We are developing a JavaCard-based security sensitive application. Our goal is to allow client code communicating with a GlobaPlatform 2.2+ based JavaCard applet to convince itself that it's actually talking to a specific (and verifiable) version of the JavaCard applet it needs to talk to. In other words, we are looking for a "platform integrity" mechanism to be sure there's no possibility that the JavaCard applet code was substituted/modified by "insiders" (e.g. even us who developed the applet).
At first we were hoping to use an Installation Receipt mechanism as described in the GP specification, but we were advised that this doesn't apply in that case.
So is there a way for client code to query the card about the authenticity (e.g. a simple hash) of the applet codebase (i.e. the installed .cap file) without having to query and trust the JavaCard applet itself?
Related
I want to make a Java Card Connected Edition Application in a Omni Ring, based on WEB (HTTP).
This Contactless Ring comes with Java Card 3.0.1 and I already have an ACR122U reader/writer.
I downloaded NetBeans IDE 8.2 RC and made an example of the Java Card Connected Edition (HTTP) and everything worked correctly on the NetBeans Virtual Card, however I am not finding any information on how I download it to the Ring.
How can I do this?
You cannot. The SLE78 only has 8 KiB of RAM available. That's not enough to run the Java Card Connected operating system. Actually, you will find preciously few implementations of Java Card Connected due to the high RAM requirements, which prohibits the use of cheap silicon. The few implementations (or rather, implementation) that I'm aware of used a contact based chip. Your chip runs the Java Card Classic variant.
That said, it is certainly possible to create a web server within an Applet (and this has been done in the past). Implementing TLS is going to be a lot trickier though, just because of the code size. TLS has many options. Instead you could tunnel the connection on a more smart card specific secure channel I suppose.
Short question:
Does the Windows Store allow applications that obtain DLLs or other low-level resources not packaged at compile time? Is there a requirement either by Windows Phone or Microsoft that requires DLLs to be signed? If so, can I use a DLL in my application that is signed by another developer?
Why I'm asking/explanation:
I'm working an an application for Android that allows users to download extensions (like themes), and I'd like to port this to Windows Phone.
I have determined that it's not possible for my app to utilize libraries or other resources of other applications downloaded from the Windows Store. (Please correct me if this is not always the case)
The workaround I'm considering is an in-app download center for other resources specific to this application. I'm wondering if a downloads for this app, specifically DLLs, can be used in my application. These DLLs would be developed by 3rd party developers, so I see that signing might be an issue.
The store specifically prohibits any additions / modifications after the app has been purchased. So although it may technically be possible, they won't certify it.
This makes sense if you think about certification . If they would allow this, it would make certification a moot point, since you would just publish a basic app, and afterwards side-load the uncertified part.
DISCLAIMER: I have never used coldfusion before and am in a bit of a hurry to get a small code snippet implemented.
So, I have the app working and receiving notifications from a php script: device token is hardcoded into script, script has access to the needed certificate to encrypt the message using SSL, message is sent to apple servers and passed on to the device.
I need to do the same thing from coldfusion. That is what the production server is using.
Is there any way to do so from coldfusion, or will I have to use some other programming language to do so? I have read that coldfusion plays well with .net and with java. I would prefer .net, and I see they have the SSL stream class (http://msdn.microsoft.com/en-us/library/system.net.security.sslstream.aspx) available. Could any coldfusion experts write some simple sample code to let me know how I should go about it?
Thank you.
-EDIT: in reply to the comment below, this is exactly what I want to do: connect through TCP over TLS or SSL to a server (in this case the Apple Push Notification server, APNs) using a local certificate I have in .pem format (if the certificate needs to be installed on the server or needs to be in another format for coldfusion, I can do that as well), and send it a binary stream (my notification).
The answer is yes, this can be done with ColdFusion. In fact, it can be done with pretty much any programming language that has the requisite cryptographic libraries to open a private key store and sign messages to the destination server (i.e., Apple's push servers).
Though ColdFusion does appear to have some native support for accessing and using a PKCS12 keystore, it seems to be far more common to let Java do the heavy lifting, and simply reference the Java library from within ColdFusion.
