO="pcscd_ccid_rules_end"
SUBSYSTEM!="usb", GOTO="pcscd_ccid_rules_end"
ENV{DEVTYPE}!="usb_device", GOTO="pcscd_ccid_rules_end"

# Aladdin eToken Pro 72k
ATTRS{idVendor}=="0529", ATTRS{idProduct}=="0620", GROUP="pcscd", MODE="0777"

# All CCID devices
ATTRS{bInterfaceClass}=="0b", RUN+="/bin/chgrp pcscd $root/$parent"

# All done
LABEL="pcscd_ccid_rules_end"

I start _pcscd_ daemon before _SACSrv_ because that is the order they are connecting to each other.
The last and most time consuming part was to link the actual binary driver/ handler for AKS ifdh from eToken files to pcsc/drivers.
bash-4.4# ls /usr/lib64/pcsc/drivers/aks-ifdh.bundle/Contents/Linux/ libAksIfdh.so libAksIfdh.so.10.0 readme.txt
Be sure to link from *.so.10.0 to just *.so, otherwise _pcscd_ daemon won't find the USD driver when needed.
Now everything should work. One may use SACTools to inspect and modify the eToken and SACMonitor to have a fast starter and selecting between devices, or the usual command line open source tools.

If any problem arise, run _pcscd_ in foreground with full debug options and hotplug and you will see the probing of all USB devices.

Hopes that helps and if you need further information please message me. Unfortunately it doesn't improve the open source driver, but it works, al least. Driver seems to be the same as for the newer eTokens, so fortunately might be maintained by Gemalto.

[LudovicRousseau]

@ghrt20 why do you need the udev rule?
pcscd is running as root so no need to change the devices access rights. Unless Slackware is doing something different (I never used Slackware yet)

[ghrt20]

Slack is doing different because there is a security concern here. There is even a Slackie spec that user and group _pcscd_ should have a certain UID&GID and _pcscd_ should be run only under this credentials, with no root privileges. In fact, all the device system doesn't need privileges. The SlackBuild script takes care of ownership and access right of ordinary folders used by _pcscd_.
Even if I use my computer as desktop, I work as an ordinary user and all processes run like that, never had a problem.

From SACTools, info about token:

HW ver: 4.29
FW ver: 1.0
Product name: eToken PRO Java 72K OS755
Model Token 4.29.1.1.1.0
Card type: Java card
OS version: eToken Java Applet 1.1.25
Supported key size: 2048 bits

[odelcourt]

Had the same problem. I have installed SAC 10.0.32 and everything is running fine.
I have received the software via GlobalSign from which our USB dongle was bought :

https://www.globalsign.com/en/safenet-drivers/USB/10.0/SAC_10.0_Post_GA_Linux.zip

Hope it can help as this thread had help me to understand what was going on with this GlobalSign USB dongle.

[swaechter]

@pavebul Thank you very much for the strace hint - I also had the same assertion problem. Installing libssl-dev did the trick without a symlink:

https://packages.debian.org/search?searchon=contents&keywords=libcrypto.so&mode=exactfilename&suite=stable&arch=any

[vinyanalista]

@pavebul

dengert, thanks! "CRYPTO/Crypto.c:247: init_openssl_crypto: Assertionlibfailed." indeed means path failure.

I've got that same error message on openSUSE Leap 15.0 64-bit using SafeNet Authentication Client 9.1.7.0.

libcrypto in openSUSE Leap 15.0 is /usr/lib64/libcrypto.so.1.1 (provided by the libopenssl1_1 package)

So, I did the same as you:

# ln -s /usr/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.6

[ffabreti]

Hey this topic was really helpful, thanks.
I managed to make it work with Windows7 + OpenSC + OpenSSL
I mean, generate keys, encrypt, decrypt.
For googlers, my notes (contains some portuguese texts):

REFERÊNCIAS

https://wiki.nikhef.nl/grid/Using_an_Aladdin_eToken_PRO_to_store_grid_certificates

#EXEMPLOS DE USO DE PKCS11-TOOL

https://wiki.nikhef.nl/grid/Storing_your_grid_certificate_on_an_Aladdin_eToken

#EXEMPLOS PARA GERAR CHAVE PRIVADA NO ETOKEN        

https://opensc-devel.narkive.com/Tk7qtmh7/openssl-pkcs11-engine-etpkcs11-dll-on-windows

the Aladdin initialization doesn't do a pkcs15/opensc compatible setup. The pkcs11 tools should be capable of working with the eTpkcs11.dll, then the openssl engine should, in theory, be able to load it (eTpkcs11.dll) to accomplish everything (?) that could be accomplished with a key initialized with the opensc code.

Have you tried using the pkcs11-spy dll to trace the pkcs11 activity between the pkcs11-tool.exe (or the openssl engine_pkcs11) and the eTpkcs11.dll?

