arrow-left

All pages
gitbookPowered by GitBook
1 of 1

Loading...

Oberthur Cosmo One v7.3

circle-exclamation

Sample code uses ES6 language features such as arrow functions and promises. For compatibility with IE11, code written with these features must be either transpiled using tools like Babel or refactored accordingly using callbacks.

hashtag
Introduction

The ID-One Cosmo V7-n is part of the Oberthur family of cryptographic modules called ID-One Cosmo V7. Modules within

this family share the same functionalities and the description of the ID-One Cosmo V7 applies to all versions including the “-n” subject to this validation.

This document describes the functionality provided by the Oberthur ID-One smartcard - which is a PKI container:

  • ID-One Cosmo V7-n; FIPS 140-2 Security Policy

hashtag
Interface

hashtag
Models

All model information can be found in the

hashtag
Examples

hashtag
Create the Oberthur module

When initialisation is finished you can continue using the aventra object to execute the functions below.

hashtag
Token info

You can fetch the token information via the function. this will give all the information of the token you need according to the PKCS11 specifications

hashtag
All certificate filters

hashtag
Extended certificates

You can also fetch the extended versions of the certificates via the functions

this has the capabilities to return multiple certificates if the token has multiple of this type.

for a single certificate the response looks like:

the allCertsExtended returns the following, with the contents of the certificates as the one you can see above;

The expected response for this call should be;

hashtag
all Key references

The expected response for this call should be;

hashtag
all Certificates

Exposes all the certificates publicly available on the smart card. The following certificates can be found on the card:

  • Root certificate

  • Signing certificate

  • Authentication certificate

When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not.

The expected response for this call should be;

hashtag
Token data

This will return information of the Aventra card.

The expected response for this call should be;

hashtag
Certificate

When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not.

hashtag
Root certificate

Contains the 'root certificate' stored on the smart card. The service can be called:

hashtag
Authentication certificate.

Contains the 'authentication certificate' stored on the smart card. The 'authentication certificate' contains the public key corresponding to the private RSA authentication key. The 'authentication certificate' is needed for pin validation, authentication and singing. The service can be called:

hashtag
Non repudiation certificate

Contains the 'non-repudiation certificate' stored on the smart card. The 'non-repudiation certificate' contains the public key corresponding the private RSA non-repudiation key. The service can be called:

hashtag
Issuer certificate

hashtag
Encryption certificate

The expected response for these calls should be in the following format;

hashtag
Verify pin

The expected response for these calls should be in the following format;

hashtag
Sign

Data can be signed using the smartcard. To do so, the SDK facilitates in:

  • Retrieving the certificate chain (root, intermediate and non-repudiation certificate)

  • Perform a sign operation (private key stays on the smart card)

  • Return the signed has

To sign data, an algorithm must be specified in the algorithm property (see ), and a Base64-encoded string representation of the digest bytes of the same algorithm in the data property.

Additionally, it is possible to bulk sign data without having to re-enter the PIN by adding an optional bulk parameter set to true to the request. Subsequent sign requests will not require the PIN to be re-entered until a request with bulk being set to false is sent, or the method is called.

triangle-exclamation

When using bulk signing, great care must be taken to validate that the first signature request was successful prior to sending subsequent requests. Failing to do this will likely result in the card being blocked.

The expected response for this call should be;

hashtag
Raw data signing

With the function signRaw you can sign unhashed document data. This means that the Trust1Connector will hash the value itself depending on the provided sign algorithm.

circle-exclamation

Trust1Connector only supports SHA2 hashing at this point.

When using SHA3, the Trust1Connector will convert to SHA2 implicitly

Below you can find an example

The function looks the same as a regular sign operation but expects a base64 data object that is unhashed.

Supported hash functions (SHA2) are;

  • SHA256

  • SHA384

  • SHA512

hashtag
Bulk PIN Reset

The PIN set for bulk signing can be reset by calling this method.

Response will look like:

hashtag
Authenticate

The SDK is able to authenticate a card holder based on a challenge. The challenge can be:

  • provided by an external service

  • provided by the smart card

    An authentication can be interpreted as a signature use case, the challenge is signed data, that can be validated in a back-end process.

The expected response for this call should be;

hashtag
Retrieve supported algorithms

The expected response for this call should be;

hashtag
Validate signature

The module allows you to call a function on the token that can validate a signature. For this we need to use the validateSignature function. You can call this one via;

The response of this function will return a valid property that is either true or false.

