EJBCA and OpenSC
Gustavsson, Tomas
The whole chain needed in order to use smart cards are quite complex. PKI, middle-ware and cards are needed and must all work together in order to make a succesful deployment in larger scale. This talk will demonstrate how opensc can be used together with EJBCA PKI, using smart cards as an HSM for the certificate authority, issuing certificates to user smart cards to be used for client authentication. We will show where the tricky integration points are and talk about what we can do about it together.
 Okay, hi, my name is Thomas Kussersson and I'm working for a small open source company, Crimekey. We developed open source API and the right product, EVCA's certificate authority and sign service, server-side digital signature service stuff. And I'm going to talk a little bit about the whole kind of chain when using smart cards, because there is... Well, okay, skip that. When you have a smart card, it's not only that well, you can have a smart card and you can use it on your PC. There's actually... when you want to use it in a bigger environment for a serious business like an electronic ID, etc. There's a whole life cycle around it that you have to manage. And this is called certificate life cycle management, this slide, but it might as well say a smart card life cycle management. Because for each smart card or certificate, you first issue it to someone, and then you can use it. And then when it will expire, then you have to renew it. If you lose it, then you have to revoke it, or you can revoke it, so someone else can't steal it and use it. And in the end, it expires and you throw it away and you just can't use it anymore. So those are different states that these certificates and smart cards go through during the time. And of course, you can manage this life cycle in various ways. One, you can do it manually in a small environment where it's fine for a small scale. Of course, it's more labor intensive, it takes some more time, but you can easily issue hundreds of electronic IDs with that. But for larger enterprises or countries, etc., you want some more automated life cycle management in order to automate these processes, etc. And then there are different standard protocols that can be used to back release automated life cycle management. So this is just something showing that there is actually a very large amount of different protocols and different things that have to interact in a PKI environment, where you can issue different types of certificates, different types of smart cards for different purposes. You have smart card management, you have LBata directories, leaden routers, web browsers, etc. So it's actually, well, it can become, it easily becomes quite complex and not very easy to manage at all. So for, we concentrate on the smart card system. As I said, it's not only that you have a smart card and smart card reader on your desktop. And in order for it to work, well, you actually have a whole chain. You have a certificate authority in the back end, which is certificates for your PKI cards, smart cards. You have certificates that has to be transferred somewhere, some way to the smart card. And that's called enrollment process. And actually you can use smart card on both ends of this chain. In the left end here, we have a hardware security module for a certificate authority. This can either be over 25,000 euro hardware box from SafeNet or U2Make or something, or you can also use a smart card with open SE, PPCS11 for this as well. And on the right side, of course, you have all the thousands or millions of smart cards for users. So in the back end, a hardware security module, which can be a smart card, protects the certificate authority's private keys so it can't be copied by someone who breaks into the server. And this requires a, also have a kind of a life cycle management to this particular token. And you have to have some sort of key ceremony to generate it in a control way. Because it's usually required that this can be ordered to have a please, if it's like in a company or a company escape. And then on the other right hand side, you have the issuance of or provisioning of the users with their usable tokens, which they can actually use to do some online faxing or banking or online voting or whatever. And that involves personalizing this smart card which comes blank, which you have received from Michel. But you have to personalize it so it actually contains your certificate. And you can do this very fine with the raw, just open SE actually. But then this is then a demonstration of a manual process which contains some steps that you have to do. You can get your, this is actually for if you have a Siemens card always card. You can initialize the card, you form up the card, you create the PCS15 file structure on the card, you can unit the card with a old PCS11 slot. You can generate, then you have to generate key pair in order to have your private and public keys. And after this, now you have actually a smart card with keys on it. But in order to be able to use it as an ID, you also need the certificate from the certificate authority. And then you have to use OpenSSL, an example which works with PCS11, you generate the certificate request on the file. And you take this file and you can copy and paste it into a web page on the certificate authority. And then you can get the certificate from the certificate authority. And then finally you can use PCS15 to store the certificate on the smart card. Now finally you have the smart card that you can use in Firefox for instance to do SSL, TLS authentication. So you can easily script this for a small business or a group like this, so you can issue smart cards. That wouldn't be any problem and there are also companies who kind of wrap this to make their own smart card personalization systems to fit with maybe GUI's in Python or something like that. So this is the labor intensive way. In an enterprise or large scale environment this is usually not kind of acceptable because they are so cheap. So they want to do everything without manual labor. So then they want to bring in CMS. It of course means a lot of things. In this context the CMS is a card management system, not the content management system, not the cryptographic message syntax but it's a card management system. And so those are used by large companies to actually enroll, issue and manage this life cycle that I mentioned in the beginning. And it also has a lot of integration points. The CMS can integrate the LDAP and legacy systems to when you provision a user with a smart card and also distributed in the organization to all the systems who are relying third parties and actually want to receive this ID. And there are... Yeah. And if you have a system like this you usually have several databases. The certificate authority has a database with certificates to manage the certificate, to be able to revoke the certificate, the issue revocation lists, etc. And the card management system also has a database with the ID, numbers of the cards, etc. So you can keep track of which person got which I accept, the smart card, etc. There, of course, I mentioned that CMS can easily base the use of NSE to create your card management system. It wouldn't be rocket science in place. There are plenty of companies who make card management system. This is just a few examples which we have been working with from some time or another. A venture Finnish company, ATE is Dutch, second maker Swedish, Gemalto, over two big ones. Card management framework here is actually an open source card management system, which is the only open source one. Unfortunately, it relies on a proprietary or commercial PCC as a level library, so it doesn't use open SE at least yet. So this is actually, if you talk about this whole chain of using smart cards, this is one area where there's a gap of a source of work, at least my knowledge, and this is the card management area. And that was actually it. I was very fast. So I'm open for questions. And of course, I challenge you to develop a card management system based on open SE. I have a question. What is, how big is the gap between PrimeKey's current products and the CMS that you would like? What PrimeKey's products are, PrimeKey's product is this part. So we completely fooled this part. PrimeKey doesn't do anything in this part. What do you think is the reason why this is so? That we don't do anything in this part? No, no, no. They just don't do anything, but that, first of all, it's kind of complicated and that there is no open source-ish solution. What's the reason for this? I think that one reason, which is part of the reason why we don't do this, is once you start doing this, you easily get a kind of transition here from where we are on the server side. It's very comfortable and nice. You deal with IT staff, which are very competent, et cetera, many transition here. You start getting into the real user and Windows desktop, which you don't get to mess with, of course. Do you feel any bug guard cards? Exactly. There are lots of cards which are very different. There are no good standards for cards, which Martin, of course, knows everything. And the main delwares are very bad? Yes. So do you know about the Doctech system? I think I've heard it somewhere. That was privately Netscape certificate system, now Red Hat certificate system, and it has been open-sourced as Doctech. I think it should be similar to what's happening here. The Hits have definitely certificate of 40, the Doctech, that's the old Netscape certificate of 40. But I don't think there's also nothing in this area. I guess they are. The problem with Doctech is that they're kind of stuck in time. It's also very... The Carson cord is one or two Java cards very specific. And as I said, the card issuing is very often protected. The cryptographic keys, NDAs, very binding contracts. So it's not really an open platform. They kind of fulfill their needs for their corporate requirements. You said earlier that it was possible to build an HSM on OpenSC on a smart card. But it's only to protect the root key. When you mean HSM, is that an embedded device for the crypto disk? Or is this a relational database based on Pkcs11 doing complete crypto? Yeah, just a hardware crypto device based on Pkcs11 who performs the cryptographic operations. In this case, the HSM would just be a card reader and a smart card. It's right that the smart card area which you have to deal with here is very... It has all the different vendors with no really open standards. Yes, Java card is an open standard, but it's very low level. So that's why it's quite complex. Right now, a lot of things on the wire are quite well standardized with SSL and things like that. Issuing and so on. When you have a large organization with LZ, you're running chip cards. You're going to roll them out together with the readers and things like that. So a certain amount of proprietary stuff is almost acceptable there. If you have thousands of people that are so expensive that it has to work, you have someone to blame to