Package com.chilkatsoft.chilkat2

Class ScMinidriver

java.lang.Object
com.chilkatsoft.chilkat2.ChilkatObject
com.chilkatsoft.chilkat2.ScMinidriver
All Implemented Interfaces:
AutoCloseable
public class ScMinidriver extends ChilkatObject
<section class="scminidriver-summary">

Access smart-card certificates, key containers, PINs, files, and on-card signing.

Chilkat.ScMinidriver is a smart-card integration class for applications that need card minidriver access to certificates, key containers, PIN authentication, card files, and on-card signing. It can retrieve and link smart-card certificates for use in other Chilkat signing classes, generate or import RSA and ECC keys, sign data directly, inspect card and container state, and manage selected card files and certificates.

Connect through minidriver

Use the Windows smart-card minidriver layer to access card capabilities without working directly at the APDU level.

Certificates and containers

Enumerate and inspect smart-card certificates, key containers, container indexes, key types, and related card state.

PIN authentication

Authenticate to the card with the required PIN before accessing protected private-key operations or card objects.

On-card signing

Sign data using private keys that remain on the smart card, including workflows where the private key is non-exportable.

Key generation and import

Generate or import RSA and ECC keys into supported card containers when the card policy allows it.

Use with Chilkat signing

Link a smart-card certificate to other Chilkat classes so PDF, XML, CMS/PKCS7, S/MIME, or other signing operations can use the card-backed private key.

Common pattern: Connect to the smart card, verify the card and container state, authenticate with the PIN, locate the certificate and private-key container, then either sign directly or link the certificate for use by another Chilkat signing class. Use ScMinidriver for Windows card-minidriver certificate and key-container operations; use Chilkat.SCard for direct PC/SC APDU-level work, and Chilkat.Pkcs11 for PKCS#11 token or HSM sessions.

For an extended overview, see ScMinidriver Class Overview.

</section>

Available on Windows only: the constructor throws UnsupportedOperationException elsewhere.

Instances hold a native Chilkat object: close them with ChilkatObject.close() (try-with-resources) when done; an unclosed instance is freed when it becomes unreachable.

See Also:
Online reference

  • Constructor Details

    • ScMinidriver

      public ScMinidriver()
      Creates a new ScMinidriver object.

  • Method Details

    • getAtr

      public String getAtr()
      The ATR of the card in the reader. This property is set by the AquireContext method.
      Returns:
      the value of the Atr property (read-only)

    • getCardName

      public String getCardName()
      The name of the card in the reader. This property is set by the AquireContext method.
      Returns:
      the value of the CardName property (read-only)

    • getMaxContainers

      public int getMaxContainers()
      The maximum number of key containers available. The 1st key container is at index 0. Each key container can potentially contain one signature key, and one key exchange key.
      Returns:
      the value of the MaxContainers property (read-only)

    • getRsaPaddingHash

      public String getRsaPaddingHash()
      If an RSA key is used for signing, this is the hash algorithm to used in conjunction with the padding scheme. It can be SHA1, SHA256, SHA384, or SHA512. The default is SHA256.
      Returns:
      the value of the RsaPaddingHash property

    • setRsaPaddingHash

      public void setRsaPaddingHash​(String value)
      Sets the RsaPaddingHash property; see getRsaPaddingHash().
      Parameters:
      value - the new value (not null)

    • getRsaPaddingScheme

      public String getRsaPaddingScheme()
      If an RSA key is used for signing, this is the padding scheme to use. It can be PKCS or PSS. The default is PSS.
      Returns:
      the value of the RsaPaddingScheme property

    • setRsaPaddingScheme

      public void setRsaPaddingScheme​(String value)
      Sets the RsaPaddingScheme property; see getRsaPaddingScheme().
      Parameters:
      value - the new value (not null)

    • getUncommonOptions

      public String getUncommonOptions()
      This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.
      Returns:
      the value of the UncommonOptions property

    • setUncommonOptions

      public void setUncommonOptions​(String value)
      Sets the UncommonOptions property; see getUncommonOptions().
      Parameters:
      value - the new value (not null)

    • acquireContext

      public void acquireContext​(String readerName)
      Initializes communication with the card inserted in the given reader. Reader names can be discovered via the SCard.ListReaders or SCard.FindSmartcards methods. If successful, the Atr and CardName properties will be set.
      Parameters:
      readerName - the readerName argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • cardDeleteFile

      public void cardDeleteFile​(String dirName, String fileName)
      Deletes the file specified by dirName and fileName. dirName is the name of the directory that contains the file, or the empty string for root.
      Parameters:
      dirName - the dirName argument (not null)
      fileName - the fileName argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • deleteCert