Issuer certificate
  • Encryption certificate

  • Token typings model page
    Supported Algorithms
    Bulk PIN Reset
    export interface AbstractOberthur73 {
        allCerts(parseCerts?: boolean, filters?: string[] | Options, callback?: (error: T1CLibException, data: TokenAllCertsResponse) => void): Promise<TokenAllCertsResponse>;
        tokenData(callback?: (error: T1CLibException, data: TokenInfoResponse) => void): Promise<TokenInfoResponse>;
        rootCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
        authenticationCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
        nonRepudiationCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
        encryptionCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
        issuerCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>
    
        allCertsExtended(parseCerts?: boolean, filters?: string[] | Options, callback?: (error: T1CLibException, data: TokenAllCertsExtendedResponse) => void): Promise<TokenAllCertsExtendedResponse>;
        rootCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
        authenticationCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
        nonRepudiationCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
        encryptionCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
        issuerCertificateExtended(parseCerts?: boolean,  callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    
        validateSignature(body: TokenValidateSignatureRequest, callback?: (error: T1CLibException, data: TokenValidateSignatureResponse) => void): Promise<TokenValidateSignatureResponse>;
    
        verifyPin(body: TokenVerifyPinData, callback?: (error: T1CLibException, data: TokenVerifyPinResponse) => void): Promise<TokenVerifyPinResponse>;
        authenticate(body: TokenAuthenticateOrSignData, callback?: (error: T1CLibException, data: TokenAuthenticateResponse) => void): Promise<TokenAuthenticateResponse>;
        sign(body: TokenAuthenticateOrSignData, bulk?: boolean, callback?: (error: T1CLibException, data: TokenSignResponse) => void): Promise<TokenSignResponse>;
        signRaw(body: TokenAuthenticateOrSignData, bulk?: boolean, callback?: (error: T1CLibException, data: TokenSignResponse) => void): Promise<TokenSignResponse>;
        allAlgoRefs(callback?: (error: T1CLibException, data: TokenAlgorithmReferencesResponse) => void): Promise<TokenAlgorithmReferencesResponse>
        resetBulkPin(callback?: (error: T1CLibException, data: BoolDataResponse) => void): Promise<BoolDataResponse>;
    }
    T1cSdk.initialize(config).then(res => {
        const oberthur = res.client.oberthur(readerId);
    }, err => {
        console.error(error)
    });
    module.tokenData().then(res => {
        // see response below
    })
    {
        "success": true,
        "data": {
            "info": {
                "slot": "string",
                "label": "string",
                "manufacturerId": "string",
                "model": "string",
                "serialNumber": "string",
                "flags": {
                    "isRandomNumberGenerator": "boolean",
                    "isWriteProtected": "boolean",
                    "isLoginRequired": "boolean",
                    "isUserPinInitialized": "boolean",
                    "isRestoreKeyNotNeeded": "boolean",
                    "isClockOnToken": "boolean",
                    "isProtectedAuthenticationPath": "boolean",
                    "isDualCryptoOperations": "boolean",
                    "isTokenInitialized": "boolean",
                    "isSecondaryAuthentication": "boolean",
                    "isUserPinCountLow": "boolean",
                    "isUserPinFinalTry": "boolean",
                    "isUserPinLocked": "boolean",
                    "isUserPinToBeChanged": "boolean",
                    "isSoPinCountLow": "boolean",
                    "isSoPinFinalTry": "boolean",
                    "isSoPinLocked": "boolean",
                    "isSoPinToBeChanged": "boolean"
                },
                "mechanisms": [
                    {
                        "mechanism": "string",
                        "flags": {
                            "isHardware": "boolean",
                            "isEncrypt": "boolean",
                            "isDecrypt": "boolean",
                            "isDigest": "boolean",
                            "isSign": "boolean",
                            "isSignRecover": "boolean",
                            "isVerify": "boolean",
                            "isVerifyRecover": "boolean",
                            "isGenerate": "boolean",
                            "isGenerateKeyPair": "boolean",
                            "isWrap": "boolean",
                            "isUnwrap": "boolean",
                            "isExtension": "boolean",
                            "isEcFP": "boolean",
                            "isEcNamedcurve": "boolean",
                            "isEcUncompress": "boolean",
                            "isEcCompress": "boolean"
                        },
                        "ulMinKeySize": "number",
                        "ulMaxKeySize": "number"
                    }
                ],
                "ulMaxSessionCount": "number",
                "ulSessionCount": "number",
                "ulMaxRwSessionCount": "number",
                "ulMaxPinLen": "number",
                "ulMinPinLen": "number",
                "ulTotalPubLicMemory": "number",
                "ulFreePubMemory": "number",
                "ulTotalPrivateMemory": "number",
                "ulFreePrivateMemory": "number",
                "hardwareVersion": "string",
                "firmwareVersion": "string"
            },
            "infoType": "TokenInfoType"
        }
    }
    
    
    
