OpenCard Framework 1.2 Programmer's Guide - OpenSCDP

} catch OpenCard Exceptions {
// handle exception
...
}
Instead of performing both of these operations (the hashing operation and the
public key algorithm) on the card, it is possible to perform the time-consuming
hashing of long messages outside the OPENCARD FRAMEWORK. To do this,
SignatureCardService offers two methods: the SignHash() method and the
VerifySignedHash() method, respectively. Computing the hash value is then the
responsibility of the application, and can be performed using classes like SUN’s
MESSAGEDIGEST in the java.security package or subpackages. It may also make
sense to perform signature verification (which does not involve any private keys)
off card using the java.security package. Wherever the private key is needed (for
example when performing signature generation), a smart card offers tamper-proof
storage to protect the private key.
Importing keys
In addition to generating and verifying signatures, KeyImportCardService (which
extends the SignatureCardService interface) offers methods for the importation
and subsequent in-card verification of keys for asymmetric key algorithms. The
non-validating methods to import keys are importPrivateKey and importPublicKey.
In addition to the actual key data and key information, these methods take as
parameters a key reference to identify the storage location of the imported key. The
key reference for file-oriented cards consists of a directory CardFilePath object and
an integer specifying the number of the key relative to the directory. The
corresponding validating methods are importAndValidatePrivateKey and
importAndValidatePublicKey. These methods make the smart card check the
integrity of the imported key by validating a signature of the key, which is passed
as an additional parameter, using (another) indicated key for signature verification.
The smart card accepts the imported keys subject to successful verification. The
code to import and validate a private key might look something like this:
RSACRTKey rsaPrivate = ...;
byte[] signature = ...;
byte[] keyInfo = ...;
SignatureCardService scs = null;
try {
// wait for card and obtain the two card services
// ...
// create the private key reference for the key to be imported
CardFilePath path1 = new CardFilePath(":3F00:C110");
PrivateKeyFile targetKey = new PrivateKeyFile(path1,0);
// create the public key reference for the key to verify the signature
CardFilePath path2 = new CardFilePath(":3F00:C200");
PublicKeyFile valKey = new PublicKeyFile(path2,1);
boolean result = scs.importAndValidatePrivateKey(targetKey,
rsaPrivate, keyInfo, signature, valKey);
// ...
} catch OpenCard Exceptions {
// handle exception
...
}
Generating keys
In addition to working with signatures, KeyGenerationCardService — a further
extension of the SignatureCardService interface — also offers methods for
generating a key pair for a public key algorithm on the card and for reading the
public key part of the pair for usage outside of the card.
Chapter 4. Programming with OCF 27