Overview

Mac OS X 10.4 has a native support for smart cards, called Tokend.

Native Mac applications (Safari browser, Mail client) will be able to automatically use the keys on the card that are supported by the Tokend.

There is an OpenSC tokend as part of OpenSC's sca package for Mac OS X. It uses the OpenSC library (the PKCS15 layer, not the pkcs11 lib) and should therefore support the same cards. It can be use together with other OpenSC lib/apps such as the pkcs11 lib for the Mozilla family of browsers and mail clients.

Currently supported are

For more info:

How to build the OpenSC tokend

This is pretty complicated, most is based on the doc "Building Tokend Using the Darwin Build Scripts" that can be requisted on the apple-cdsa mailing list.

Make sure you have Mac OS 10.4.

If you want SVN (subversion): download and install fink [http://fink.sourceforge.net/] and use fink to obtain svn: "sudo fink install svn-client" in a Terminal window.

1. download and install Xcode 2.2 or later from [http://developer.apple.com/tools/]

2. Download, build and install darwinbuild 0.7.2 or later from [http://opendarwin.org/projects/darwinbuild/]

3. Create a disk image to contain the build environment

(This way your regular system won't be modified when all frameworks etc. are downloaded)

(/Volumes/ is where all filesystems like disks, USB sticks and disk images are mounted)

Note: next time you start your Mac, you need to re-open the builds.dmg disk image again before you can work with it: double-click on it in Finder or do "hdiutil attach Builds.dmg in a Terminal window.

4. Download and build the Tokend code from opendarwin

This is done in a subdirectory of /Volumes/Builds/. It's name depends on the 10.4.x version that you have. For example:

** For 10.4.2: Build8C46

** For 10.4.3: Build8F46

In what follows, we assume we are building on 10.4.3.

/usr/local/bin/darwinxref -b 8A428 edit

This opens vi or vim (yes:-) where you have to remove 'i386' from RC_ARCHS (use the arrow keys to go to 'i386', then hit x to delete it, then use the ESC button to go back to normal mode and type :wq or :wq!)

This command will download the Tokend-11 code and all required libs,frameworks,... and build the tokend's as Apple did. It will take a while.

You could try them (first backup the original ones):

** mkdir /System/Library/Security/tokend/backups

** mv /System/Library/Security/tokend/* /System/Library/Security/tokend/backups

** sudo ditto BuildRoot/var/tmp/Tokend/Tokend-11.root / }

The Tokend-11 sources are compressed in Sources/Tokend-11.tar.gz. If you would like to modify them, e.g. to add logging, you can do the following:

** extract them ("cd Sources" and "tar xfz Tokend-11.tar.gz");

** make them writable: chown -R <yourusername> Tokend-11

** then open the project with XCode ("open Tokend-11/Token.xcodproject") and change and save them;

** then run "/usr/local/bin/darwinbuild Tokend". Since the sources already exist, darwinbuild won't download them again but use the existing onces instead.

NOTE: the building seems to go fail somehow sometimes. However, once the libtokend.a has been build, you are far enough. So just check if the file "/Volumes/Builds/Build8F46/BuildRoot/private/var/tmp/Tokend/Tokend-11.obj/UninstalledProducts/libtokend.a" exists.

WARNING: don't run "/usr/local/bin/darwinbuild Tokend" again after you installed and build the OpenSC sources (they will be overwritten)!

5. Obtain and install sca.

In the future this will be available as a installer from OpenSC website, but current you have to get it from SVN:

svn co http://www.opensc.org/svn/sca/trunk/

Just open sca-x.y.z.dmg and install the package (or build it yourself).

After installation, everything should be in /Library/OpenSC/.

6. Obtain and build the OpenSC tokend code.

This is part of sca: http://www.opensc.org/svn/sca/trunk/opensc.tokend/

Now you can build the OpenSC tokend, there's no need to be root anymore. You can either build directly from the command prompt:

** xcodebuild -configuration Deployment

or from within Xcode:

** "open Tokend.xcodeproject" or double-click on it in Finder

** Project -> Set Activate Build Configuration -> Deployment

** Build -> Build

The result should be an OpenSC.tokend bundle in build/Deployment.

To 'deploy' it:

sudo cp -r build/Deployment/OpenSC.tokend /System/Library/Security/tokend/OpenSC.tokend

The Tokend-11/ directory is based on the one from opendarwin:

** The BELPIC, CAC, MuscleCard? and Tokend targets/products were removed from the project

** The BELPIC, CAC and MuscleCard? directories were removed

** The cpp files (not the .h files) from the Tokend dir were removed

(it uses the libtokend.a lib that was made with /usr/local/bin/darwinbuild)

** The project has been modified to build with Xcode instead of with /usr/local/bin/darwinbuild

The opensc.tokend dir contains an optional tokend.conf config file; see this file for more info.