# Safenet

## Introduction

The following page describes how you can integrate the Safenet module exposed on the Trust1Connector onto your web application.&#x20;

{% hint style="info" %}
Middleware of Safenet has to be installed to be able to fully use the Safenet token.

Supported version of the middleware is;\
Windows: 10.2 - [64bit](https://storage.googleapis.com/t1c-dependencies-prod/pkcs11-middleware/safenet/GlobalSign-Safenet-Authentication-Tools-x64.zip) & [32bit](https://storage.googleapis.com/t1c-dependencies-prod/pkcs11-middleware/safenet/GlobalSign-Safenet-Authentication-Tools-x32.zip)\
MacOS: [10.2](https://storage.googleapis.com/t1c-dependencies-prod/pkcs11-middleware/safenet/SAC_10.2_Mac_GA.zip)
{% endhint %}

## Interface

```javascript
export interface AbstractSafenet {
    allCerts(parseCerts?: boolean, filters?: string[] | Options, callback?: (error: T1CLibException, data: TokenAllCertsResponse) => void): Promise<TokenAllCertsResponse>;
    authenticationCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
    nonRepudiationCertificate(parseCerts?: boolean, callback?: (error: T1CLibException, data: TokenCertificateResponse) => void): Promise<TokenCertificateResponse>;
    verifyPin(body: TokenVerifyPinData, callback?: (error: T1CLibException, data: TokenVerifyPinResponse) => void): Promise<TokenVerifyPinResponse>;
    authenticate(body: TokenAuthenticateOrSignData, callback?: (error: T1CLibException, data: TokenAuthenticateResponse) => void): Promise<TokenAuthenticateResponse>;
    sign(body: TokenAuthenticateOrSignData, bulk?: boolean, callback?: (error: T1CLibException, data: TokenSignResponse) => void): Promise<TokenSignResponse>;
    allAlgoRefs(callback?: (error: T1CLibException, data: TokenAlgorithmReferencesResponse) => void): Promise<TokenAlgorithmReferencesResponse>
    resetBulkPin(callback?: (error: T1CLibException, data: BoolDataResponse) => void): Promise<BoolDataResponse>;
}
```

### Models

All model information can be found in the [Token typings model page](../token-typing-models#models)

## Get Safenet container object

Initialise a Trust1Connector client:

```javascript
T1CSdk.T1CClient.initialize(config).then(res => {
    client = res;
}, err => {
    console.error(error)
});
```

Get the Belgian eID container service:

```javascript
var beid = client.safenet(reader_id);
```

Call a function for the Belgian eID container:

```javascript
function callback(err,data) {
    if(err){console.log("Error:",JSON.stringify(err, null, '  '));}
    else {console.log(JSON.stringify(data, null, '  '));}
}
beid.biometric(callback);
```

### Obtain the Reader-ID

The constructor for the Belgian eID expect as the parameter to be a valid reader-ID. A reader-ID can be obtained from the exposed core functionality, for more information see\
Core services responds with available card-readers, available card in a card-reader, etc.\
For example:\
In order to get all connected card-readers, with available cards:

```javascript
var core = client.core();
core.readersCardAvailable(callback);
```

This function call returns:

```javascript
{
  "data": [
    {
      "card": {
        "atr": "3B9813400AA503010101AD1311",
        "description": [""]
      },
      "id": "57a3e2e71c48cee9",
      "name": "JC Token",
      "pinpad": false
    }
  ],
  "success": true
}
```

All methods for `safenet` will use the selected reader - identified by the `reader_id`.

## Certificates

Exposes all the certificates publicly available on the smart card.