work. Because you've got so many people involved in the organization that you would never ever get through otherwise. Now, at that CMS part, that's of course a little different, right? Because there's a rule for a standard and a massive benefit if you have one CMS system working with a wide range of cards and things like that. So if you look at OpenSC today, it covers a pretty wide range, effectively. Could you make it more, or is there a way of slicing the dice in a program a little bit different by lobing off the whole browser side and things like that? Well, that's only focused on the issuing side, or somehow finding a way of making the issuing protocol supported by open source. It lets tail and leave proprietary in the browser. So basically as an interim step to get to this point, is there something pragmatic you could do there? Or do you have to solve the whole problem in one pass? Well, I think you can be quite pragmatic and kind of mix a match a little bit. Definitely. Well, where would you draw the line? What problem do you solve? What problem with the CMS do you really have to solve of the standard to get the maximum benefit? And what step can you leave a little proprietary knowing that smart cards in the world is really expensive? Well, currently, I would say where you usually are the most proprietary is on Windows clients. While the stuff in the middle can be more or less handled quite easily with open source things. At least that's my current opinion. Very nice. Okay. I think time for cigarettes again. Thank you.
 Okay, hi, my name is Thomas Kussersson and I'm working for a small open source company,  Crimekey. We developed open source API and the right product,  EVCA's certificate authority and sign service,  server-side digital signature service stuff.  And I'm going to talk a little bit about the whole kind of chain when using smart cards,  because there is...  Well, okay, skip that. When you have a smart card, it's not only that well,  you can have a smart card and you can use it on your PC.  There's actually... when you want to use it in a bigger environment for a serious business like an electronic ID, etc.  There's a whole life cycle around it that you have to manage.  And this is called certificate life cycle management, this slide,  but it might as well say a smart card life cycle management.  Because for each smart card or certificate, you first issue it to someone,  and then you can use it.  And then when it will expire, then you have to renew it.  If you lose it, then you have to revoke it, or you can revoke it,  so someone else can't steal it and use it.  And in the end, it expires and you throw it away and you just can't use it anymore.  So those are different states that these certificates and smart cards go through during the time.  And of course, you can manage this life cycle in various ways.  One, you can do it manually in a small environment where it's fine for a small scale.  Of course, it's more labor intensive, it takes some more time,  but you can easily issue hundreds of electronic IDs with that.  But for larger enterprises or countries, etc.,  you want some more automated life cycle management in order to automate these processes, etc.  And then there are different standard protocols that can be used to back release automated life cycle management.  So this is just something showing that there is actually a very large amount of different protocols  and different things that have to interact in a PKI environment,  where you can issue different types of certificates, different types of smart cards for different purposes.  You have smart card management, you have LBata directories,  leaden routers, web browsers, etc.  So it's actually, well, it can become, it easily becomes quite complex  and not very easy to manage at all.  So for, we concentrate on the smart card system.  As I said, it's not only that you have a smart card and smart card reader on your desktop.  And in order for it to work, well, you actually have a whole chain.  You have a certificate authority in the back end,  which is certificates for your PKI cards, smart cards.  You have certificates that has to be transferred somewhere, some way to the smart card.  And that's called enrollment process.  And actually you can use smart card on both ends of this chain.  In the left end here, we have a hardware security module for a certificate authority.  This can either be over 25,000 euro hardware box from SafeNet or U2Make or something,  or you can also use a smart card with open SE, PPCS11 for this as well.  And on the right side, of course, you have all the thousands or millions of smart cards for users.  So in the back end, a hardware security module, which can be a smart card,  protects the certificate authority's private keys so it can't be copied by someone who breaks into the server.  And this requires a, also have a kind of a life cycle management to this particular token.  And you have to have some sort of key ceremony to generate it in a control way.  Because it's usually required that this can be ordered to have a please, if it's like in a company or a company escape.  And then on the other right hand side, you have the issuance of or provisioning of the users with their usable tokens,  which they can actually use to do some online faxing or banking or online voting or whatever.  And that involves personalizing this smart card which comes blank, which you have received from Michel.  But you have to personalize it so it actually contains your certificate.  