# TCOS based preformatted cards

Telesec GmbH, Deutsche Post and Kobil GmbH are german companies that sell TCOS based preformatted cards, i.e NetKey E4 cards, SignTrust cards and Smartkey cards. All these cards have a TCOS 2.02 operationg system and an almost PKCS#15 compatible file-layout. OpenSC has read-only support for these kind of cards.

If OpenSC would fully support TCOS, one could erase the preformatted card and initialize the card with a PKCS#15 filesystem. This is not possible right now as OpenSC lacks support for initializing a PKCS#15 layout on an empty card with TCOS operation system.

The good news are: With the help of an emulation layer OpenSC can use cards that are almost PKCS#15 compatible. For the above mentioned cards such an emulation layer exists. The emulation cannot store certificates, keys or pins on the card, but you can use whatever is visible through the emulation layer.

If you know of other TCOS based cards and are willing to help, please post information on the mailing list. You might also send `opensc-tool -f` output to me, maybe I can extend the emulation such that it works with your card as well.

Telesec GmbH will offer the next generation of TCOS cards in late 2006. As of this writing (May 2006) the author was not able to get his hands on a prototype. If you do - let me know. These new TCOS-cards will fullfill all requirements from the german HPC-specification (Health Profession Card) and as such will have lots of new features.

## NetKey E4 filesystem layout

NetKey E4 cards contain different applications (i.e. directories). Only one of these (application NKS, directory DF01) is made visible through the NetKey emulation layer. This directory contains 3 private keys, 3 public keys, 3 read only certificates, 6 empty certificate files, 2 local PINs and one signature-counter. There are other applications on NetKey-cards, for example one that can be used to create SigG (german signature law) conformning digital signatures. This application is not supported right now. Please ask for it on the mailing list.

      pkcs15-tool -c

will list all certificates. It will not list empty certificate files. Here's the output for a new NetKey E4 card:

    $ pkcs15-tool -c
    X.509 Certificate [Telesec Signatur Zertifikat]
            Flags    : 0
            Authority: no
            Path     : DF01C000
            ID       : 01

    X.509 Certificate [Telesec Authentifizierungs Zertifikat]
            Flags    : 0
            Authority: no
            Path     : DF01C100
            ID       : 02

    X.509 Certificate [Telesec Verschlüsselungs Zertifikat]
            Flags    : 0
            Authority: no
            Path     : DF01C200
            ID       : 03

The read-only certificates are signed by a certificate of german Telekom AG and all have the same CN (NetKey? serial number). Here's output that shows one of them:

    $ pkcs15-tool -r 01 | openssl x509 -noout -text -certopt no_pubkey,no_sigdump
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 13356238 (0xcbccce)
            Signature Algorithm: ripemd160WithRSA
            Issuer: C=DE, O=Deutsche Telekom AG/0.2.262.1.10.7.20=1, CN=NKS CA 21:PN
            Validity
                Not Before: Jan 31 08:43:51 2003 GMT
                Not After : Jan 31 08:43:51 2006 GMT
            Subject: C=DE/0.2.262.1.10.7.20=1, CN=NKS 03 A 02707
            X509v3 extensions:
                X509v3 Key Usage: critical
                    Digital Signature, Non Repudiation

The public-keys are record-based transparent files and cannot be used for cryptographic operations. They are on the card for convenience only. OpenSC extracts the public keys from the certificates and does not use the public key files.

The Signature-Key can do signature-operations only. All other private keys can be used for decryption- and signature operations.

### How do I store additional certificates into the above mentioned empty certificate-files?

You (and OpenSC) dont see the empty certificate files through the emulation layer. One consequence of this is, that you cannot store your own certificates into these files with pkcs11-tool or pkcs15-init.

You must use opensc-explorer and store the certificate directly into the right position or use netkey-tool, a small program, that I wrote exactly for that purpose.

In general (and in particular with TCOS-cards) it's a lot more complicated to create a new file on a smartcard than updating an existing one. That's the reason why there are empty certificate files on a NetKey card. They contain 1536 0xFF-bytes and you can overwrite them with your own certificate (if your certificate has at most 1536 bytes).

### Some remarks about the pins of a Netkey card

There are two global pins on a NetKey-card and some of the directories contain further pins. The NetKey emuation will list the two global pins (PIN and PUK) and the two local pins contained in directory DF01 (PIN0 and PIN1). The TCOS card operation system can protect a private key by more than one pin. OpenSC does NOT support this and will always ask for one specific pin. If a key is protected by both a global pin and a local pin OpenSC will always ask for the local one.

Now that you know that you MUST use local PIN0 or local PIN1 and cannot use global PIN instead you probably want to know the initial value of those local pins. But these local pins were set to a random 6-digit number when TeleSec Gmbh produced your card. So you cannot know them until you changed them.

You can change local PIN0 only if you know either local PIN0 itself or your global PIN. And you cannot change a pin once it was blocked. So if your local PIN0 is blocked (for example because you provided you global PIN when OpenSC asked you for the local one and you did that for at least three times) then you must unblock it first.

Here's an example about how to unblock your local PIN0, how to change its value to 111111 with your global PIN and then change its value from 111111 to 222222. It assumes that your global PIN is 123456

    netkey-tool --pin 123456 unblock pin0
    netkey-tool --pin 123456 change pin0 111111
    netkey-tool --pin0 111111 change pin0 222222

One more hint: Your global PUK was set to an 8-digit random number at production time. This random number is stored on your card in a transparent file. This transparent file is read-protected by your global PIN.

`netkey-tool --pin <your_global_pin>` will print out the initial PUK-value. If you change your global PUK the transparent file on your card will still contain the initial value.

## SignTrust layout

SignTrust cards contain three applications (i.e. directories). Each of them contain one certificate, one private key and one pin.

The signature-key is restricted such that it can create signatures only, the other keys can be used for decryption- and signature operations. There are no empty certificate files on a SignTrust card (as with NetKey cards) so you cannot store your own certificates pn a SignTrust card.

The certificate from the signature-application can ba used to create SigG (german signature law) conforming digital signatures. Neither the CA-certificate nor the Root-Certificate is stored on the card but you can download them here. The certificates from the authentication and encryption application are signed by a selfsigned Root-certificate from Deutsche Post.

## Kobil Smartkey layout

There are two sorts of Kobil Smartkey cards. The first one are NetKey E4 cards with one additional directory where Kobil stores a Windows 2000 logon certificate. The emulation detects this kind of Smartkey cards as a NetKey card.

The second one has a Kobil specific undocumented layout. The emulation tries its best to support this kind of cards too. One Smartkey-variant that already works is the student card of the Technical University of Darmstadt. If you are using a Kobil Smartkey card that OpenSC does not yet support please let me know.