关于OpenSC依赖机制及为非兼容卡添加PKCS#11支持的技术咨询
1. Is OpenSC fully implemented based on PC/SC, or does it also use other commands?
OpenSC is primarily built on top of the PC/SC framework for low-level communication with smart card readers and cards—PC/SC handles the basic transport layer (like sending/receiving APDUs between the host and card). But OpenSC isn’t limited to just using PC/SC’s default capabilities:
- It implements its own higher-level logic to construct, parse, and manage APDUs for smart card operations (like key management, certificate handling, etc.).
- For specific smart card models, OpenSC often sends proprietary vendor-specific APDUs (beyond standard ISO 7816 commands) that are required to interact with the card’s unique features. These commands are handled directly by OpenSC’s card-specific drivers, with PC/SC acting only as the transport layer to pass them to the card.
- Additionally, OpenSC includes standalone tools (like
opensc-tool,pkcs11-tool) that use its internal libraries alongside PC/SC to perform operations, rather than relying solely on PC/SC’s native APIs.
2. Will implementing an applet that handles all ISO 7816 commands be enough to add PKCS#11 support via OpenSC?
Your understanding of the overall flow is correct: PC-side apps call OpenSC’s PKCS#11 API, OpenSC constructs APDUs (via PC/SC) for the card, and the card responds with processed data. However, only supporting all standard ISO 7816 commands won’t be sufficient in most cases, and here’s why:
- OpenSC relies on card-specific drivers to map PKCS#11 operations (like key generation, signing, certificate storage) to the correct APDU sequences. If your card isn’t on OpenSC’s compatibility list, OpenSC has no built-in knowledge of how to interact with it—even if the card supports all ISO 7816 commands.
- While ISO 7816 defines core commands, many smart cards use proprietary extensions to implement PKCS#11-required features. For example:
- Some vendors use custom commands to manage secure key containers or access control policies.
- Others have proprietary APDUs for handling specific encryption algorithms (like ECC variants) or certificate storage formats that aren’t fully covered by ISO 7816.
- If your card strictly adheres to the PKCS#15 standard (a common smart card file structure for storing cryptographic objects), you might be able to create a minimal OpenSC driver that reuses OpenSC’s generic PKCS#15 handling logic. But even then, you may need to implement small tweaks for any card-specific edge cases.
In short: You’ll need to either adapt your card’s applet to match an existing OpenSC-supported card’s command set, or write a custom OpenSC driver that translates PKCS#11 operations to your card’s specific APDUs (which may include both standard ISO 7816 commands and any proprietary ones your card uses).
内容的提问来源于stack exchange，提问作者matteof93