As Nils mentioned, the opensc initialization is pkcs15 compatible, while the    etoken's native setup isn't, so this successful result won't help you unless you can move everything over to opensc. Since there's not currently a MS-compatiable Cryptographic Service Provider(?) for opensc, this can be a problem integrating with MS software.

https://github.com/OpenSC/OpenSC/wiki/SmartCardHSM

#explica como extrair a chave publica gerada no eToken

https://github.com/OpenSC/OpenSC/wiki/Using-pkcs11-tool-and-OpenSSL

# referência de vários comandos

​
​

EXEMPLOS DE COMANDOS

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" --login --test

​ Using slot 0 with a present token (0x0)
​ Logging in to "fer-etoken".
​ Please enter User PIN: C_SeedRandom() and C_GenerateRandom():
​ seems to be OK
​ Digests:
​ all 4 digest functions seem to work
​ MD5: OK
​ SHA-1: OK
​ Signatures (currently only for RSA)
​ Signatures: no private key found in this slot
​ Verify (currently only for RSA)
​ No private key found for testing
​ Key unwrap (currently only for RSA)
​ Decryption (currently only for RSA)
​ No errors

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" -I

​ Cryptoki version 2.20
​ Manufacturer SafeNet, Inc.
​ Library SafeNet eToken PKCS#11 (ver 8.1)
​ Using slot 0 with a present token (0x0)

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" -L

​ Available slots:
​ Slot 0 (0x0): AKS ifdh 0
​ token label : fer-etoken
​ token manufacturer : SafeNet, Inc.
​ token model : eToken
​ token flags : login required, rng, token initialized, PIN initialized, other flags=0x200
​ hardware version : 4.30
​ firmware version : 1.0
​ serial num : 01c5f0a2
​ pin min/max : 6/16
​ Slot 1 (0x1): AKS ifdh 1
​ (empty)
​ Slot 2 (0x2): Rainbow Technologies iKeyVirtualReader 0
​ (empty)
​ Slot 3 (0x3): Rainbow Technologies iKeyVirtualReader 1
​ (empty)

"C:\Program Files\OpenSC Project\OpenSC\tools\opensc-tool" -c gpk -n

​ Using reader with a card: AKS ifdh 0
​ Gemplus GPK

"C:\Program Files\OpenSC Project\OpenSC\tools\opensc-tool" -c gpk --list-algorithms

​ Using reader with a card: AKS ifdh 0
​ Algorithm: rsa
​ Key length: 512
​ Flags: padding ( pkcs1 ansi iso9796 ) hashes ( sha1 MD5 md5-sha1 )
​ RSA public exponent: 65537

Algorithm: rsa
Key length: 768
Flags: padding ( pkcs1 ansi iso9796 ) hashes ( sha1 MD5 md5-sha1 )
RSA public exponent: 65537

Algorithm: rsa
Key length: 1024
Flags: padding ( pkcs1 ansi iso9796 ) hashes ( sha1 MD5 md5-sha1 )
RSA public exponent: 65537

Gerando par de chaves dentro do eToken

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" --keypairgen --key-type rsa:2048 --login --label "fabreti" --id 10

​ Using slot 0 with a present token (0x0)
​ Logging in to "fer-etoken".
​ Please enter User PIN: Key pair generated:
​ Private Key Object; RSA
​ label: fabreti
​ ID: 10
​ Usage: decrypt, sign, unwrap
​ Public Key Object; RSA 2048 bits
​ label: fabreti
​ ID: 10
​ Usage: encrypt, verify, wrap

Exportando chave pública do token

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" --id 10 --read-object --type pubkey --output-file c:\temp\fabreti-pubkey.der

Using slot 0 with a present token (0x0)

Converter chave pública exportada do eToken do formato DER para formato PEM

"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" rsa -inform DER -outform PEM -in c:\temp\fabreti-pubkey.spki -pubin > c:\temp\fabreti-pubkey.pub

>

writing RSA key

Testando as chaves criptografando e des-criptografando um arquivo

>echo "este é um teste de criptografia usando CLI" > c:\temp\data

"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" rsautl -encrypt -inkey c:\temp\fabreti-pubkey.pub -in c:\temp\data -pubin -out c:\temp\data.crypt

"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool"  --module "C:\windows\system32\eTPKCS11.dll" --id 10 --decrypt -m RSA-PKCS --input-file c:\temp\data.crypt
Using slot 0 with a present token (0x0)
Logging in to "fer-etoken".
Please enter User PIN: 
Using decrypt algorithm RSA-PKCS
"este é um teste de criptografia usando CLI"

[dutty5]

