1. © Copyright 2010 ecsec GmbH, All Rights Reserved. © 2013 ecsec GmbH Dr. Detlef Hühnlein (ecsec GmbH) ISO/IEC 24727 and Extended Access Control

2. © 2013 ecsec GmbH>>2 Agenda © 2013 ecsec GmbH  ISO/IEC 24727  Extended Access Control (v2)

3. © 2013 ecsec GmbH ISO/IEC 24727 within an eID-Client

4. © 2013 ecsec GmbH CardInfo according to CEN 15480-3 and ISO/IEC 24727-3 (Amd1) >> 4 http://ws.openecard.org/schema/CardInfo.xsd

5. © 2013 ecsec GmbH ISO/IEC 24727-4 (IFD-API) Card terminal functions EstablishContext ReleaseContext ListIFDs GetIFDCapabilities GetStatus Wait Cancel ControlIFD Card functions Connect Disconnect BeginTransaction EndTransaction Transmit User interaction functions VerifyUser ModifyVerificationData Output IFD-Callback-Interface SignalEvent >>5 Channel functions EstablishChannel DestroyChannel Planned Contribution for Amd2 http://ws.openecard.org/schema/ISOIFD.wsdl

6. © 2013 ecsec GmbH Transmit >>6

7. © 2013 ecsec GmbH ISO/IEC 24727-3 (Service Access Layer)  Card-application-service Access Initialize Terminate CardApplicationPath  Connection-service CardApplicationConnect CardApplicationDisconnect CardApplicationStartSession CardApplicationEndSession  Card-application service CardApplicationList CardApplicationCreate CardAppicationDelete CardApplicationServiceList CardApplicationServiceCreate CardApplicationServiceLoad CardApplicationServiceDelete CardApplicationServiceDescribe ExecuteAction  Named data service DataSetList DataSetCreate DataSetSelect DataSetDelete DSIList DSICreate DSIDelete DSIRead DSIWrite  Cryptographic service Encipher Decipher GetRandom Hash Sign VerifySignature VerifyCertificate  Differential-identity service DIDList DIDCreate DIDGet DIDUpdate DIDDelete DIDAuthenticate  Authorization service ACLList ACLModify >>7 http://ws.openecard.org/schema/ISO24727-3.wsdl

8. © 2013 ecsec GmbH DIDAuthenticate >>8

9. © 2013 ecsec GmbH Generic authentication flow >>9

10. © 2013 ecsec GmbH Connection Establishment - Overview >>10

11. © 2013 ecsec GmbH Connection Establishment – More Details >>11 eID-S SP User   EAC UA   get http://localhost:24727/eID-Client?tcTokenURL=...   eID App tcTokenURL TCT-S  ServerAddress RefreshAddress 

12. © 2013 ecsec GmbH>>12 StartPAOS http://ws.openecard.org/schema/ISO24727-Protocols.wsdl

13. © 2013 ecsec GmbH>>13 Agenda © 2013 ecsec GmbH  ISO/IEC 24727  Extended Access Control (v2)

14. © 2013 ecsec GmbH>>14 eService Extended Access Control (v2) - Overview

15. © 2013 ecsec GmbH>>15 random Password Authenticated Connection Establishment (PACE) random,,, eService

16. © 2013 ecsec GmbH>>16 Terminal Authentication (TA) (Version 2) random Private key Verification of Ephemeral private key eService

17. © 2013 ecsec GmbH>>17 Chip Authentication (CA) (Version 2) in TA generated private key Passive Authentication priv. key random eService

18. © 2013 ecsec GmbH Restricted Identification >>18 private key for RI eService

19. © 2013 ecsec GmbH Extended Access Control (v2) >>19

20. © 2013 ecsec GmbH Extended Access Control (v2) (with support for legacy cards) >>20

21. © 2013 ecsec GmbH DIDAuthenticate with EAC1InputType >>21

22. © 2013 ecsec GmbH>>22 EAC1InputType http://ws.openecard.org/schema/ISO24727-Protocols.xsd

23. © 2013 ecsec GmbH DIDAuthenticate with EAC1OutputType >>23

24. © 2013 ecsec GmbH>>24 EAC1OutputType http://ws.openecard.org/schema/ISO24727-Protocols.xsd

25. © 2013 ecsec GmbH DIDAuthenticate with EAC2InputType >>25

26. © 2013 ecsec GmbH>>26 EAC2InputType http://ws.openecard.org/schema/ISO24727-Protocols.xsd

27. © 2013 ecsec GmbH DIDAuthenticate with EAC2OutputType >>27

28. © 2013 ecsec GmbH>>28 EAC2OutputType http://ws.openecard.org/schema/ISO24727-Protocols.xsd

29. © 2013 ecsec GmbH>>29 © Copyright 2010 ecsec GmbH, All Rights Reserved. Titelmasterformat durch Klicken bearbeiten Formatvorlage des Untertitelmasters durch Klicken bearbeiten © 2013 ecsec GmbH Thank you very much for your attention! Contact: