Re: [Lilux-help] A FLOSS driver for LuxTrust-issued smartcards

On 12/01/11 17:33, Lionel Elie Mamane wrote: ok... I guessed that much, but still wanted to be sure. As far as I know, they market it as being "more professional", not more secure, and this has more to do with the features that Luxtrust's PKI supports on the various media, rather than the intrinsic security. Most important feature here is that the credit-card sized cards support signature by multiple cards, which is useful in an enterprise context if signatures of more than one decision-taker are necessary to validate a given business transaction. Moreover, Luxtrust provides a fraud insurance with their media, and the amount insured is higher for the credit cards than for the SIMs. Another fun fact is that the sticks are guaranteed for 5 years, but the credit cards only for 3. Apparently, this is for purely mechanical reasons: contacts of the credit cards wear faster than for the sticks (because the SIM is only inserted into the stick once, and then stays there), and so the credit card would never last 5 years. Interesting. No Pb Yes, noticed that too (... but only had noticed it _after_ I've already found it out by other means...) Weird. I use it on an Ubuntu 10.04, which is also fairly recent (came out last year). But I did notice that opensc based _applications_ cannot use the Gemsafe PKCS11 module (even on older Ubuntu 8.04), supposedly because the two copies of opensc "fight" each other (the "dynamical" copy pulled in by the app, and the static one brought by the PKCS11 module). No such problem exists for apps that don't use OpenSC directly (such as Firefox). Btw, this is how I first noticed that Gemsafe uses OpenSC :-) It might be interesting to see whether the Gemsafe module fails on lenny for all apps (including Firefox), or only for those that use OpenSC (various handy command line "test tools") Also, legally, their licenses are an interesting mess. They did include the LGPL for openSc in their package, but then put their own license (for the proprietary parts) next to it, and both licenses basically contradict each other (and there is no text which says which should count more). I would guess, in case of doubt the OpenSC LGPL license should count, because they would not legally be allowed to "remove" anything from the OpenSC license or else they would forfeit their right to build upon OpenSC... As far as the java JNI "shim" that loads the original gemsafe lib by absolute path is concerned, maybe this could be tricked by renaming the open source driver? Theoretically, the JNI shim should only depend on PKCS11 standard APIs, so this might work... the C PKCS11 API) was lacking some features which they "needed" (such as chosing among more than one card that might be present), so they had to resort to this "hack" if they wanted to offer these features from Java. The C PKCS11 API does have the required features, so there is no reason why any standard complying PKCS11 module shouldn't work, if it had the "correct" name.... Regards, Alain