Aladdin eToken Pro Java 72K (SafeNet 5100) is supported by opensc on both Linux and Mac OS X (up to Mac OS Mojave at least, as of date of writing). However, creating independent PKCS#15 file structure and use of opensc's own opensc-pkcs11.so module or tools like pkcs15-init/pkcs15-tool (like in older eToken PRO 64k cardos-based tokens) are not supported. As such, manipulation should be done with pkcs11-tool with --module pointing to proprietary module from SafeNet:

Download GPG key and Safenet Authentication Client rpm or deb from here: https://support.comodo.com/index.php?/Knowledgebase/Article/View/1211/106/safenet-download-for-ev-codesigning-certificates
or from
https://installer.id.ee/media/etoken/ (version SAC_10_0_Post_GA_Linux.zip is currently the latest)

For example, on Centos 7:

# yum install pcsc-lite opensc
# rpm --import RPM-GPG-KEY-SafenetAuthenticationClient
# rpm -Uvh SafenetAuthenticationClient-core-10.0.32-0.x86_64.rpm
# reboot
$ pkcs11-tool --module /usr/lib64/libeTPkcs11.so -l -O

To initialize token:

$ pkcs11-tool --module /usr/lib64/libeTPkcs11.so --init-token --label 'MyToken'
$ pkcs11-tool --module /usr/lib64/libeTPkcs11.so --init-pin --login
$ pkcs11-tool --module /usr/lib64/libeTPkcs11.so --login --keypairgen --key-type rsa:2048 --id 10 --label "HSM RSA MyToken"

To read and export public key in various formats:

$ pkcs11-tool --module /usr/lib64/libeTPkcs11.so -r --id 10 --type pubkey > ~/.ssh/MyToken.pub.der
$ openssl rsa -inform DER -outform PEM -in ~/.ssh/MyToken.pub.der -pubin > ~/.ssh/MyToken.pub.pem
$ ssh-keygen -f ~/.ssh/MyToken.pub.pem -i -mPKCS8 > ~/.ssh/MyToken.ssh.pub
$ cat ~/.ssh/MyToken.ssh.pub

Use example with ssh:
$ ssh -I /usr/lib64/libeTPkcs11.so [email protected]
or add the line
PKCS11Provider /usr/lib64/libeTPkcs11.so
into ~/.ssh/config

On MacOS:

1) Download and install opensc for Mac from here: https://github.com/OpenSC/OpenSC/releases (0.19 is the latest version as of writing)
2) Download and install Safenet Authentication Client for Mac from here: https://support.comodo.com/index.php?/Knowledgebase/Article/View/1211/106/safenet-download-for-ev-codesigning-certificates or from https://installer.id.ee/media/etoken/ (latest version as of writing is mac_10.2.82.0.zip)
3) reboot
4) check that you can communicate with the card:
$ pkcs11-tool --module /usr/local/lib/libeToken.dylib -l -O

To initialize token:

$ pkcs11-tool --module /usr/local/lib/libeToken.dylib --init-token --label 'MyToken'
$ pkcs11-tool --module /usr/local/lib/libeToken.dylib --init-pin --login
$ pkcs11-tool --module /usr/local/lib/libeToken.dylib --login --keypairgen --key-type rsa:2048 --id 10 --label "HSM RSA MyToken"

To read and export public key:

$ pkcs11-tool --module /usr/local/lib/libeToken.dylib -r --id 10 --type pubkey > ~/.ssh/MyToken.pub.der
$ openssl rsa -inform DER -outform PEM -in ~/.ssh/MyToken.pub.der -pubin > ~/.ssh/MyToken.pub.pem
$ ssh-keygen -f ~/.ssh/MyToken.pub.pem -i -mPKCS8 > ~/.ssh/MyToken.ssh.pub
$ cat ~/.ssh/MyToken.ssh.pub

Latest Mac OS X versions use system preinstalled OpenSSH compiled with LibreSSL (instead of OpenSSL). This breaks the use of /usr/local/lib/libeToken.dylib as PKCS11Provider in OpenSSH client ('Assertion failed' bug). Workaround is the use of homebrew installed OpenSSH client:

$ brew install openssh --with-openssl
$ /usr/local/bin/ssh -I /usr/local/lib/libeToken.dylib [email protected]

You may need to close the Terminal window and open again to use newly installed OpenSSH client without providing full path:
$ ssh -I /usr/local/lib/libeToken.dylib [email protected]
or add the line
PKCS11Provider /usr/local/lib/libeToken.dylib
into ~/.ssh/config to use shorter command line:
$ ssh [email protected]

See also very useful post here: https://r3blog.nl/index.php/etoken-pro-72k/

[ghrt20]

I understand that they put into their package the binaries from Gemalto/SafeNet windows driver? If that's correct, it won't work on other architectures (ARM, Android etc).
Ref r3blog: On my Slack I had to remove OpenCT in order to correctly load driver.