4

This is a question specific to the country of Luxembourg:

In Luxembourg, electronic signature infrastructure for official and banking business is provided by the company LuxTrust S.A.. They offer USB sticks that are actually rebranded Gemalto devices, in particular the Signing Stick, a Gemalto "Gemplus USB Shell Token V2" (or thereabouts) with a removable chipcard carrying an X.509 certificate identifying the user and a private key.

LuxTrust signing stick

LuxTrust says that the device works on Windows and Mac, but support for Linux is weak (however they support Ubuntu), even though Gemalto itself offers support and drivers for the device.

It seems the general functional layout to use the device from a browser is this:

What's going on

So I have tried to make this work for some time now but I can't get the applet of LuxTrust to interwork with the "Signing Stick". Has anyone had experience with the LuxTrust Signing Stick on Linux?

In this precise case, we have:

  • Firefox 37.0 (with NoScript, incidentally), the Java plugin is: active
  • Oracle JDK (java -versionsays: 1.8.0_40-b26)
  • Fedora 20 (uname -a says: 3.18.9-100.fc20.x86_64)
2

Looks like I have had some success.

The Journey begins

So, we start off with the "Middleware for Linux" LuxTrust page which basically says "You are on your own, we don't support you, and if it goes pear-shaped, it's all your own damn fault. Clicksign here!":

enter image description here

We shall remain unfazed and first make sure that Java is active in the browser.

Activate Java

If Java is not active, the Status Test Page (reachable via "Support" > "Questions about Certificate management" > "My Certificate" (in the footer) > "Test & Status") will look like this (note that the page also classifies Firefox 37 as "unsupported", which is frankly weird):

enter image description here

Install the Oracle Java SDK or Java Runtime from Oracle's website

Make the Java browser plugin visible to Firefox. See Manual Installation and Registration of Java Plugin for Linux, but the procedure is generally as follows (run as a non-root user):

$ mkdir ~/.mozilla/plugins
$ cd ~/.mozilla/plugins/
$ ln -s $PATH_TO_WHERE_JAVA_HAS_BEEN_INSTALLED/jre/lib/amd64/libnpjp2.so 

Now one has to check whether Java is enabled in the browser.

See Oracle: How do I enable Java in my web browser? and Mozilla: How to turn off Java applets in Firefox. In principle you need just check the "≡ > Add-Ons" menu. Set to "Ask to activate" in order to stay on the "I'm in the loop here!" side of things:

enter image description here

If you have NoScript installed, make NoScript allows Java applets to run:

enter image description here

Finally test at Oracle's test page.

Ok, so that's that.

Install "LuxTrust Middleware"

So, you decided to install that "middleware RPM" called LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm that you downloaded from LuxTrust.

Let's get some info on this:

# rpm --query --info --package LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm

    Name        : libclassicclient
    Epoch       : 0
    Version     : 7.0.0
    Release     : b01.fc20
    Architecture: x86_64
    Install Date: (not installed)
    Group       : System Environment/Libraries
    Size        : 23147060
    License     : Proprietary
    Signature   : (none)
    Source RPM  : libclassicclient-7.0.0-b01.fc20.src.rpm
    Build Date  : Mon 08 Dec 2014 09:21:51 CET
    Build Host  : localhost
    Relocations : (not relocatable)
    Vendor      : Gemalto
    Summary     : Classic Client for Linux: PKCS#11 token for Gemalto Classic cards
    Description : PKCS#11 token for Gemalto Classic cards

Note the name libclassicclient. This indicates this is actually (a part of?) the "Gemalto Classic Client". It must be this one:

The classic client, I presume?

Also, the license is "proprietary". Oh well.

What does this package require? Quite a few things, actually. In particular, crypto libraries. Note that it doesn't need "sqlite" ....

