Electronic identification

An electronic identification ("eID") is an electronic identification solution of citizens or organizations, for example in view to access benefits or services provided by government authorities, banks or other companies. Apart from online authentication many eICs also give users the option to sign electronic documents with a digital signature.

Related articles

Installation

All types of electronic identification require installing the ccid package. After installation, enable, and start pcscd.socket. In addition, ACS smart cards also require the acsccid package.

If you have a CR-75 card reader (1307:0361), you will also have to compile the following driver: https://github.com/jordidg/libcr75. Reconnect the reader after that.

pcsc-tools contains pcsc_scan program that can be used to check smart card detection Smartcards#Scan for card reader.

For PIN entry, is used. This requires either or to be installed to draw the window where you can enter your PIN number.

Belgium

To identify with an identification card reader, the following steps are required:

  • The app for authentication

Import the (continuous build) keys from . See makepkg#Signature checking. Install the package. Run: 

$ about-eid-mw

which should open a window. In the window, check that the "PCSC daemon status" is "running". If it is not the case, start pcscd.service. In the same window, copy the value for "PKCS#11 location". This value can alternatively be found by first finding the module (which might be beidpkcs11.so) by doing: 

# p11tool --list-tokens

Then finding the full path with: 

# find /usr/lib -name beidpkcs11.so
  • The driver of the card reader itself.

Look at the brand of the card reader; there is a high chance it is ACS (Advanced Card System Ltd). If it is ACS, go to https://belgeid.be/product/acr38 and download the Linux driver. Follow the described install driver process.

  • Know which internet browser you will be using

For Chrome, no plugin. For Chromium, you will need to install and as well. You may consider: https://devctl.blogspot.com/2014/01/making-belgian-eid-work-on-arch-linux.html

For Firefox, add the Firefox plugin to your browser. In recent versions, you will need to manually add the eID module to the Firefox security devices configuration. Your module path might be different than the one in the guide, use the value of "PKCS#11 location" found with the instructions at the authentication paragraph.

To test if the setup worked, try it out on the test page. You may find hints for troubleshooting in the official documentation but keep in mind that Arch Linux is not officially supported.

Signing documents

Signing emails with Thunderbird and documents with LibreOffice is explained in a blog post by Luc Stroobant.

Depending on your system configuration it may be possible to run Adobe Reader DC under wine (see also the official FAQ on digital digital signatures). If using Adobe Reader is not possible, you can use Belgian Federal Public Services' "signing box". Using this service requires the installation of an extra eID middleware and extension by e-contract.be. Navigate to the signing box page, upload any pdf-file and attempt to add a digital signature to begin the installation process.

Alternatively, provides native digital signing of pdf's in Linux since version 21.04.

Brazil (ICP-Brasil)

SSL

Install as the Brazilian root CAs are not part of Mozilla's NSS due to a long standing issue.

Smart Cards (A3 certificates)

1. Install and .

2. Start/enable

Firefox

Navigate to Edit -> Preference -> Advanced -> Certificates -> Security Devices and click "Load" to load a module using and name it ICP-Brasil A3 - Safe Sign Identity Client.

Test it by going to Receita Federal's e-CAC.

Chrome

Ensure Chrome is closed and run:

 modutil -dbdir sql:$HOME/.pki/nssdb/ -add "ICP-Brasil A3 - Safe Sign Identity Client" -libfile /usr/lib/libaetpkss.so

Croatia

1. Start/enable

2. Install

3. Launch Eid client ()

Firefox

Navigate to Edit -> Preference -> Advanced -> Certificates -> Security Devices and click "Load" to load a module using /usr/lib/akd/eidmiddleware/pkcs11/libEidPkcs11.so. You can assign any name to it, i.e. .

Estonia

See

  • https://www.id.ee/?lang=en
  • Automated installation script in Estonian community wiki: EST | ENG. Although initially created for Manjaro Linux, it is also suitable for Arch Linux and other related distributions that use pacman.

DigiDoc

Once ccid is installed and pcscd.socket is started, install . One of the dependency is verified with a signature that you have to import to your GnuPG keyring. If you have an ACS card reader, acsccid is required.

DigiDoc4 has an optional GNOME/Files right click menu integration that requires to be installed. Currently this is broken due to missing Python 3 support

Chromium

After installing , enable the PIN 1 authentication in Google Chrome and Chromium by running the following command (taken from the open-eid repo).

 modutil -dbdir sql:$HOME/.pki/nssdb -add opensc-pkcs11 -libfile onepin-opensc-pkcs11.so -mechanisms FRIENDLY

Firefox

To enable PIN 1 authentication in Firefox you should install esteidpkcs11loaderAUR and . After restarting the browser make sure that "Firefox PKCS11 loader" extension is enabled. You can also follow manual instructions at Smartcards#Mozilla Firefox.

Finland

Official instructions: https://dvv.fi/kansalaisvarmenne-kortinlukijaohjelmisto.

mPollux Digisign Client

First install the prequisites as described in #Installation. Then install . Launch the client, connect your reader and put in your card. Click the icon in your status bar once it turns yellow. This should trigger the card activation process if you have not activated it before.

Firefox

Navigate to Security Devices page (Search it via Preferences), then click Load and set Module Name to DigiSign PKCS#11-moduuli and module filename to . Finally restrart Firefox. The card can be tested at: https://dvv.fi/testaa-varmenteen-kayttoa.

Germany

ReinerSCT devices

For some devices, you need to install and copy the default configuration file to the same folder, without the .default suffix. Restart and applications like should recognize the scanner. The ReinerSCT RFID will blink its LED, which it does not when the driver is not installed correctly.

Spain

DNI electrónico (DNIe)

Install . To sign documents using your identity card, install .

Sweden

BankID is the leading electronic identification in Sweden.

gollark: S↓¶e...
gollark: "Can't connect to server"
gollark: Just traverse the hash table to backtrace Visual Basic into the x264 transcoder.
gollark: Their decision to use IPv5 for that instead of something else was stupidious.
gollark: Yes, I know.
This article is issued from Archlinux. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.