bk99.de entertain the web since 1997

Accessing smart cards server-side from PHP

Summary

Johannes publishes PC/SC for PHP, a native extension for smart card communication via pcsc-lite. The source code was published on 17 December 2010. The project uses pcsc-lite.

Ideas

  • The PHP extension connects web applications directly to the PC/SC stack.
  • pcsc-lite handles the platform-level access to card readers.
  • Smart cards can perform signing or encryption operations on the server side.

Insights

  • Hardware-backed keys can also be integrated into classic web applications.
  • Direct device access from a web process requires particularly tight permissions and error boundaries.

Facts

  • As uses, Johannes names SAM- and HSM-like tasks.

Recommendations

  • Separate the web process from the card reader with a small privileged service.
  • Keep private keys on the smart card and log only the metadata you need.

References

Read the original article on hanez.org

Search the Web Archive