And you can do this very fine with the raw, just open SE actually.  But then this is then a demonstration of a manual process which contains some steps that you have to do.  You can get your, this is actually for if you have a Siemens card always card.  You can initialize the card, you form up the card, you create the PCS15 file structure on the card,  you can unit the card with a old PCS11 slot.  You can generate, then you have to generate key pair in order to have your private and public keys.  And after this, now you have actually a smart card with keys on it.  But in order to be able to use it as an ID, you also need the certificate from the certificate authority.  And then you have to use OpenSSL, an example which works with PCS11,  you generate the certificate request on the file.  And you take this file and you can copy and paste it into a web page on the certificate authority.  And then you can get the certificate from the certificate authority.  And then finally you can use PCS15 to store the certificate on the smart card.  Now finally you have the smart card that you can use in Firefox for instance to do SSL, TLS authentication.  So you can easily script this for a small business or a group like this,  so you can issue smart cards.  That wouldn't be any problem and there are also companies who kind of wrap this to make their own smart card personalization systems  to fit with maybe GUI's in Python or something like that.  So this is the labor intensive way.  In an enterprise or large scale environment this is usually not kind of acceptable because they are so cheap.  So they want to do everything without manual labor.  So then they want to bring in CMS.  It of course means a lot of things.  In this context the CMS is a card management system, not the content management system,  not the cryptographic message syntax but it's a card management system.  And so those are used by large companies to actually enroll, issue and manage this life cycle that I mentioned in the beginning.  And it also has a lot of integration points.  The CMS can integrate the LDAP and legacy systems to when you provision a user with a smart card  and also distributed in the organization to all the systems who are relying third parties  and actually want to receive this ID.  And there are...  Yeah.  And if you have a system like this you usually have several databases.  The certificate authority has a database with certificates to manage the certificate,  to be able to revoke the certificate, the issue revocation lists, etc.  And the card management system also has a database with the ID, numbers of the cards, etc.  So you can keep track of which person got which I accept, the smart card, etc.  There, of course, I mentioned that CMS can easily base the use of NSE to create your card management system.  It wouldn't be rocket science in place.  There are plenty of companies who make card management system.  This is just a few examples which we have been working with from some time or another.  A venture Finnish company, ATE is Dutch, second maker Swedish, Gemalto, over two big ones.  Card management framework here is actually an open source card management system,  which is the only open source one.  Unfortunately, it relies on a proprietary or commercial PCC as a level library,  so it doesn't use open SE at least yet.  So this is actually, if you talk about this whole chain of using smart cards,  this is one area where there's a gap of a source of work, at least my knowledge,  and this is the card management area.  And that was actually it. I was very fast.  So I'm open for questions.  And of course, I challenge you to develop a card management system based on open SE.  I have a question.  What is, how big is the gap between PrimeKey's current products and the CMS that you would like?  What PrimeKey's products are, PrimeKey's product is this part.  So we completely fooled this part.  PrimeKey doesn't do anything in this part.  What do you think is the reason why this is so?  That we don't do anything in this part?  No, no, no. They just don't do anything, but that, first of all, it's kind of complicated  and that there is no open source-ish solution.  What's the reason for this?  I think that one reason, which is part of the reason why we don't do this, is once you start doing this,  you easily get a kind of transition here from where we are on the server side.  It's very comfortable and nice.  You deal with IT staff, which are very competent, et cetera, many transition here.  You start getting into the real user and Windows desktop, which you don't get to mess with, of course.  Do you feel any bug guard cards?  Exactly. There are lots of cards which are very different.  There are no good standards for cards, which Martin, of course, knows everything.  And the main delwares are very bad?  Yes.  So do you know about the Doctech system?  I think I've heard it somewhere.  That was privately Netscape certificate system, now Red Hat certificate system,  and it has been open-sourced as Doctech. I think it should be similar to what's happening here.  The Hits have definitely certificate of 40, the Doctech, that's the old Netscape certificate of 40.  But I don't think there's also nothing in this area.  I guess they are.  The problem with Doctech is that they're kind of stuck in time.  It's also very... The Carson cord is one or two Java cards very specific.  And as I said, the card issuing is very often protected.  The cryptographic keys, NDAs, very binding contracts.  So it's not really an open platform.  