Italian health insurance card: read some public data.

Since a few years, Italian health insurance card works as a contactless card as well as a smart card.

In both cases informations are presented in a filesystem-like structure similar to Calypso cards.

Apart certificates and keys, on card there are some cardholder's public data that can be handy to read.

I was successful with a ACR122U NFC reader and a ACS ACR38 smart card reader. Both devices access the same data structure where you can find card ID number, cardholder's name, surname, taxpayer number.

It wasn't easy for me to find the details needed to make sense of data, so I decided to write them in a tessera_sanitaria GitHub repository.

pkcs11 ssh authentication

This post is about using ssh without password, with a certificate stored on a smartcard. I think it could be really useful with notebooks. You can securely connect to ssh servers without storing the ssh secret key on the notebook, which can be stolen, can be lost etc.

Setup

Of course you have to be able to read the certificate on the smartcard so:

• get a smartcard reader; be sure it is supported. We lost a lot of time because ACR38UR didn't work (ACR38UC works fine);
• install pcscd;
• get the crypto api for yor smartcard. 'opensc' should work fine, sometimes the certificate issuer require other libraries (Italian CNS work with libbit4ipki.so -- you can find it with the software 'dike').

Get public keys

$ ssh-keygen -D /usr/lib/libbit4ipki.so

ssh-rsa AAAAB3NzaC1yc2[...]J6KIcjjROKtdJ2CHOftZExSkNyNNQ==

ssh-rsa AAAAB3NzaC1yc2[...]kRxbZfOVWb8X5C4X++iiXS4UDpWhQ==

Copy one of the line beginning with "ssh-rsa" to the '.ssh/authorized_keys' on the ssh server (chmod 600).

Load private keys

$ ssh-agent /bin/bash

$ ssh-add -s /usr/lib/libbit4ipki.so

Enter passphrase for PKCS#11:

Card added: /usr/lib/libbit4ipki.so

$ ssh-add -l

1024 f8:8a:e3:[...]:cb:ab:db:67:da:3e /usr/lib/libbit4ipki.so (RSA)

1024 bc:9f:e9:[...]:27:7a:13:55:81:bf /usr/lib/libbit4ipki.so (RSA)

Then you can happily login to ssh server with a simple ssh command.