      public void deleteCert​(Cert cert, boolean delPrivKey)
      Deletes a certificate and optionally its associated private key from the smart card. If delPrivKey is true, then the associated private key, if it exists, is also deleted.
      Parameters:
      cert - the cert argument (not null)
      delPrivKey - the delPrivKey argument
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • deleteContext

      public void deleteContext()
      This function reverses the effect of AcquireContext and severs the communication between the Base CSP/KSP and the card minidriver. The Atr and CardName properties are cleared.
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • deleteKeyContainer

      public void deleteKeyContainer​(int containerIndex)
      Deletes the key container at the given containerIndex. This deletes both the signature and key exchange keys that may be contained in the specified key container.
      Parameters:
      containerIndex - the containerIndex argument
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • enumFiles

      public void enumFiles​(String dirName, StringTable st)
      Get the list of files in the directory specified by dirName. Pass the empty string for the root directory. The filenames are returned in st.
      Parameters:
      dirName - the dirName argument (not null)
      st - the st argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • findCert

      public void findCert​(String certPart, String partValue, Cert cert)
      Finds the certificate where the given certPart equals the partValue. Possible values for certPart are: subjectDN, subjectDN_withTags, subjectCN, serial, or serial:issuerCN.

      The cert is loaded with the certificate if successful.

      Note: If successful, the cert will be linked internally with this ScMinidriver session such that certificate can be used for signing on the smart card when used in other Chilkat classes such as XmlDSigGen, Pdf, Crypt2, Mime, MailMan, etc.

      Parameters:
      certPart - the certPart argument (not null)
      partValue - the partValue argument (not null)
      cert - the cert argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • generateKey

      public void generateKey​(int containerIndex, String keySpec, String keyType, int keySize, String pinId)
      Generates a key to be stored in either the signature or key exchange location within a key container. Creates the key container if it does not already exist. Otherwise replaces the key in the key container.

      The keySpec can be sig or kex to specify either the signature or key exchange location.

      The keyType can be ecc or rsa.

      For RSA keys, the keySize is the size of the key in bits, such as 1024, 2048, 4096, etc. (2048 is a typical value.) For ECC keys, the size can be 256, 384, or 521.

      The pinId can be user, or 3 through 7. (It is typically user.)

      Parameters:
      containerIndex - the containerIndex argument
      keySpec - the keySpec argument (not null)
      keyType - the keyType argument (not null)
      keySize - the keySize argument
      pinId - the pinId argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getCardProperties

      public void getCardProperties​(JsonObject json)
      Gets all card properties and returns them in json. See the example below.
      Parameters:
      json - the json argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getCert

      public void getCert​(int containerIndex, String keySpec, Cert cert)
      Get the certificate at the specified containerIndex and keySpec. The keySpec can be sig or kex to specify either the signature or key exchange location within the container. The containerIndex can be -1 to choose the first key container with a certificate. The keySpec can also be any to choose either sig or kex based on which is present, with preference given to sig if both are present.

      The cert is loaded with the certificate if successful.

      Note: If successful, the cert will be linked internally with this ScMinidriver session such that certificate can be used for signing on the smart card when used in other Chilkat classes such as XmlDSigGen, Pdf, Crypt2, Mime, MailMan, etc.

      Parameters:
      containerIndex - the containerIndex argument
      keySpec - the keySpec argument (not null)
      cert - the cert argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getContainerKeys

      public void getContainerKeys​(int containerIndex, PublicKey sigKey, PublicKey kexKey)
      Queries a key container to get the keys that are present. If the signature public key is present, it is returned in sigKey. If the key exchange key is present, it is returned in kexKey.
      Parameters:
      containerIndex - the containerIndex argument
      sigKey - the sigKey argument (not null)
      kexKey - the kexKey argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getCspContainerMap

      public void getCspContainerMap​(JsonObject json)
      Returns the contents of the CSP container map file (cmapfile). The information is returned in the json. This gives an overview of what key containers and certificates exist in the smart card from a CSP's point of view. See the example linked below.
      Parameters:
      json - the json argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • importCert

      public void importCert​(Cert cert, int containerIndex, String keySpec, String pinId)
      Imports a certificate with its private key onto the smart card. The cert must have an accessible private key, such as will be the case if the cert was loaded from a .pfx/.p12, or if the cert was loaded from a Windows certificate store where the private key exists (and can be exported from the Windows certificate store).

      The containerIndex is the container index. It can range from 0 to the MaxContainers-1.

      The keySpec can be sig or kex to specify either the signature or key exchange location within the container.

      The pinId can be user, or 3 through 7. (It is typically user.)

      Parameters:
      cert - the cert argument (not null)
      containerIndex - the containerIndex argument
      keySpec - the keySpec argument (not null)
      pinId - the pinId argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • importKey

      public void importKey​(int containerIndex, String keySpec, PrivateKey privKey, String pinId)
      Imports a key to be stored in either the signature or key exchange location within a key container. Creates the key container if it does not already exist. Otherwise replaces the specified key in the key container.

