3 ms·

Apparently in Windows there are generic drivers and then there are "minidrivers" such as https://www.cardlogix.com/glossary/minidriver-card/ https://www.cardlog

Apparently in Windows there are generic drivers and then there are "minidrivers" such as https://www.cardlogix.com/glossary/minidriver-card/ https://www.cardlogix.com/glossary/minidriver-card/ or https://www.yubico.com/support/download/smart-card-drivers-tools/ https://www.yubico.com/support/download/smart-card-drivers-t... that I guess provide more direct or faster functionality? Even on Linux, OpenSC software apparently supports drivers, such as the generic CCID driver as well as more specific drivers. The generic spec that both Microsoft and the CCID driver support appears to be https://www.usb.org/document-library/smart-card-ccid-version-11 https://www.usb.org/document-library/smart-card-ccid-version... from 2005. I imagine the tech hasn't changed that much to need custom drivers, so I'm not sure why they exist, except maybe to do firmware updates or something unusual. https://ludovicrousseau.blogspot.com/2022/04/30-shades-of-pcsc.html https://ludovicrousseau.blogspot.com/2022/04/30-shades-of-pc... and other such sources seem to indicate that most of this is pretty standard? If you want to write code that uses smart cards, I mean. That said, if I were doing a from-scratch authentication implementation today, I'd probably pick something like biometrics via FIDO2 instead of smart cards...

wahern 4y ago
> That said, if I were doing a from-scratch authentication implementation today, I'd probably pick something like biometrics via FIDO2 instead of smart cards... Traditional smart cards like CAC and PIV can include a user X.509 certificate on the device. FIDO doesn't include this capability. That means FIDO keys have to be registered separately with each and every service[1]. This is deliberate as FIDO tokens can generate a unique key per service--for services authenticated via a web browser this is precisely what happens. But the choice means FIDO doesn't work well for building a generic, federated PKI system. FIDO has a laser focus on solving user authentication problems for website operators, all managing their user databases independently. The saliency of this approach has at least as much to do with removing degrees of freedom that vendors could abuse to fragment the hardware space than in the technical security of things. Traditional smart cards never lived up to their promise precisely because companies like Saicoo actively sabotaged interoperability and ecosystem simplicity in attempts to leverage vendor lock in. [1] Or those services must all be able to contact a shared online user database, or a certificate has to be distributed separately (e.g. as with OpenSSH). (But I don't think a FIDO token can even sign something like an X.509 certificate, at least not without defining a new signature algorithm OID.) Both are problematic for use cases like CAC or national identity cards.
- tialaramex 4y ago
  > at least not without defining a new signature algorithm OID Yes, that's what you would need to do if you wanted this. OpenSSH comes with tooling that will sign arbitrary files, and can use either conventional SSH key files (for which it has a safety rationale, explaining why this can't weaken their security for their original authentication purpose if the signature algorithm works as intended) or a FIDO device.
- mariusmarais 4y ago
  It was also deliberate in the sense that they specifically wanted to make it impossible to link different identities on the same key in order to protect privacy. So you can be user1 and user2@ without the site being able to tell from the authentication process alone. (Obviously cookies, IPs and other side-channels exist, but if you protect against that, FIDO won't give you away.)
seszett 4y ago
Our chip id cards have been in service since 2002 though, and work fine so I don't think it was a mistake to choose this technology. I'm not sure how FIDO2 would work for most uses which are not web based, and identification via biometrics is certainly not something I'm looking forward to.

wahern 4y ago

> That said, if I were doing a from-scratch authentication implementation today, I'd probably pick something like biometrics via FIDO2 instead of smart cards... Traditional smart cards like CAC and PIV can include a user X.509 certificate on the device. FIDO doesn't include this capability. That means FIDO keys have to be registered separately with each and every service[1]. This is deliberate as FIDO tokens can generate a unique key per service--for services authenticated via a web browser this is precisely what happens. But the choice means FIDO doesn't work well for building a generic, federated PKI system. FIDO has a laser focus on solving user authentication problems for website operators, all managing their user databases independently. The saliency of this approach has at least as much to do with removing degrees of freedom that vendors could abuse to fragment the hardware space than in the technical security of things. Traditional smart cards never lived up to their promise precisely because companies like Saicoo actively sabotaged interoperability and ecosystem simplicity in attempts to leverage vendor lock in. [1] Or those services must all be able to contact a shared online user database, or a certificate has to be distributed separately (e.g. as with OpenSSH). (But I don't think a FIDO token can even sign something like an X.509 certificate, at least not without defining a new signature algorithm OID.) Both are problematic for use cases like CAC or national identity cards.

tialaramex 4y ago
> at least not without defining a new signature algorithm OID Yes, that's what you would need to do if you wanted this. OpenSSH comes with tooling that will sign arbitrary files, and can use either conventional SSH key files (for which it has a safety rationale, explaining why this can't weaken their security for their original authentication purpose if the signature algorithm works as intended) or a FIDO device.
mariusmarais 4y ago
It was also deliberate in the sense that they specifically wanted to make it impossible to link different identities on the same key in order to protect privacy. So you can be user1 and user2@ without the site being able to tell from the authentication process alone. (Obviously cookies, IPs and other side-channels exist, but if you protect against that, FIDO won't give you away.)

seszett 4y ago

Our chip id cards have been in service since 2002 though, and work fine so I don't think it was a mistake to choose this technology. I'm not sure how FIDO2 would work for most uses which are not web based, and identification via biometrics is certainly not something I'm looking forward to.