WebUSB based Interface Device (IFD) handler for USB based Chip Card Interface Device(s) (CCID).
This is a proof-of-concept developed for my diploma thesis. I was supported by Humboldt-Universität zu Berlin (Humboldt University of Berlin) and Bundesdruckerei GmbH ("Federal Printing Office"), especially by my two advisors.
To run the demo, host a (simple) web server and access it with a WebUSB compatible Browser e.g. Chrome/Chromium >= 61.
+- Chrome/Chromium ----------+ +--> WebSocketServer.py
|----------------------------| | (send GET CHALLENGE and
| | | output the cards result)
| demo.html +--WebSocket--+
| | | +--> WebSocketServerVICC.py
+---------------------|------+ | (make card available via PC/SC
+-----+ +--------+ | | | | on server in virtual reader)
|Smart|<-->|USB CCID| <--WebUSB----> ifd.js <-----+ | |
|Card | |Reader | | | +--> WebSocketServerPACE.py
+-----+ +--------+ +----------------------------+ (generate APDUs to
establish a PACE channel)
Making a CCID available to WebUSB, unless they come with a WebUSB compatible driver or device, requires operating system specific actions.
- For Windows Zadig is recommended to load the generic WinUSB driver for your CCID.
- For Linux, the user's browser needs write access to the usb device. This can be done by creating a custom udev rule. See the following example rule created in
/etc/udev/rules.d/50-Identiv-4700F.rulesand adding your user to theplugdevgroup inetc/group. A generic rule for (specific) WebUSB devices could be added to the udev project.
SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="5720", GROUP="plugdev"
Vendor Id and Product Id of your CCID can be identified using lsusb command.
Once your WebUSB device is available for the browser, in user space, you can follow the quick start instructions to get the demos up and running. You need to enable SSL/TLS encryption, if you want to host the server on a different machine. SSL/TLS encryption is left off for debugging.
- Start web server (
python3 HttpServer.py) - open
http://localhost:8000/demo.htmlin Chrome - Click "connect" and choose your USB CCID smart card reader
- Insert smart card that accepts GET CHALLENGE (
00 84 00 00 00 00 01) - Clicking the square sends GET CHALLENGE; the card's response is translated to the appropriate number of pips on the dice's face
- Insert smart card that accepts GET CHALLENGE (
00 84 00 00 00 00 01) python3 WebSocketServer.py- Clicking "Get challenge" connects to WebSocketServer.py, which sends a GET CHALLENGE; the response is shown in the log.
- Insert smart card
python3 WebSocketServerVICC.py- Start virtual smart card reader on localhost:35963 (i.e. start PCSC-Lite or SCardSvr.exe with the vpcd driver)
- Clicking "send" in the section "Remote nPA PACE" connects to WebSocketServerVICC.py, which relayes the card to the virtual smart card reader
- Accessing the card in the virtual reader via PC/SC is relayed through the WebSocket and through the browser; the website's log shows the command and response APDUs.
- Insert smart card that is capable of performing PACE (e.g. German ID card)
python3 WebSocketServerPACE.py- In the section "Remote nPA PACE", enter the card's CAN and click "send". The browser connects to WebSocketServerPACE.py, which verifies the CAN with PACE; the responses are shown in the log.
electron provides a Chromium based framework to build native applications for Linux, Mac and Windows. If Chromium >= 61 is used, it supports WebUSB. At time of testing, this was only the case with the beta version.
A working starting point can be the quick-start example installed using npm install -D electron@beta. Once started (npm start), navigator.usb is available in the included developer console (Ctrl+Shift+I).