They kind of fulfill their needs for their corporate requirements.  You said earlier that it was possible to build an HSM on OpenSC on a smart card.  But it's only to protect the root key.  When you mean HSM, is that an embedded device for the crypto disk?  Or is this a relational database based on Pkcs11 doing complete crypto?  Yeah, just a hardware crypto device based on Pkcs11 who performs the cryptographic operations.  In this case, the HSM would just be a card reader and a smart card.  It's right that the smart card area which you have to deal with here is very...  It has all the different vendors with no really open standards.  Yes, Java card is an open standard, but it's very low level.  So that's why it's quite complex.  Right now, a lot of things on the wire are quite well standardized with SSL and things like that.  Issuing and so on.  When you have a large organization with LZ, you're running chip cards.  You're going to roll them out together with the readers and things like that.  So a certain amount of proprietary stuff is almost acceptable there.  If you have thousands of people that are so expensive that it has to work, you have someone to blame to work.  Because you've got so many people involved in the organization that you would never ever get through otherwise.  Now, at that CMS part, that's of course a little different, right?  Because there's a rule for a standard and a massive benefit if you have one CMS system working with a wide range of cards and things like that.  So if you look at OpenSC today, it covers a pretty wide range, effectively.  Could you make it more, or is there a way of slicing the dice in a program a little bit different by lobing off the whole browser side and things like that?  Well, that's only focused on the issuing side, or somehow finding a way of making the issuing protocol supported by open source.  It lets tail and leave proprietary in the browser.  So basically as an interim step to get to this point, is there something pragmatic you could do there?  Or do you have to solve the whole problem in one pass?  Well, I think you can be quite pragmatic and kind of mix a match a little bit. Definitely.  Well, where would you draw the line?  What problem do you solve?  What problem with the CMS do you really have to solve of the standard to get the maximum benefit?  And what step can you leave a little proprietary knowing that smart cards in the world is really expensive?  Well, currently, I would say where you usually are the most proprietary is on Windows clients.  While the stuff in the middle can be more or less handled quite easily with open source things.  At least that's my current opinion.  Very nice.  Okay.  I think time for cigarettes again.  Thank you.
security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_0_47.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_48_119.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_120_383.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_384_467.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_468_575.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_576_863.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_864_923.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_924_3395.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_3396_8651.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_8652_10547.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_10548_10967.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_10968_12119.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_12120_12167.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_12168_12227.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_12228_12323.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_12324_13283.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_13284_15275.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_15276_15887.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_15888_21671.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_21672_21719.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_21720_23183.png security_1530_ejbca_gustavsson_TrRIE7GeG0k_2_23184_24321.png
Okay, hi, my name is Thomas Kussersson and I'm working for a small open source company, Crimekey. We developed open source API and the right product, EVCA's certificate authority and sign service, server-side digital signature service stuff. And I'm going to talk a little bit about the whole kind of chain when using smart cards, because there is... Well, okay, skip that. When you have a smart card, it's not only that well, you can have a smart card and you can use it on your PC. There's actually... when you want to use it in a bigger environment for a serious business like an electronic ID, etc. There's a whole life cycle around it that you have to manage. And this is called certificate life cycle management, this slide, but it might as well say a smart card life cycle management. Because for each smart card or certificate, you first issue it to someone, and then you can use it. And then when it will expire, then you have to renew it. If you lose it, then you have to revoke it, or you can revoke it, so someone else can't steal it and use it. And in the end, it expires and you throw it away and you just can't use it anymore. So those are different states that these certificates and smart cards go through during the time. And of course, you can manage this life cycle in various ways. One, you can do it manually in a small environment where it's fine for a small scale. Of course, it's more labor intensive, it