Ken.
Great comments!
Follow up, questions on the following comments.
In the case where the key is on a smartcard, the appropriate tokend
module's callback function will be invoked to perform the operation.
How securityd recognizes if a key is on a smartcard or in a
file-based keychain? Is there a flag can be set for a key to tell
this?
There are a number of callback functions that a tokend module must
provide. securityd will call your tokend's provided callbacks to read
the contents of the card, sign or encrypt data, change the card's
PIN,
and so on. You don't have to actually perform an operation with the
card, of course... you're free to tell the world "this card
contains a
private key named 'foo'", and when securityd calls you to sign
data with
that private key, you can actually go off and have the data signed
on a
server (while pretending the card performed the operation), then hand
the signed data back to the caller.
Yes. This is really what I want.
Yes, if you can require the user to insert a smartcard which is
managed
by your tokend module. As I suggested above, when your module is
asked
to perform cryptographic operations, you can handle in whatever
way you
like, such as communicating with a server to do the actual work.
I don't understand why we have to insert a smartcard. If we can
create a "virtual card" to mimic a real smartcard behavior, a tokend
module, I mean my >>> tokend, to manage this "virtual card" should be
fine. As you said, the tokend definitely needs to "provide" all the
cryptographic function that
securityd requires.
You won't be able to simply store a dummy key in a normal file-based
keychain, because then any cryptographic operations for that key
will be
handled by the Apple CSP/DL.
I agree. So do I still need create a keychain? Yes, the path
should
point to the "virtual card", right?
Thanks a lot,
Ben
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Apple-cdsa mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/apple-cdsa/will.hickie%
40hisc.com
This email sent to email@hidden
