Archive for August, 2009

Mac OS X and eToken PKI Client

I’ve also managed to get the Mac drivers for another of the common USB crypto tokens, this time from Aladdin Systems (who are now owned by SafeNet, but that’s neither here nor there).

Installation is about the same, however having a “proper” graphical token management utility (eToken Properties) is much much nicer than having to use a command line based utility. The installer logs you out after it’s done its’ thing, however it took a full reboot before the token was recognised.

I didn’t have the doco handy, so I don’t know if it goes in to detail on how to configure Firefox to use the token; but the process is basically the same as for the SafeNet iKey — go in to the Firefox preferences, Advanced > Encryption > Security Devices > Load, given the module a name (like “eToken PKI” maybe) and point to the following file location:

/Library/Frameworks/eToken.framework/Versions/Current/libeToken.dylib

Restart Firefox just to be sure, but everything should just work. Attempting to use Keychain Access to manage the token is just as pointless an activity as with the iKey token, though at least the Keychain Access app doesn’t crash. In any case, it’s easy enough to use the token management tool to import and delete certificates – that is, unless you’re trying to import CA certificates on to the token, because the only format it can cope with importing is PKCS12 (which is retarded, because the Windows version of the same utility has no problems importing CA certificates). If the PKCS12 file has CA certificates, they do get imported properly.

Key generation is a bit faster than with the iKey token — though whether that is due to better hardware/drivers, I don’t know.

What will be very interesting to see is whether these drivers (and the iKey drivers) work at all with Mac OS X Snow Leopard. I’m guessing they will (at least, with Firefox) – but I’m still waiting on my copy of Snow Leopard to show up, so it’s a bit of a mystery to me for now.

- zac.

2009
08/29
CATEGORY
General
10 comments

Mac OSX and SafeNet iKey tokens

I finally managed to get my hands on the SafeNet iKey token drivers for Mac OSX. For reasons I still don’t entirely understand, SafeNet have seen fit to make the Windows drivers freely available – but the Mac drivers need $$ spent and CDs shipped from the United States.

The driver CDs that I ordered finally made their way to my desk today – was entertained by the amount of packaging they deemed necessary; 5 CDs came in individual envelopes inside a box that could have easily held 100 CDs! Not very environmentally friendly.

Installing the drivers is simple enough, but configuring Firefox is a little more complicated (you have to configure the PKCS11 security device in the advanced preferences by hand). Instruction manual reading required.

First attempt to get things going (on an ancient Graphite Power Mac G4) was filled with fail; the token utility program couldn’t see the token I was trying to use. I suspect the problem was more related to dodgy USB ports than anything else, but no way to test properly. Second installation attempt on my MacBook Core Duo worked properly – token was now recognised, but I couldn’t do anything with it. Pro tip #1: use a token that isn’t damaged.

Once configured, the token needs to be removed and reinserted before Keychain Access can see it and interact with it. Pro tip #2: don’t expect much from Keychain Access. You can’t import PKCS12 files to the token and it crashes if you look at it the wrong way. :( Use Firefox instead.

Once configured, Firefox handles certificate imports quite nicely – and enrolling/installing certificates using our regular enrollment pages works properly as well (albeit key generation takes a very long time indeed). During enrollment, you’re first prompted to choose a security level (key size) and then the security device, which will allow you to select the token for key storage (the token label is what appears in the dropdown). During certificate installation, Firefox automagically works out where the certificate should live and asks for the token password if needed.

The one annoyance is that any CA certificates are copied to the browser store and not the token store; Firefox won’t have it any other way. There doesn’t appear to be any method of moving CA certificates to the token on a Mac, whether by using Firefox or the included token utility.

Exciting stuff.

- zac.

2009
08/18
CATEGORY
General
6 comments

Advert