takes some more time, but you can easily issue hundreds of electronic IDs with that. But for larger enterprises or countries, etc., you want some more automated life cycle management in order to automate these processes, etc. And then there are different standard protocols that can be used to back release automated life cycle management. So this is just something showing that there is actually a very large amount of different protocols and different things that have to interact in a PKI environment, where you can issue different types of certificates, different types of smart cards for different purposes. You have smart card management, you have LBata directories, leaden routers, web browsers, etc. So it's actually, well, it can become, it easily becomes quite complex and not very easy to manage at all. So for, we concentrate on the smart card system. As I said, it's not only that you have a smart card and smart card reader on your desktop. And in order for it to work, well, you actually have a whole chain. You have a certificate authority in the back end, which is certificates for your PKI cards, smart cards. You have certificates that has to be transferred somewhere, some way to the smart card. And that's called enrollment process. And actually you can use smart card on both ends of this chain. In the left end here, we have a hardware security module for a certificate authority. This can either be over 25,000 euro hardware box from SafeNet or U2Make or something, or you can also use a smart card with open SE, PPCS11 for this as well. And on the right side, of course, you have all the thousands or millions of smart cards for users. So in the back end, a hardware security module, which can be a smart card, protects the certificate authority's private keys so it can't be copied by someone who breaks into the server. And this requires a, also have a kind of a life cycle management to this particular token. And you have to have some sort of key ceremony to generate it in a control way. Because it's usually required that this can be ordered to have a please, if it's like in a company or a company escape. And then on the other right hand side, you have the issuance of or provisioning of the users with their usable tokens, which they can actually use to do some online faxing or banking or online voting or whatever. And that involves personalizing this smart card which comes blank, which you have received from Michel. But you have to personalize it so it actually contains your certificate. And you can do this very fine with the raw, just open SE actually. But then this is then a demonstration of a manual process which contains some steps that you have to do. You can get your, this is actually for if you have a Siemens card always card. You can initialize the card, you form up the card, you create the PCS15 file structure on the card, you can unit the card with a old PCS11 slot. You can generate, then you have to generate key pair in order to have your private and public keys. And after this, now you have actually a smart card with keys on it. But in order to be able to use it as an ID, you also need the certificate from the certificate authority. And then you have to use OpenSSL, an example which works with PCS11, you generate the certificate request on the file. And you take this file and you can copy and paste it into a web page on the certificate authority. And then you can get the certificate from the certificate authority. And then finally you can use PCS15 to store the certificate on the smart card. Now finally you have the smart card that you can use in Firefox for instance to do SSL, TLS authentication. So you can easily script this for a small business or a group like this, so you can issue smart cards. That wouldn't be any problem and there are also companies who kind of wrap this to make their own smart card personalization systems to fit with maybe GUI's in Python or something like that. So this is the labor intensive way. In an enterprise or large scale environment this is usually not kind of acceptable because they are so cheap. So they want to do everything without manual labor. So then they want to bring in CMS. It of course means a lot of things. In this context the CMS is a card management system, not the content management system, not the cryptographic message syntax but it's a card management system. And so those are used by large companies to actually enroll, issue and manage this life cycle that I mentioned in the beginning. And it also has a lot of integration points. The CMS can integrate the LDAP and legacy systems to when you provision a user with a smart card and also distributed in the organization to all the systems who are relying third parties and actually want to receive this ID. And there are... Yeah. And if you have a system like this you usually have several databases. The certificate authority has a database with certificates to manage the certificate, to be able to revoke the certificate, the issue revocation lists, etc. And the card management system also has a database with the ID, numbers of the cards, etc. So you can keep track of which person got which I accept, the smart card, etc. There, of course, I mentioned that CMS can easily base the use of NSE to create your card management system. It wouldn't be rocket science in place. There are plenty of companies who make card management system. This is just a few examples which we have been working with from some time or another. A venture Finnish company, ATE is Dutch, second maker Swedish, Gemalto, over