OpenSC and Open-Source Smart Card Tools

OpenSC and Open-Source Smart Card Tools

OpenSC is the most widely deployed open-source framework for accessing smart cards and cryptographic tokens. It provides a PKCS#11 module, a PC/SC driver stack, and a suite of command-line utilities covering everything from card identification to certificate import and PIN management. Distributed under the LGPL, OpenSC runs on Linux, macOS, and Windows and supports hundreds of card models through a plug-in driver architecture.

Architecture Overview

Application
    │
    ├── PKCS#11 (opensc-pkcs11.so / .dll)
    │       │
    │       └── libopensc  ←── card drivers (*.so)
    │               │
    │               └── PC/SC layer (libpcsclite / WinSCard)
    │                       │
    │                       └── Reader driver (USB CCID / NFC)

OpenSC's libopensc implements the ISO 7816 file system, PIN management, and cryptographic operations. Card-specific quirks are handled by individual drivers (e.g. card-piv.c, card-openpgp.c, card-cac.c).

pkcs11-tool — PKCS#11 Operations

pkcs11-tool exercises the OpenSC PKCS#11 module directly and is the fastest way to verify card functionality.

# List available slots and tokens
pkcs11-tool --module opensc-pkcs11.so --list-slots

# List objects on the card (requires PIN login)
pkcs11-tool --module opensc-pkcs11.so --login --list-objects

# Generate an RSA-2048 key pair on the card
pkcs11-tool --module opensc-pkcs11.so --login \
    --keypairgen --key-type RSA:2048 --id 01 --label "My Key"

# Sign a file with the on-card private key
pkcs11-tool --module opensc-pkcs11.so --login \
    --sign --id 01 --mechanism SHA256-RSA-PKCS \
    --input-file data.txt --output-file sig.bin

# Verify with the public key
pkcs11-tool --module opensc-pkcs11.so \
    --verify --id 01 --mechanism SHA256-RSA-PKCS \
    --input-file data.txt --signature-file sig.bin

Use the APDU Builder to cross-check the APDU sequences that pkcs11-tool sends when --verbose is set.

pkcs15-tool — PKCS#15 File System

PKCS#15 (ISO 7816ISO 7816StandardPrimary standard for contact smart cards.Click to view →-15) defines a standardised on-card file structure for certificates, keys, and PINs. pkcs15-tool reads and writes this structure directly.

# Dump all PKCS#15 objects
pkcs15-tool --dump

# Read a DER certificate by ID and convert to PEM
pkcs15-tool --read-certificate 01 | openssl x509 -inform DER -text

# Change PIN
pkcs15-tool --change-pin --auth-id 01

# Initialise a blank JavaCard with a PKCS#15 structure
pkcs15-init --create-pkcs15 --profile pkcs15+onepin

# Enroll a certificate
pkcs15-init --store-certificate cert.pem --id 01 --auth-id 01

opensc-tool — Low-Level Card Access

opensc-tool provides raw card access without the PKCS#15 abstraction layer.

# Print ATR (identify the card)
opensc-tool --atr

# Send raw APDU and see response
opensc-tool --send-apdu 00:A4:04:00:07:D2:76:00:00:85:01:01

# List all files in the card's MF (Master File)
opensc-tool --list-files

Parse the ATR output with the ATR Parser to identify the card platform and supported protocols (T=0, T=1).

Card-Specific Drivers

OpenSC in the Browser

Browsers access smart cards via the PKCS#11 module loaded into NSS or through OS-level middleware. See Smart Card Web Authentication for integration steps.

Troubleshooting

For identifying unknown cards, combine opensc-tool --atr with the Card Identifier tool.