# rpm --query --package --requires LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm

    /bin/sh
    /bin/sh
    rpmlib(FileDigests) <= 4.6.0-1
    rpmlib(PayloadFilesHavePrefix) <= 4.0-1
    rpmlib(CompressedFileNames) <= 3.0.4-1
    ld-linux-x86-64.so.2()(64bit)
    ld-linux-x86-64.so.2(GLIBC_2.3)(64bit)
    libatk-1.0.so.0()(64bit)
    libcairo.so.2()(64bit)
    libcrypto.so.10()(64bit)
    libc.so.6()(64bit)
    libc.so.6(GLIBC_2.14)(64bit)
    libc.so.6(GLIBC_2.2.5)(64bit)
    libc.so.6(GLIBC_2.3.2)(64bit)
    libc.so.6(GLIBC_2.3.3)(64bit)
    libc.so.6(GLIBC_2.3.4)(64bit)
    libc.so.6(GLIBC_2.3)(64bit)
    libc.so.6(GLIBC_2.4)(64bit)
    libc.so.6(GLIBC_2.7)(64bit)
    libdl.so.2()(64bit)
    libdl.so.2(GLIBC_2.2.5)(64bit)
    libfontconfig.so.1()(64bit)
    libfreetype.so.6()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3)(64bit)
    libgcc_s.so.1(GCC_4.2.0)(64bit)
    libgdk_pixbuf-2.0.so.0()(64bit)
    libgdk-x11-2.0.so.0()(64bit)
    libgio-2.0.so.0()(64bit)
    libglib-2.0.so.0()(64bit)
    libgobject-2.0.so.0()(64bit)
    libgtk-x11-2.0.so.0()(64bit)
    libidkit.so.2()(64bit)
    libiomp5.so()(64bit)
    libm.so.6()(64bit)
    libm.so.6(GLIBC_2.2.5)(64bit)
    libpango-1.0.so.0()(64bit)
    libpangocairo-1.0.so.0()(64bit)
    libpangoft2-1.0.so.0()(64bit)
    libpcsclite.so.1()(64bit)
    libpthread.so.0()(64bit)
    libpthread.so.0(GLIBC_2.2.5)(64bit)
    libpthread.so.0(GLIBC_2.3.2)(64bit)
    libQtCore.so.4()(64bit)
    libQtGui.so.4()(64bit)
    librt.so.1()(64bit)
    librt.so.1(GLIBC_2.2.5)(64bit)
    libScanAPI.so()(64bit)
    libssl.so.10()(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(GLIBCXX_3.4.11)(64bit)
    libstdc++.so.6(GLIBCXX_3.4.15)(64bit)
    libstdc++.so.6(GLIBCXX_3.4)(64bit)
    libstdc++.so.6(GLIBCXX_3.4.9)(64bit)
    libusb-0.1.so.4()(64bit)
    rpmlib(PayloadIsXz) <= 5.2-1

Ok, let's install the package as root:

# rpm --install LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm
    WARNING: libsqlite3.so could not be found. Creating symbolic link...
    Creating symbolic link done.

So it actually needs "sqlite", but doesn't say so in the requirements.

Googling the message above reveals that this message is indeed sometimes emitted by the "Gemalto Classic Client".

We now find an additional symbolic link in the filesystem:

/usr/lib/debug/usr/lib64/libsqlite3.so -> libsqlite3.so.0.8.6.debug

I guess we can live with that.

We got manuals

Listing the files installed via

# rpm --query --list libclassicclient | less

shows this package ACTUALLY COMES WITH (pretty good) MANUALS!

/usr/share/doc/libclassicclient/Classic_Client_Linux_User_Guide.pdf
/usr/share/doc/libclassicclient/ReleaseNotes.pdf

Excellent!