### Root Certificate

Contains the 'root certificate' stored on the smart card. The root certificate is used to sign the 'citizen CA certificate'. When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not.\
The service can be called:

```javascript
client.beid(reader_id).rootCertificate(parseCertsBoolean, callback);
```

Response:

```javascript
{
    success: true,
    data: {
        certificate?: string,
        certificates?: Array<string>,
        certificateType?: string,
        id?: string,
        parsedCertificate?: Certificate,
        parsedCertificates?: Array<Certificate>
    }    
}
```

### Authentication Certificate

Contains the 'authentication certificate' stored on the smart card. The 'authentication certificate' contains the public key corresponding to the private RSA authentication key. The 'authentication certificate' is needed for pin validation and authentication. When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not\
The service can be called:

```javascript
client.beid(reader_id).authenticationCertificate(parseCertsBoolean, callback);
```

Response:

```javascript
{
    success: true,
    data: {
        certificate?: string,
        certificates?: Array<string>,
        certificateType?: string,
        id?: string,
        parsedCertificate?: Certificate,
        parsedCertificates?: Array<Certificate>
    }    
}
```

### Intermediate Certificate (citizen)

Contains the citizen certificate stored on the smart card. The 'citizen certificate' is used to sign the 'authentication certificate' and the 'non-repudiation certificate'. When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not\
The service can be called:

```javascript
client.beid(reader_id).intermediateCertificates(parseCertsBoolean, callback);
```

Response:

```javascript
{
    success: true,
    data: {
        certificate?: string,
        certificates?: Array<string>,
        certificateType?: string,
        id?: string,
        parsedCertificate?: Certificate,
        parsedCertificates?: Array<Certificate>
    }    
}
```

### Non-repudiation Certificate

Contains the 'non-repudiation certificate' stored on the smart card. The 'non-repudiation certificate' contains the public key corresponding the private RSA non-repudiation key. When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not\
The service can be called:

```javascript
client.beid(reader_id).nonRepudiationCertificate(parseCertsBoolean, callback);
```

Response:

```javascript
{
    success: true,
    data: {
        certificate?: string,
        certificates?: Array<string>,
        certificateType?: string,
        id?: string,
        parsedCertificate?: Certificate,
        parsedCertificates?: Array<Certificate>
    }    
}
```

### Encryption Certificate

Contains the 'encryption certificate' stored on the smart card. The 'encryption certificate' corresponds to the private key used to sign the 'biometric' and 'Address' data. When additional parsing of the certificate is needed you can add a boolean to indicate if you want to parse the certificate or not\
The service can be called:

```javascript
client.beid(reader_id).encryptionCertificate(parseCertsBoolean, callback);
```

Response:

```javascript
{
    success: true,
    data: {
        certificate?: string,
        certificates?: Array<string>,
        certificateType?: string,
        id?: string,
        parsedCertificate?: Certificate,
        parsedCertificates?: Array<Certificate>
    }    
}
```

## Data Filter

### Filter Certificates

All certificates on the smart card can be dumped at once, or using a filter. In order to read all certificates at once:

```javascript
var filter = [];
client.beid(reader_id).allCerts(parseCerts, { filters: filter}, callback);
```

Response:

```javascript
{
 "rootCertificate": {
  ...
 },
 "authenticationCertificate": {
  ...
 },
 "nonRepudiationCertificate": {
  ...
 },
 "intermediateCertificates": {
  ...
 },
 "encryptionCertificate": {
  ...
 }
}
```

The filter can be used to ask a list of custom data containers. For example, we want to read only the rootCertificate

```javascript
var filter = ['rootCertificate'];
client.safenet(reader_id).allCerts(parseCerts, { filters: filter}, callback);
```

Response:

```javascript
{
 "rootCertificate": {
  ...
 }
}
```

## Sign Data

### Signing

Data can be signed using the Belgian eID smart card. To do so, the T1C-GCL facilitates in:

* Retrieving the certificate chain (citizen-certificate, root-certificate and non-repudiation certificate)
* Perform a sign operation (private key stays on the smart card)
* Return the signed hash

To get the certificates necessary for signature validation in your back-end:

```javascript
var filter = null;
client.safnet(reader_id).allCerts(parseCerts, { filters: filter}, callback);
```

Response:

```javascript
{
 "rootCertificate": {
  ...
 },
 "authenticationCertificate": {
  ...
 },
 "nonRepudiationCertificate": {
  ...
 },
 "intermediateCertificates": {
  ...
 },
 "encryptionCertificate": {
  ...
 }
}
```