two big ones. Card management framework here is actually an open source card management system, which is the only open source one. Unfortunately, it relies on a proprietary or commercial PCC as a level library, so it doesn't use open SE at least yet. So this is actually, if you talk about this whole chain of using smart cards, this is one area where there's a gap of a source of work, at least my knowledge, and this is the card management area. And that was actually it. I was very fast. So I'm open for questions. And of course, I challenge you to develop a card management system based on open SE. I have a question. What is, how big is the gap between PrimeKey's current products and the CMS that you would like? What PrimeKey's products are, PrimeKey's product is this part. So we completely fooled this part. PrimeKey doesn't do anything in this part. What do you think is the reason why this is so? That we don't do anything in this part? No, no, no. They just don't do anything, but that, first of all, it's kind of complicated and that there is no open source-ish solution. What's the reason for this? I think that one reason, which is part of the reason why we don't do this, is once you start doing this, you easily get a kind of transition here from where we are on the server side. It's very comfortable and nice. You deal with IT staff, which are very competent, et cetera, many transition here. You start getting into the real user and Windows desktop, which you don't get to mess with, of course. Do you feel any bug guard cards? Exactly. There are lots of cards which are very different. There are no good standards for cards, which Martin, of course, knows everything. And the main delwares are very bad? Yes. So do you know about the Doctech system? I think I've heard it somewhere. That was privately Netscape certificate system, now Red Hat certificate system, and it has been open-sourced as Doctech. I think it should be similar to what's happening here. The Hits have definitely certificate of 40, the Doctech, that's the old Netscape certificate of 40. But I don't think there's also nothing in this area. I guess they are. The problem with Doctech is that they're kind of stuck in time. It's also very... The Carson cord is one or two Java cards very specific. And as I said, the card issuing is very often protected. The cryptographic keys, NDAs, very binding contracts. So it's not really an open platform. They kind of fulfill their needs for their corporate requirements. You said earlier that it was possible to build an HSM on OpenSC on a smart card. But it's only to protect the root key. When you mean HSM, is that an embedded device for the crypto disk? Or is this a relational database based on Pkcs11 doing complete crypto? Yeah, just a hardware crypto device based on Pkcs11 who performs the cryptographic operations. In this case, the HSM would just be a card reader and a smart card. It's right that the smart card area which you have to deal with here is very... It has all the different vendors with no really open standards. Yes, Java card is an open standard, but it's very low level. So that's why it's quite complex. Right now, a lot of things on the wire are quite well standardized with SSL and things like that. Issuing and so on. When you have a large organization with LZ, you're running chip cards. You're going to roll them out together with the readers and things like that. So a certain amount of proprietary stuff is almost acceptable there. If you have thousands of people that are so expensive that it has to work, you have someone to blame to work. Because you've got so many people involved in the organization that you would never ever get through otherwise. Now, at that CMS part, that's of course a little different, right? Because there's a rule for a standard and a massive benefit if you have one CMS system working with a wide range of cards and things like that. So if you look at OpenSC today, it covers a pretty wide range, effectively. Could you make it more, or is there a way of slicing the dice in a program a little bit different by lobing off the whole browser side and things like that? Well, that's only focused on the issuing side, or somehow finding a way of making the issuing protocol supported by open source. It lets tail and leave proprietary in the browser. So basically as an interim step to get to this point, is there something pragmatic you could do there? Or do you have to solve the whole problem in one pass? Well, I think you can be quite pragmatic and kind of mix a match a little bit. Definitely. Well, where would you draw the line? What problem do you solve? What problem with the CMS do you really have to solve of the standard to get the maximum benefit? And what step can you leave a little proprietary knowing that smart cards in the world is really expensive? Well, currently, I would say where you usually are the most proprietary is on Windows clients. While the stuff in the middle can be more or less handled quite easily with open source things. At least that's my current opinion. Very nice. Okay. I think time for cigarettes again. Thank you.
protocols that can be used to back release order for it to work, well, you actually have a whole chain. You have a certificate authority in in order to be able to use it as an ID, you also of integration points. The CMS can integrate the a database with certificates to manage the is actually, if you talk about this whole chain of using smart cards, this is one area where are quite well standardized with SSL and things