Network token with CryptoTokenKit

Question

ElenaS OP

Created Jul ’18

Replies 16

Boosts 0

Views 6.6k

Participants 10

As documentation states

"Tokens are physical devices that can be built in to the system, located on attached hardware (like a smart card), or accessible through a network connection"

We'd like to make token that would acquire

TKTokenKeychainContents

(certificates) through network(without smart card reader).

What's would be the best approach for this ?

What should we set for com.apple.ctk.token-type in Info.plist ?

The only possible value i found is "smartcard".

I have not found any documentation regarding other options.

The only extension target that Xcode gives is "Smart Card Token Extension"

Boost

Answer 1

anshuman_mor OP

Mar ’21

Can you please explain what is the actual reason behind the below error -

[client] Unable to connect to tokenServer even after retries. (ep=(null) uid=(null))

Some more information I got from system log -

2021-03-09 00:26:09.036130+0530 localhost ctkd[469]: <ctkd> [com.apple.CryptoTokenKit:tokenhost] Failed to communicate with driver (null), error: Error Domain=NSCocoaErrorDomain Code=4099 "The connection on anonymousListener or serviceListener from pid 21919 was invalidated." UserInfo={NSDebugDescription=The connection on anonymousListener or serviceListener from pid 21919 was invalidated.}
2021-03-09 00:26:09.036225+0530 localhost ctkd[469]: <ctkd> [com.apple.CryptoTokenKit:tokenhost] failed to acquire token from extension myTokenExtension, error:Error Domain=NSCocoaErrorDomain Code=4099 "The connection on anonymousListener or serviceListener from pid 21919 was invalidated." UserInfo={NSDebugDescription=The connection on anonymousListener or serviceListener from pid 21919 was invalidated.}
2021-03-09 00:26:09.036497+0530 localhost TokenShow[21975]: (CryptoTokenKit) <CryptoTokenKit`-[TKClientToken ensureConnectionWithError:]> [com.apple.CryptoTokenKit:client] reconnecting ctkd after invalidate, try 3

I get this intermittently when I unload the token by calling the removeTokenConfiguration and then again load it using addTokenConfiguration.

I have a requirement where I want to frequently call remove and add token configuration to sync keys and certificate to CTK multiple times, each time I would want to sync different set of keys+certificates.

Also, is there a way to make the keys+certificates/identities available to login or system keychain using CTK extension?

0