3

I develop an application to sign file XML with a public key and a private key stored on a smart card (IAS-ECC). I know that my smart card has two certificates (one used for authentication, one used for signature) and private keys. With that in mind, I search desperately documentations and examples to sign correctly my file (the size varies between 4 and 10 ko). All in all, I want obtain a P7M file.

So, my questions are: how to do this? Do I use some libraries like OpenSSL or PKCS11? For the moment, I only try to use APDU commands, but with no results. I would like to know all the steps to do this.

In addition, I discovered on my smart card a CSP (“Cryptographic Service Provider”) by sending APDU commands. Is it useful?

I should specify that I develop on C# with Compact Framework (3.5). If you’ve got an idea, I’m very happy to hear that.

Thank you by advance for your help!

Best regards

Amatukami
  • 93
  • 1
  • 7

1 Answers1

1

If you have PKCS11 driver DLL for the smartcard reader and/or smartcard, that would be an ideal option. This will give you easy to use way to sign the data.

I am not sure that OpenSSL will be able to access the smartcard (at least without modifying the source code) but I am not an expert in OpenSSL. What I know is that our SecureBlackbox would do the job (if you can use PKCS11).

On a side note, are you sure that you need to get PKCS#7 signature (P7M extension implies this)? XML files are often signed using XMLDSig or XAdES (extension of XMLDSig). Or it can be that you need a detached PKCS#7 signature. You need to check the requirements.

Eugene Mayevski 'Callback
  • 45,135
  • 8
  • 71
  • 121
  • Thank you for your help! Unfortunately, I have not a PKCS11 driver DLL for the smardcard. Instead of PKCS11 dll, can I use a Crypto API DLL for the same job? – Amatukami Sep 08 '14 at 14:20
  • @Amatukami if the certificate is accessible via CryptoAPI , then you can use that interface (there's no DLL there, as CryptoAPI is windows system interface). Our SecureBlackbox supports CryptoAPI natively and so does .NET framework. – Eugene Mayevski 'Callback Sep 08 '14 at 14:24