Depending on the connected smart card reader. A sign can be executed in 2 modes:

* Using a connected card reader with 'pin-pad' capabilities (keypad and display available)
* Using a connected card reader without 'pin-pad' capabilities (no keypad nor display available)

### Sign Hash without pin-pad

When the web or native application is responsible for showing the password input, the following request is used to sign a given hash:

```javascript
var data = {
      "pin":"...",
      "algorithm":"sha1",
      "data":"I2e+u/sgy7fYgh+DWA0p2jzXQ7E=",
      "osDialog": true
}
client.safenet(reader_id).sign(data, callback);
```

Response is a base64 encoded signed hash:

```javascript
{
  "success": true,
  "data": {
    "data" : "W7wqvWA8m9S...="
  }
}
```

The 'authenticationreference' property can contain the following values: sha1, sha256, sha512, md5.

### Sign Hash with pin-pad

When the pin entry is done on the pin-pad, the following request is used to sign a given hash:

```javascript
var data = {
      "algorithm":"sha1",
      "data":"I2e+u/sgy7fYgh+DWA0p2jzXQ7E=",
      "osDialog": false
}
client.safenet(reader_id).sign(data, callback);
```

Response is a base64 encoded signed hash:

```javascript
{
  "success": true,
  "data": {
    "data" : "W7wqvWA8m9S...="
  }
}
```

The 'algorithm\_reference' property can contain the following values: sha1, sha256, sha512, md5.

The core services lists connected readers, and if they have pin-pad capability. You can find more information in the Core Service documentation on how to verify card reader capabilities.

## Verify PIN

### Verify PIN without pin-pad

When the web or native application is responsible for showing the password input, the following request is used to verify a card holder PIN:

```javascript
var data = {
      "pin":"..."
}
client.safenet(reader_id).verifyPin(data, callback);
```

Response:

```javascript
{
  "verified": true
}
```

### Verify PIN with pin-pad

When the pin entry is done on the pin-pad, the following request is used to verify a given PIN:

```javascript
var data = {}
client.safenet(reader_id).verifyPin(data, callback);
```

Response:

```javascript
{
  "verified": true
}
```

## Authentication

The T1C is able to authenticate a card holder based on a challenge. The challenge can be:

* provided by an external service
*   provided by the smart card\
    An authentication can be interpreted as a signature use case, the challenge is signed data, that can be validated in a back-end process.

    **External Challenge**

    An external challenge is provided in the data property of the following example:

    ```javascript
    var data = {
      "pin": "...",
      "algorithm": "sha1",
      "data":"I2e+u/sgy7fYgh+DWA0p2jzXQ7E="
    }
    client.safenet(reader_id).authenticate(data, callback);
    ```

    Response:

    ```javascript
    {
      "success": true,
      "data": {
        "data" : "W7wqvWA8m9S...="
      }
    }
    ```

    Take notice that the PIN property can be omitted when using a smart card reader with pin-pad capabilities.\
    The 'algorithm\_reference' property can contain the following values: sha1, sha256, sha512, md5.

    **Generated Challenge**

    A server generated challenge can be provided to the JavaScript library.\
    In order to do so, an additional contract must be provided with the 'OCV API' (Open Certificate Validation API).

```
The calculated digest of the hash is prefixed with:
DigestInfo ::= SEQUENCE {
      digestAlgorithm AlgorithmIdentifier,
      digest OCTET STRING
  }
Make sure this has been taken into consideration in order to validate the signature in a backend process.
```

## Get valid algorithms to use for Sign or Authenticate

Via the Trust1Connector modules you are able to retrieve available algorithms to use for Signing or Authenticate

```javascript
generic.allAlgoRefs(module, callback);
```

The response you can expect is a list of algorithms, an example can be found below (the values below are purely examplatory)

```javascript
{
    "success": true,
    "data": ["sha1", "sha256"]
}
```