      The keySpec can be sig or kex to specify either the signature or key exchange location.

      The privKey is the private key to import.

      The ARG5 can be user, or 3 through 7. (It is typically user.)

      Parameters:
      containerIndex - the containerIndex argument
      keySpec - the keySpec argument (not null)
      privKey - the privKey argument (not null)
      pinId - the pinId argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • listCerts

      public void listCerts​(String certPart, StringTable st)
      Lists the certs found on the smart card. The certPart indicates the information to be returned from each certificate. Possible values are: subjectDN, subjectDN_withTags, subjectCN, serial, or serial:issuerCN. The information is returned in st.
      Parameters:
      certPart - the certPart argument (not null)
      st - the st argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • pinAuthenticate

      public int pinAuthenticate​(String pinId, String pin)
      Performs regular PIN authentication. The pinId can be user, admin, or 3 through 7. (It is typically user.) The pin is the alphanumeric PIN.

      Returns 0 for success. If not successful, the return value indicates the number of attempts remaining before the PIN is locked. (The number of times an incorrect PIN may be presented to the card before the PIN is blocked, and requires the admin to unblock it.) If the PIN is already blocked, the return value is -1. If the method fails for some other reason, such as if a context has not yet been acquired, the return value is -2.

      Parameters:
      pinId - the pinId argument (not null)
      pin - the pin argument (not null)
      Returns:
      the result (see ChilkatObject.getLastMethodSuccess() where the description mentions failure)

    • pinAuthenticateHex

      public int pinAuthenticateHex​(String pinId, String pin)
      The same as PinAutheneticate, but the PIN is passed as a hex string. For example, to pass a PIN of 0x01, 0x02, 0x03, 0x04, pass 01020304.
      Parameters:
      pinId - the pinId argument (not null)
      pin - the pin argument (not null)
      Returns:
      the result (see ChilkatObject.getLastMethodSuccess() where the description mentions failure)

    • pinChange

      public int pinChange​(String pinId, String currentPin, String newPin)
      Changes a PIN. The pinId can be user, admin, or 3 through 7. (It is typically user.) The currentPin is the current alphanumeric PIN. The newPin is the new PIN.

      Returns 0 for success. If not successful, the return value indicates the number of attempts remaining before the PIN is locked. (The number of times an incorrect PIN may be presented to the card before the PIN is blocked, and requires the admin to unblock it.) If the PIN is already blocked, the return value is -1. If the method fails for some other reason, such as if a context has not yet been acquired, the return value is -2.

      Parameters:
      pinId - the pinId argument (not null)
      currentPin - the currentPin argument (not null)
      newPin - the newPin argument (not null)
      Returns:
      the result (see ChilkatObject.getLastMethodSuccess() where the description mentions failure)

    • pinDeauthenticate

      public void pinDeauthenticate​(String pinId)
      Reverses a previous PIN authentication without resetting the card. The pinId can be user, admin, or 3 through 7. (It is typically user.)
      Parameters:
      pinId - the pinId argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • readFile

      public void readFile​(String dirName, String fileName, BinData bd)
      Reads the entire file specified by dirName and fileName into bd. dirName is the name of the directory that contains the file, or the empty string for root.
      Parameters:
      dirName - the dirName argument (not null)
      fileName - the fileName argument (not null)
      bd - the bd argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • signData

      public void signData​(int containerIndex, String keySpec, String hashDataAlg, BinData bdData, BinData bdSignedData)
      Signs the data passed in bdData. The hashDataAlg can be sha1, sha256, sha384, sha512, or none. If not equal to none, then the hash of the data passed in bdData is signed.

      The containerIndex specifies the key container. By specifying the key container, you are almost specifying the key. A key container can contain two keys: A signature key, and a key-exchange key. The keySpec indicates which of these two keys to use. keySpec should be set to sig or kex.

      Note: The type of signature created, such as RSA or ECC, is determined by the type of key that exists in the key container (specified by containerIndex and keySpec). If it is an RSA key, additional options can be specified via the RsaPaddingScheme and RsaPaddingHash properties.

      If successful, the signature is written to bdSignedData.

      Parameters:
      containerIndex - the containerIndex argument
      keySpec - the keySpec argument (not null)
      hashDataAlg - the hashDataAlg argument (not null)
      bdData - the bdData argument (not null)
      bdSignedData - the bdSignedData argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • writeFile

      public void writeFile​(String dirName, String fileName, BinData bd)
      Writes the entire file specified by dirName and fileName. dirName is the name of the directory that contains the file, or the empty string for root. The entire contents of bd are written to the file on the smart card.
      Parameters:
      dirName - the dirName argument (not null)
      fileName - the fileName argument (not null)
      bd - the bd argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why