From Fedora Project Wiki

< Changes

Revision as of 13:50, 6 January 2017 by Jjelen (talk | contribs) (Created page with "<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name. This keeps all change proposals in the same namespace --> = R...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Replace Coolkey with OpenSC

Summary

There are more PKCS#11 libraries supporting the same smart cards in the system. For the next releases, we would like to promote OpenSC as a default PKCS#11 provided in place where Coolkey driver is used these days, which will increase the list of supported smart cards and make use of the most of the OpenSC.

Owner

  • Email: jjelen@redhat.com
  • Release notes owner:

Current status

  • Targeted release: Fedora 26
  • Last updated: 2017-01-06
  • Tracker bug: <will be assigned by the Wrangler>

Detailed Description

Currently, there are several PKCS#11 modules available in Fedora. Some of them provide the same functionality as the others. Currently, the majority of the work around smart cards is done in the OpenSC project supporting all the major cards. On the other side, there is no significant development efforts in Coolkey project, which is currently used by default in some applications.

The provided libraries are PKCS#11 libraries, so existing applications should not depend directly on either package. The transition should be smooth as the change of the path in the configurations if any. The only exceptions are NSS (Coolkey installs its module to the NSS database), ESC and pesign) (explicit requires should be [https://bugzilla.redhat.com/show_bug.cgi?id=1349073 removed) 

$ dnf repoquery --whatrequires coolkey
esc-0:1.1.0-30.fc25.x86_64
pesign-0:0.112-4.fc25.x86_64

We would like to

  • Get rid of explicit requires (pesign, esc)
  • Switch the applications dependent on Coolkey to OpenSC (NSS, ESC, pesign)
  • Retire the Coolkey package from Fedora (estimated in Fedora 27)

Benefit to Fedora

Having multiple PKCS#11 provider libraries can be confusing for users especially when used over proxy, such as p11-kit. In this case the tokens could show up multiple times.

There is no significant development going on in Coolkey anymore, unlike with OpenSC, which has very active upstream.

Scope

  • Proposal owners:

For Fedora 26, we want to switch all applications to OpenSC and leave Coolkey as a backup. We will unregister coolkey from NSS database and register OpenSC instead.

For Fedora 27, we would like to retire coolkey package.

Upgrade/compatibility impact

Previously installed Fedora will have Coolkey registered in NSS database (if installed). The upgrade path needs to ensure that the coolkey will be removed from database and OpenSC installed instead (explicit requires Coolkey -> OpenSC?). All the cards supported by Coolkey should be supported by OpenSC by now.

How To Test

  • Make sure you have installed the packages below:
    • opensc, coolkey and nss
  • The command modutil -list -dbdir /etc/pki/nssdb should list CoolKey PKCS #11 Module
  • Any of your application using Smart Cards/PKCS#11 should work with /usr/lib64/pkcs11/opensc-pkcs11.so PKCS#11 module instead of /usr/lib64/pkcs11/libcoolkeypk11.so

User Experience

N/A (not a System Wide Change)

Dependencies

N/A (not a System Wide Change)

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No
  • Blocks product? product

Documentation

N/A (not a System Wide Change)

Release Notes

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/Replace_Coolkey_with_OpenSC&oldid=483459"