Smart cards are physical devices (usually the size and shape of a credit card) that contain microprocessors and a small amount of memory. The memory on the card stores one or more security certificates that identify the user. A certificate, in combination with a user’s PIN or biometric information, is used to authenticate a user. Smart cards typically contain an identity certificate, an email encryption certificate, and an email signing certificate. This means that they can be used to identify and authenticate user access to a computer or services as well as for sending and receiving encrypted emails.
For a computer to read the information on a smart card, it must be equipped with a smart card reader. There are a number of smart card and smart card reader vendors. Mac OS X includes generic smart card reader drivers that allow it to work with readers from a variety of vendors, including Athena, CryptoCard, GemPlus, SCM, and OmniKey. Other vendors may produce hardware that works with Mac OS X, but require additional drivers.
There are also a number of types of smart cards available, many of which are designed to government specifications, including the United States and other national governments. The specifications for each type of card identify the plug-in known as a tokend that is used by the card to communicate with the securityd process on the computer. Mac OS X supports three tokend formats: the Common Access Card (CAC) standard established by the U.S. federal government, the Belgian Personal ID Card standard (BELPIC), and the Japanese Public Key Infrastructure standard (JPKI).
Mac OS X’s Smart Card Support
Support for smart card authentication is built into Mac OS X Tiger, but is not enabled by default. Once enabled, smart cards are supported by the Login Window, Keychain Access, Mail, Safari, and Internet Connect (used for establishing VPN connections). Once enabled, smart card authentication can be enabled for user local Mac OS X user accounts as well as for accounts stored on a server. Enabling smart card support for Mac OS X computers is not difficult. It requires only some simple modifications of the /etc/authorization file.
Once smart card support is enabled, you must enable its support for individual user accounts. For local user accounts, this can be done by using series scripts that are included with Mac OS X. These scripts create the certificate on the smart card and then store a hash of it in the user’s local account. For network accounts stored in some directory domains, the process can be a bit more difficult because you need to create a lookup attribute configuration. Apple provides a brief technote on the steps to enable smart card login as well as a more detailed setup guide.
While Apple’s support for smart cards is built in, it may not offer a complete solution. The OpenSC project is an open source project for developing smart card solutions. Smart Card for Apple Mac OS X (SCA) is a Mac OS X iteration of the project that enables support for any OpenSC-compliant smart card. SCA also offers other features via its command line tools, including support for the use of smart cards when establishing SSH connections and support for replacing the traditional Mac OS X login with a smart card solution (when smart card support is enabled under Mac OS X, traditional login is still permitted).