Manual front page Release notes front page

By reading the above, we quickly find out that:

  1. Something like a smartcard-reading daemon is needed, and it is called ccid something something. More details at Gemalto
  2. There is a packaged application to change the PIN on the "LuxTrust signing stick" (as said, a GemPlus smartcard reader): /usr/bin/CCChangePinTool

Install daemon, exercise CCChangePinTool

Plug in the "signing stick" at some USB port. The kernel log (journalctl SYSLOG_FACILITY=0) says:

    kernel: usb 3-2: new full-speed USB device number 3 using ohci-pci
    kernel: usb 3-2: New USB device found, idVendor=08e6, idProduct=3438
    kernel: usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
    kernel: usb 3-2: Product: USB SmartCard Reader
    kernel: usb 3-2: Manufacturer: Gemplus

Let's install that smartcard-reading daemon:

    # yum search ccid  

    pcsc-lite-ccid.x86_64 : Generic USB CCID smart card reader driver
    pcsc-lite-ccid-debuginfo.x86_64 : Debug information for package pcsc-lite-ccid
    libykneomgr.i686 : YubiKey NEO CCID Manager C Library
    libykneomgr.x86_64 : YubiKey NEO CCID Manager C Library

It seems to be the pcsc-lite-ccid. Thus:

    # yum install pcsc-lite-ccid

    Installing : pcsc-lite-1.8.10-2.fc20.x86_64
    Installing : pcsc-lite-ccid-1.4.13-1.fc20.x86_64

Some additional output elided. Now start the daemon:

    # systemctl start pcscd
    # systemctl status pcscd
    pcscd.service - PC/SC Smart Card Daemon
       Loaded: loaded (/usr/lib/systemd/system/pcscd.service; static)
       Active: active (running) since Mon 2015-04-06 13:12:43 CEST; 4s ago
     Main PID: 10970 (pcscd)
       CGroup: /system.slice/pcscd.service
               └─10970 /usr/sbin/pcscd --foreground --auto-exit

     systemd[1]: Started PC/SC Smart Card Daemon.
     pcscd[10970]: 00000000 utils.c:61:GetDaemonPid() Can't open /var/run/pcscd/pcscd.pid: No such file or directory
     pcscd[10970]: 00062795 commands.c:898:CmdEscape error on byte 10

Basically not looking bad.

Now run /usr/bin/CCChangePinTool as non-root user.

A window appears that allows you to "change the PIN". Set the PIN to its existing value (be double careful here!). Apparently this works, the application does not complain or segfault. Cool.

Make smartcard reader visible to Firefox

(This all comes from the Gemalto Manual not provided by LuxTrust)

One has to explicitly configure the smartcard reader in Firefox. Here is how:

Under Preferences > Ribbon: "Advanced" > Tab: "Certificates" > Button: "Security Devices" you have to add the smartcard reader and its smartcard. This may be arbitrary.

In my case, the reader showed up first:

Reader visible in Firefox 1

But after some time (in particular, after the PIN non-change above), the "Gemalto USB Shell Token V2" is recognized:

Reader visible in Firefox 2

But after a FireFox restart the label had changed:

Reader visible in Firefox 3

Mysterious? Yes! But you can now "Load" the "GemP15-1". This demands entering the PIN to the smartcard (which keep safely in a notebook or in LastPass...)

Test at LuxTrust

So let's go back to the LuxTrust test page and....

Well, it STILL does not work. No idea why even though this is a Java Applet that could log what's going on and where exactly it is encountering problems.

It still does not work!

Is it time for Mr. Rage yet?

Mr. Rage

Test at RCSL

The Company Registry of Luxembourg (RCSL) can be used for another test. They have a "certificate login page". Bring it up, you get an "eAccess" page ("Connection to an online service of the State of Luxembourg"), which loads an Applet published by CTIE - Centre des technologies de l'information de l'Etat. If you are fast enough and click on the "Run" button, you will notice that the Applet can properly access the LuxTrust Signing Stick and will retrieve the user's coordinates for the login page.

TAM Login Applet

It works! Enjoy.

  • Can't believe they needed all this Java nonsense instead of simply using TLS client certificate authentication. – André Borie Sep 15 '16 at 1:35
  • But then the certificate owner would have to install the client certificate wherever he accesses the secured site. – David Tonhofer Sep 15 '16 at 8:35
  • You can keep client certs on the stick. The only setup you'd need is a "minidriver" for the smartcard on Windows, and OpenSC for Mac/Linux. – André Borie Sep 15 '16 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.