Welcome

All relevant information about the eIDClientCore can be found at: http://sar.informatik.hu-berlin.de/BeID-lab/eIDClientCore

Warning: This is just proof-of-concept code and should NOT be used in production environments

Tested platforms:

• Windows
• Linux
• Mac OS X
• Android
• iOS
• Travis CI (Ubuntu Linux)

Usage

C library interface

For using eIDClientCore applications should use eIDClientCore.h The application initiates the electronic identification by calling nPAeIdPerformAuthenticationProtocol. To enter the PIN, the application shall define a user interaction call back. Also, the state call back informs the application about completed protocol steps.

The application may also choose to use eIDClientConnection.h which, by default, is basically a wrapper around libcurl. However, you may want to choose to replace the implementation of eIDClientConnection with a wrapper to your platform dependent solution.

JNI wrappers for Android

For android we build JNI wrappers to our C++ implementation. The public Java interface is accessed through the EidClient class Electronic identification is triggered similar to its C-counterpart. Additionally the Android application has to pass an implementation of the Reader class to do the actual communication with the card.

Building for Linux

First you have to download the eIDClientCore Git-Repository in your target intstallation directory:

git clone https://github.com/BeID-lab/eIDClientCore.git

You can then change in the eIDClientCore directory and install the prerequisites and the eIDClientCore by:

cd eIDClientCore
make all

If you want to install manually you can use the following guide. We assume that PREFIX is set to the directory eIDClientCore in the target installation directory.

Compiling Prerequisites from source

eIDClientCore has the following dependencies:

• Crypto++
• asn1c (at least version 0.9.23)
• libexpat
• PC/SC development files (if PC/SC smart card readers shall be used)
• OpenSSL patched for RSA-PSK
• libcurl (using the patched OpenSSL)

Crypto++

svn checkout https://svn.code.sf.net/p/cryptopp/code/trunk/c5 cryptopp
sed -i.org -e "s%^#.*\(CXXFLAGS += -fPIC.*\)%\1%g" ${PREFIX}/cryptopp/GNUmakefile
make -C cryptopp all libcryptopp.so
make -C cryptopp install PREFIX=${PREFIX}

You can skip compilation of Crypto++ when using your distributions version of the library.

asn1c

wget https://lionet.info/soft/asn1c-0.9.24.tar.gz --ca-certificate=trusted_ca/COMODORSADomainValidationSecureServerCA.pem
tar xzf asn1c-0.9.24.tar.gz
cd asn1c-0.9.24
./configure --prefix=${PREFIX}
make install
cd -

If you want to use your distributions version of asn1c you will propably have to edit eidasn1's Makefile.am. You need to change the commented lines so that they meet the version of asn1c.

libexpat

wget http://sourceforge.net/projects/expat/files/expat/2.1.0/expat-2.1.0.tar.gz
echo "b08197d146930a5543a7b99e871cba3da614f6f0 expat-2.1.0.tar.gz" | sha1sum -c -
tar xzf expat-2.1.0.tar.gz
cd expat-2.1.0
./configure --prefix=${PREFIX}
make install
cd -

You can skip compilation of libexpat when using your distributions version of the library.

OpenSSL

cd ${PREFIX}/OpenSSL_1_0_2-stable 
git submodule init 
git submodule update 
./config --prefix=${PREFIX} shared 
make 
make install_sw 

OpenSSL is the only library that needs to be patched since it does currently not support RSA-PSK.

libcurl

wget https://github.com/bagder/curl/releases/download/curl-7_44_0/curl-7.44.0.tar.gz
tar xzf curl-7.44.0.tar.gz
cd curl-7.44.0
./configure --prefix=${PREFIX} \
    PKG_CONFIG_PATH=${PREFIX}/lib/pkgconfig:${PREFIX}/lib64/pkgconfig
make install
cd -

If you want to use your distributions version of curl will need to make sure it uses the patched version of OpenSSL at runtime (see above).

wxWidgets

To build the SimpleClient wxWidgets (Release >= 3.0.0) is required. The name of the required package in OpenSuse is wxWidgets-3_0-devel. Alternatively wxWidgets can be downloaded and compiled manually (https://wiki.wxwidgets.org/Install):

wget https://github.com/wxWidgets/wxWidgets/releases/download/v3.1.0/wxWidgets-3.1.0.tar.bz2
tar -xjf wxWidgets-3.1.0.tar.bz2 
cd wxWidgets-3.1.0
mkdir gtk-build
cd gtk-build
../configure --enable-unicode --enable-debug --prefix=${PREFIX}
make > /dev/null
make install
cd -

Compiling eIDClientCore from source

git clone https://github.com/BeID-lab/eIDClientCore.git
cd eIDClientCore
autoreconf -vis
env LD_LIBRARY_PATH=${PREFIX}/lib:${PREFIX}/lib64 ./configure --prefix=${PREFIX} \
    --with-openssl=${PREFIX} --with-libcurl=${PREFIX} \
    PKG_CONFIG_PATH=${PREFIX}/lib/pkgconfig:${PREFIX}/lib64/pkgconfig \
    ASN1C=${PREFIX}/bin/asn1c
make install
cd -

Building for Android

We added a Makefile to automatically build eIDClientCore and its prerequisites for android. We assume that ANDROID_NDK_ROOT and ANDROID_SDK_ROOT are set to the root directory of Android's SDK and NDK respectively. Also, asn1c and ant should be available in the PATH.

git clone https://github.com/BeID-lab/eIDClientCore.git
cd eIDClientCore/android
make ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT

On successfull compilation you can find a jar-file containing the library in eIDClientCore/android. Building for android has been verified on Debian/Wheezy with android-ndk-r9 and adt-bundle-linux-x86-20130729.

• ANDROID_API defines the Android API version to use, we choose 'android-14' as default
• ANDROID_ARCH defines the architecture to use, we choose 'arm' as default

Including the library in your Android project

To use the library in your project, you have two possibilities:

1. Add eIDClientLib/bin/classes.jar to your build path and copy the following listed shared objects into your libs/armeabi folder:

   • libeidclient-wrapper.so
   • libexternalReader.so
   • libstlport_shared.so

2. Reference the library with the android tools (see Android documentation). In this case all necessary files are copied automatically.

android update project \
  --path path/to/your/project \
  --library path/to/eiDClientLib

Android example app

• eIDClientCore Selbstauskunft

Projects using eIDClientCore

The eIDClientCore is used in the project Selbstauskunft in the middle. This project provides a docker image containing the eIDClientCore to simplify performing the scenario "Selbstauskunft in the middle". The docker images for this project can be found here.

TODO

• Add abstraction layer between ePACard and cryptographic functions
• Remove unused/bloated interfaces
• Check try...catch block around C-Interfaces
• use OOP in nPA-EAC
• Check the hash of the SSL/TLS certificate from the SP with the SP's Terminal certificate
• Check if the Terminal certificate is up to date
• Check the Subject URL of the Terminal certificate
• remove the use of exceptions