Accessing smart cards server-side from PHP
Summary
Johannes publishes PC/SC for PHP, a native extension for smart card communication via pcsc-lite. The source code was published on 17 December 2010. The project uses pcsc-lite.
Ideas
- The PHP extension connects web applications directly to the PC/SC stack.
- pcsc-lite handles the platform-level access to card readers.
- Smart cards can perform signing or encryption operations on the server side.
Insights
- Hardware-backed keys can also be integrated into classic web applications.
- Direct device access from a web process requires particularly tight permissions and error boundaries.
Facts
- As uses, Johannes names SAM- and HSM-like tasks.
Recommendations
- Separate the web process from the card reader with a small privileged service.
- Keep private keys on the smart card and log only the metadata you need.
References
Read the original article on hanez.org
Links to the original source and the Web Archive open in a new tab.