## Overview

Mac OS X 10.4 has a native support for smart cards, called Tokend.

Native Mac applications (Safari browser, Mail client) will be able to automatically use the keys on the card that are supported by the Tokend.

There is an OpenSC tokend as part of OpenSC's sca package for Mac OS X. It uses the OpenSC library (the PKCS15 layer, not the pkcs11 lib) and should therefore support the same cards. It can be use together with other OpenSC lib/apps such as the pkcs11 lib for the Mozilla family of browsers and mail clients.

Currently supported are

- Keychain Access (to view the contents of the smart card)
- Safari browser (SSL client authentication)
- Mail client (sign and decrypt emails) -- Note: the account's mail address must be present in the cert

For more info:

- Max OS X: [http://developer.apple.com/documentation/MacOSX/Conceptual/OSX_Technology_Overview/] (OSX_Technology_Overview.pdf)
- Mac OS X for UNIX Users: [http://images.apple.com/macosx/pdf/MacOSX_UNIX_TB.pdf]
- Apple-cdsa mailing list: [http://lists.apple.com/mailman/listinfo/apple-cdsa]

## How to build the OpenSC tokend

This is pretty complicated, most is based on the doc "Building Tokend Using the Darwin Build Scripts" that can be requested on the apple-cdsa mailing list.

Make sure you have Mac OS 10.4.

If you want SVN (subversion): download and install fink [http://fink.sourceforge.net/] and use fink to obtain svn: "sudo fink install svn-client" in a Terminal window.

1. download and install Xcode 2.2 or later from [http://developer.apple.com/tools/]

2. Download, build and install darwinbuild 0.7.2 or later from [http://opendarwin.org/projects/darwinbuild/]

3. Create a disk image to contain the build environment

> (This way your regular system won't be modified when all frameworks etc. are downloaded)

- hdiutil create -size 2g -type UDIF -fs HFSX -volname Builds -uid 0 -gid -0 -attach Builds.dmg

- Become root (su or sudo /bin/bash)

- vsdbutil -a /Volumes/Builds

> (/Volumes/ is where all filesystems like disks, USB sticks and disk images are mounted)

> Note: next time you start your Mac, you need to re-open the builds.dmg disk image again before you can work with it: double-click on it in Finder or do "hdiutil attach Builds.dmg in a Terminal window.

4. Download and build the Tokend code from opendarwin

> This is done in a subdirectory of /Volumes/Builds/. It's name depends on the 10.4.x version that you have. For example:

> > > ** For 10.4.2: Build8C46

> > > ** For 10.4.3: Build8F46

> > > ** For 10.4.4: Build8G32

> > > ** For 10.4.5: Build8H14

> (See [http://darwinsource.opendarwin.org/plists/])

> In what follows, we assume we are building on 10.4.3.

- cd /Volumes/Builds

- mkdir Build8F46

- cd Build8F46

- /usr/local/bin/darwinbuild -init 8F46

- Disable the i386 build (only ppc):

> > /usr/local/bin/darwinxref -b 8A428 edit

> > This opens vi or vim (yes:-) where you have to remove 'i386' from RC_ARCHS (use the arrow keys to go to 'i386', then hit x to delete it, then use the ESC button to go back to normal mode and type :wq or :wq!)

- /usr/local/bin/darwinbuild Tokend

> This command will download the Tokend-11 code and all required libs,frameworks,... and build the tokend's as Apple did. It will take a while.

> You could try them (first backup the original ones):

> > ** mkdir /System/Library/Security/tokend/backups

> > ** mv /System/Library/Security/tokend/* /System/Library/Security/tokend/backups

> > ** sudo ditto BuildRoot/var/tmp/Tokend/Tokend-11.root / }

> The Tokend-11 sources are compressed in Sources/Tokend-11.tar.gz. If you would like to modify them, e.g. to add logging, you can do the following:

> > ** extract them ("cd Sources" and "tar xfz Tokend-11.tar.gz");

> > ** make them writable: chown -R <yourusername> Tokend-11

> > ** then open the project with XCode ("open Tokend-11/Token.xcodproject") and change and save them;

> > ** then run "/usr/local/bin/darwinbuild Tokend". Since the sources already exist, darwinbuild won't download them again but use the existing onces instead.

> NOTE: the building seems to go fail somehow sometimes. However, once the libtokend.a has been build, you are far enough. So just check if the file "/Volumes/Builds/Build8F46/BuildRoot/private/var/tmp/Tokend/Tokend-11.obj/UninstalledProducts/libtokend.a" exists.

> WARNING: don't run "/usr/local/bin/darwinbuild Tokend" again after you installed and build the OpenSC sources (they will be overwritten)!

5. Obtain and install sca.

> Download the installer from http://www.opensc-project.org/sca/, or look at this site for info on how to get the sources and build it yourself

> After installation, everything should be in /Library/OpenSC/.

6. Obtain and build the OpenSC tokend code.

> This is part of sca, just search for the opensc.tokend/ directory.

> Note: if you should use the OpenSC version was used for building sca. E.g. if you used sca-0.1.8, you should use OpenSC 0.10.1. And if you used the sca code from SVN, use the OpenSC code from SVN

- copy the contents of opensc.tokend/ to /Volumes/Builds/Build8F46/Sources/Tokend-11/

- cd /Volumes/Builds/Build8F46/Sources/Tokend-11/

> Now you can build the OpenSC tokend, there's no need to be root anymore. You can either build directly from the command prompt:

> > ** xcodebuild -configuration Deployment

> or from within Xcode:

> > ** "open Tokend.xcodeproject" or double-click on it in Finder

> > ** Project -> Set Activate Build Configuration -> Deployment

> > ** Build -> Build

> NOTE: if the build fails with error "can't locate file for: -ltokend", this means that the libtoken.a library has moved. E.g. before Mac OS 10.4.5, the lib was located at $(BuildRoot$/private/var/tmp/Tokend/Tokend-11.obj/UninstalledProducts/libtokend.a but if you build with Mac OS 10.4.5 (build 8H14), it's located at $(BuildRoot$/private/var/tmp/Tokend/Tokend-25868.obj/UninstalledProducts/libtokend.a So you should do an "ls ../../BuildRoot/private/var/tmp/Tokend/" to find out the name of the dir containing the libtokend.a; and modify the Tokend.xcodeproj/project.pbxproj accordingly by means of a text editor (perhaps it's also possible to do so with Xcode).

> The result should be an OpenSC.tokend bundle in build/Deployment/.

> To 'deploy' it:

> > sudo cp -r build/Deployment/OpenSC.tokend /System/Library/Security/tokend/OpenSC.tokend

> FYI: The Tokend-11/ directory is based on the one from opendarwin:

> > ** The BELPIC, CAC, MuscleCard? and Tokend targets/products were removed from the project

> > ** The BELPIC, CAC and MuscleCard? directories were removed

> > ** The cpp files (not the .h files) from the Tokend dir were removed

> > > > (it uses the libtokend.a lib that was made with /usr/local/bin/darwinbuild)

> > ** The project has been modified to build with Xcode instead of with /usr/local/bin/darwinbuild

> The opensc.tokend dir contains an optional tokend.conf config file; see this file for more info.