    //ENUM
    TokenInfoType {
        Token,
        PKCS11,
        File,
        Payment,
        HSM,
        Vault,
        Wallet,
    }
    allCertsExtended(parseCerts?: boolean, filters?: string[] | Options, callback?: (error: T1CLibException, data: TokenAllCertsExtendedResponse) => void): Promise<TokenAllCertsExtendedResponse>;
    rootCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    authenticationCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    nonRepudiationCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    encryptionCertificateExtended(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    issuerCertificateExtended(parseCerts?: boolean,  callback?: (error: T1CLibException, data: TokenCertificateExtendedResponse) => void): Promise<TokenCertificateExtendedResponse>;
    {
        "success" : true
        "data" : {
            "certificates": [{
                "certificate"?: string,
                "certificateType"?: string,
                "id"?: string,
                "subject"?: string,
                "issuer"?: string,
                "serialNumber"?: string,
                "url"?: string,
                "hashSubPubKey"?: string,
                "hashIssPubKey"?: string,
                "exponent"?: string,
                "remainder"?: string,
                "parsedCertificate"?: Certificate
            }]
        }
    }
    {
        "success" : true
        "data" : {
            "rootCertificate": {
                "certificates": [...]
            },
            "authenticationCertificate": {
                "certificates": [...]
            },
            "nonRepudiationCertificate": {
                "certificates": [...]
            },
            "encryptionCertificates": {
                "certificates": [...]
            },
            "issuerCertificates": {
                "certificates": [...]
            }
       }
    }
    oberthur.allCertFilters().then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: ['rootCertificate', 'authenticationCertificate', 'encryptionCertificate', 'nonRepudiationCertificate', 'issuerCertificate']
    }
    oberthur.allKeyRefs().then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: ['authenticate', 'sign', 'encrypt']
    }
    const filter = ['rootCertificate', 'authenticationCertificate', 'encryptionCertificate'];
    oberthur.allCerts(filter).then(res => {
        res.data
    }, err => {
        console.error(err)
    })
    {
     "rootCertificate": {
      ...
     },
     "authenticationCertificate": {
      ...
     },
     "nonRepudiationCertificate": {
      ...
     },
     "intermediateCertificates": {
      ...
     },
     "encryptionCertificate": {
      ...
     }
    }
    oberthur.tokenData().then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
           version?: string,
           serialNumber?: string,
           label?: string,
           changeCounter?: number,
        }
    }
    oberthur.rootCertificate(parseCertsBoolean).then(res => {
    }, err => {
        console.error(err)
    })
    oberthur.authenticationCertificate(parseCertsBoolean).then(res => {
    }, err => {
        console.error(err)
    })
    oberthur.nonRepudiationCertificate(parseCertsBoolean).then(res => {
    }, err => {
        console.error(err)
    })
    oberthur.issuerCertificate(parseCertsBoolean).then(res => {
    }, err => {
        console.error(err)
    })
    aventra.encryptionCertificate(parseCertsBoolean).then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
            certificate?: string,
            certificates?: Array<string>,
            certificateType?: string,
            id?: string,
            parsedCertificate?: Certificate,
            parsedCertificates?: Array<Certificate>
        }    
    }
    const data = {
        pin: "1234", // optional
        osDialog: true // optional
    }
    oberthur.verifyPin(data).then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
            "verfied": true
        }
    }
    const data = {
        algorithm: "sha256",
        data: "E1uHACbPvhLew0gGmBH83lvtKIAKxU2/RezfBOsT6Vs=",
        id: "123"
    }
    const bulk = false;
    oberthur.sign(data, bulk).then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
            data: string
        }
    }
    var data = {
          "algorithm":"sha256",
          "data":"vl5He0ulthjX+VWNM46QX7vJ8VvXMq2k/Tq8Xq1bwEw=",
          "osDialog": false,
          "id": "1235s"
    }
    oberthur.signRaw(data, callback);
    diplad.resetBulkPin().then(res => {
    }, err => {
        console.error(err)
    })
    {
        "success": true,
        "data": true
    }
    const data = {
        algorithm: "sha256",
        data: "E1uHACbPvhLew0gGmBH83lvtKIAKxU2/RezfBOsT6Vs="
        id: "123"
    }
    oberthur.authenticate(data).then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
            data: string
        }
    }
    oberthur.allAlgoRefs(data).then(res => {
    }, err => {
        console.error(err)
    })
    {
        success: true,
        data: {
            ref: ['sha256', 'md5']
        }
    }
    const body = {
        "algorithm": 'sha256',
        "hash": '...',
        "signedHash": '...',
        "osDialog": false,
        "id": 'cert_id',
        "pin": 'pin_code',
        "timeout": 120 //timeout in seconds
    }
    safenet.validateSignature(body).then(response => {
        response.valid
    ).catch(error => {
        errorHandler(error)}
    )
    {
        "success": true,
        "data": {
            "valid": true
        }
    }