# Estonian eID

OpenSC is the official software for the Estonian eID card for non-WinCSP platforms as well as PKCS#11 provider on all three supported platforms: Windows, Mac OS X, Linux/BSD/*nix

Resources:

- The official home page for the Estonian eID card is http://www.id.ee.
- Martin Paljak has more information (in Estonian) and binary and source downloads: http://ideelabor.ee/id-kaart/. Contact him with any issues and questions regarding EstEID
  - No end-user troubleshooting. End-user support is available from http://support.sk.ee or by calling 1777 from Estonia.
- A nice movie in English that explains the solution: http://www.openxades.org/files/id_movie_eng.mpeg
- And some paperwork: http://www.infosec.co.uk/ExhibitorLibrary/168/EstoniaID_CaseStudy.pdf
- The eID card and surrounding infrastructure is a key component in the e-voting system. General overview of the system can be found from here: http://www.vvk.ee/elektr/docs/Yldkirjeldus-eng.pdf. OpenSC PKCS#11 is used for card access on non-windows platforms (Linux, OS X).

Estonian eID card uses Micardo card driver or a similar MULTOS application. This is what is available on the card (Isikutuvastus = authentication, allkirjastamine = digital signature):

    martin$ pkcs15-tool -D
    Using reader with a card: SCM SPR 532 00 00
    PKCS#15 Card [MARTIN PALJAK]:
    	Version        : 2
    	Serial number  : A1528610
    	Manufacturer ID: AS Sertifitseerimiskeskus
    	Flags          : Read-only, PRN generation, EID compliant

    PIN [PIN1]
    	Com. Flags: 0x0
    	ID        : 01
    	Flags     : [0x00]
    	Length    : min_len:4, max_len:12, stored_len:12
    	Pad char  : 0x00
    	Reference : 1
    	Type      : ascii-numeric
    	Path      :
    	Tries left: 3

    PIN [PIN2]
    	Com. Flags: 0x0
    	ID        : 02
    	Flags     : [0x00]
    	Length    : min_len:5, max_len:12, stored_len:12
    	Pad char  : 0x00
    	Reference : 2
    	Type      : ascii-numeric
    	Path      :
    	Tries left: 3

    PIN [PUK]
    	Com. Flags: 0x40
    	ID        : 03
    	Flags     : [0x40], unblockingPin
    	Length    : min_len:8, max_len:12, stored_len:12
    	Pad char  : 0x00
    	Reference : 0
    	Type      : ascii-numeric
    	Path      :
    	Tries left: 3

    Private RSA Key [Isikutuvastus]
    	Com. Flags  : 1
    	User consent: no
    	Usage       : [0x3F], encrypt, decrypt, sign, signRecover, wrap, unwrap
    	Access Flags: [0x1D], sensitive, alwaysSensitive, neverExtract, local
    	ModLength   : 1024
    	Key ref     : 1
    	Native      : yes
    	Path        :
    	Auth ID     : 01
    	ID          : 01

    Private RSA Key [Allkirjastamine]
    	Com. Flags  : 1
    	User consent: yes
    	Usage       : [0x200], nonRepudiation
    	Access Flags: [0x1D], sensitive, alwaysSensitive, neverExtract, local
    	ModLength   : 1024
    	Key ref     : 2
    	Native      : yes
    	Path        :
    	Auth ID     : 02
    	ID          : 02

    X.509 Certificate [Isikutuvastus]
    	Flags    : 0
    	Authority: no
    	Path     : 3f00eeeeaace
    	ID       : 01

    X.509 Certificate [Allkirjastamine]
    	Flags    : 0
    	Authority: no
    	Path     : 3f00eeeeddce
    	ID       : 02

Known ATR-s of the card are:

- 3B 6E 00 00 45 73 74 45 49 44 20 76 65 72 20 31 2E 30
- 3B 6E 00 FF 45 73 74 45 49 44 20 76 65 72 20 31 2E 30
- 3B DE 18 FF C0 80 B1 FE 45 1F 03 45 73 74 45 49 44 20 76 65 72 20 31 2E 30 2B
- 3B FE 94 00 FF 80 B1 FA 45 1F 03 45 73 74 45 49 44 20 76 65 72 20 31 2E 30 43
- 3B FE 96 00 FF C0 0A 31 FE 4D 45 73 74 45 49 44 20 76 65 72 20 31 2E 30 9B

- Tags
- eID
- maintained
- martin
- readonly
- supported