Aladdin eToken PRO

Image of eToken PRO 32K

 Aladdin offers the  eToken PRO, an USB crypto token with 32k or 64k memory and support for RSA keys up to 2048bit key length.

The eToken PRO is fully supported by OpenSC and is well tested.

Models

The precise model of your token can be determined from the text moulded in the plastic enclosure.

Unsupported models

There is a rare version of the Aladdin eToken PRO with a G&D Starcos smart card inside. This version never went into mass production as far as we know, and is not supported by OpenSC.

Also there are some smart cards with the "Aladdin eToken" Name on them too. These cards are too old, they are not supported by OpenSC, as they lack some required features.

eToken R1 and R2

Those were the first generation of tokens produced. They use a proprietary protocol for communication between the host and token.

eToken PRO 4.2B

This is the second public release of the device, that use a proprietary protocol for communication. These can still (2009) be found on the cheap on EBay or otherwise.

eToken NG-OTP

This device (and the others below) are compliant with the USB CCID (Chip/Smart Card Interface Devices) standard (see section “Smart Card Class” on  http://www.usb.org/developers/devclass_docs). As such, they don't require a proprietary driver to work with OpenSC.

eToken 64

eToken PRO (newest version)

Support

Aladdin is maybe the oldest player in the USB token field, and their hardware and software predates the standards such as CCID and PKCS#15, so you can't really blame them for not conforming to these standards (especially for older token hardware). See also the Thanks section below, they are a fair player!

Aladdin has an SDK with Documentation on their ftp server for public download, but to implement the OpenSC driver further documentation was necessary (by Siemens and available only under NDA as far as we know).

CardOS-based versions

CardOS versions up to and including M4.20 are supported. (Is CardOS M4.3b also working?) This includes all the CardOS-based token versions listed above except the evaluation boards. In order to make these work with OpenSC, one has to install the proprietary middleware; the proprietary key manager is not needed. See below.

One minor misfeature of the Siemens CardOS M4 is that an RSA key cannot be used for both signing and decryption. OpenSC has implemented a workaround: software key generation and storing that key twice, once marked as decryption key and once marked as signing key. To enable this workaround specify "--split-key" on the command line, when creating the key.

Installation Notes

Aladdin provides their own software, which comprises both the middleware (necessary for all CardOS-based tokens) and the key-management tool ( also for Linux) which is not compatible with PKCS#15. (However, as long as enough memory is available on the chip, it is possible to initialize the token with both OpenSC and this proprietary key manager, and thus install files and keys side by side - each software can then only handle their own structures.)

Mac OS X

Download the  PKIClient 4.55 software package. If you are only interested in the middleware (and not the proprietary key manager), don't install everything at once; rather, follow these steps:

  1. unpack and mount the pkiclient.4.55.41.dmg file
  2. explore the eToken PKI Client 4.55.mpkg directory on it (Ctrl-click then “Show package contents”), then open “Contents” and “Packages”
  3. double-click on the following packages in this order so as to install them:
    • etokenframework.pkg: those are the shared libraries (that will go into /Library/Frameworks/eToken.framework) needed by all the other packages;
    • etokendriversleopard.pkg (for Mac OS 10.5.x) or etokendriverstiger.pkg (for Mac OS 10.4.x): this is the middleware, that goes under /usr/libexec/SmartCardServices/drivers/eTokenIfdh.bundle/ . It consists of an auxillary daemon that will be run by pcscd in order to perform the necessary USB I/O.

To test this setup, plug your token in, then open a terminal and type the following commands:

sudo killall pcscd
sudo /usr/sbin/pcscd -a -d -f

pcscd should start chatting, and the diode on the token should turn on. If pcscd instead says:

Error loading /usr/libexec/SmartCardServices/drivers/eTokenIfdh.bundle/Contents/MacOS/eTokenIfdh:  dlopen(/usr/libexec/SmartCardServices/drivers/eTokenIfdh.bundle/Contents/MacOS/eTokenIfdh, 262)

it means that the middleware is corectly installed, but etokenframework.pkg is not. This happens when one installs the former first (!) In that case, run the Uninstall eToken PKI Client 4.55 program from the .dmg image and start over.

Linux

The middleware for Linux is available here:  ftp://ftp.ealaddin.com/pub/etoken/Linux ; and a third party provides the the  key-management tool for Linux (you don't need the latter if you just want your token to work with OpenSC).

Thanks

Big thanks to  Aladdin, they sponsored an OpenSC workshop in 2003 by donating 30 Aladdin eToken PRO!

Big thanks to  Startcom and Eddy Nigg for lots of time and support in adding support for the Aladdin eToken PRO 64, for lots of testing and for donating one to us.

Big thanks to  ASW, they donated two Aladdin eToken PRO 64, so we could test our support for those Tokens (not yet released, will be included in the next release).

Big thanks to Josef Gillhuber from  Aladdin. He donated two eToken PRO (32k and 64k) on LinuxTag 2006.

Thanks to Roman Stahl, he donated two Aladdin eToken PRO 32k (4.2B), so we could verify: they work fine too.

Attachments