Here is a link demonstrating the simple use case of initiating a push notification from ColdFusion, using a Java library for the actual sending of the notification:
http://www.raymondcamden.com/index.cfm/2010/9/13/Guest-Post-Apple-Push-Notifications-From-ColdFusion-in-Ten-Minutes-or-Less
I am developing a Remote Software Provisioning system that should be able to handle all deployment, installation, un-installation and upgrades of software components. Software can be in any language (java, .net, c/c++ etc) and target side can be PC, embedded systems and smart phones.
I have found Apache ACE as good candidate for developing this system.
I want to know if there is any advantage/necessity of using OSGi at target side as Apache ACE can do software provisioning to non-OSGi targets as well.
Having a modular framework like OSGi at the client side is a huge advantage when doing remote management, because it gives you much insight into what's happening inside - installed bundles, dependencies, states of the bundles, available services etc. This helps a lot when you have to solve a problem remotely. Another advantage is that OSGi basically forces programmers to develop proper modular and dynamic systems, which makes (remote) updating much easier.
So, if you have to decide now what language and framework to use for the client side, I strongly recommend OSGi for the embedded and mobile clients. For the PCs (I guess you mean desktop PCs?) this is probably not the best choice - it depends a lot what you want to achieve there. If you want to install MS Office remotely OSGi won't bring you forward ;)
However, if you already have existing programs at the client side and are discussing whether to convert them to OSGi, I would recommend to investigate some time first to see whether they can be converted easily. Some software packages could give you a lot of trouble converting to OSGi, not because OSGi is complex, but because the program itself is not modular and has a lot of assumptions about the static nature of the environment (e.g. nothing ever disappears, parts of the system never get updated etc.). The irony in the matter is that these are exactly the programs which will give you most trouble later anyway no matter which remote provisioning system you chose.
If you have OSGi at some of the targets be sure to use a remote provisioning system which gives you access to the full OSGi functionality and not only the most basic and simple install and update functions. I haven't yet used Apache ACE, but I have experience with another provisioning system - mPower Remote Manager. Here are some snapshots from the documentation which can give you a feeling what is possible with OSGi as a base - you can draw your own conclusions whether it will be useful for your case or not.
I've given some examples in the other question you asked:
What are the non-osgi targets with which Apache ACE can work
You can write your own management agent that talks to the ACE server and installs artifacts. There actually are a couple of places where you could hook in your own code and protocol. Is there a concrete language/environment you're thinking of using, or are you just exploring the possibilities right now?
Well, the advantages of OSGi haven't changed, so for that I can refer you to the standard page.
To be a bit more constructive, I'll read the question as 'Should I bother converting my application to OSGi, as it is not necessary for ACE?'
I think that depends on what 'kind' of updating mechanism you're after. If you have a monolithical application (at least from the provisioning perspective) which you deploy and update only as a whole (Like an iOS app) then there isn't much to gain for provisioning purposes by using OSGi.
For the rest I can tell you the same as I tell anybody else: Converting an application to OSGi isn't hard, but modularizing code can be a nightmare, but something you'll need to face at some point, OSGi or not. If your code is modularized already, using OSGi should be a piece of cake.
I created a test domain, a CA and I issued a certificate with that CA. I also have fully functional CSP. For logging on, Windows are offering smart card as logon option. However, when I insert the card, after a few seconds of interaction with the card I receive the message "no valid certificates found". I did my homework by reading tons of MS documentation and generally whatever Google offered. Since I have no more options I'm trying here.
Added after posting: The certificate was created from the Smartcard Logon template.
Here are a few things I would check:
the authentication cert asserts the windows smartcard logon OID in the EKU.
the authenctication cert has a UPN in the subject alternative name (not stricly necessary for windows 7/server 2008).
the authentication cert key usage is digitial signature.
the domain controller has the certificate chain installed correctly.
How was the card issued?
* Follow-up *
How did the certificates make it on to the card? AFAIK, there is no card management built into Windows, so an external card management system is needed to load the certs on the card in whatever card applet you are using. Can you provide more specifics on the card you are trying to use?
* Follow-up *
You might find this link interesting; it's for PIV cards but the same ideas probably apply to your situation - the article describes a test lab setup for smart cards. In particular, check out which certs go in which trust stores.
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=9427
You may find commercial software automating the binding process but no free ones. This way you won't have to check tons of support KB.
You can get a look at this demo (http://www.youtube.com/watch?v=OkMGXr-bls0) to see one of these tools in action.