# Configuration file for OpenSC
# Example configuration file

# NOTE: All key-value pairs must be terminated by a semicolon.

# Default values for any application
# These can be overrided by an application
# specific configuration block.
app default {
	# Amount of debug info to print
	#
	# A greater value means more debug info.
	# Default: 0
	#
	debug = 0;

	# The file to which debug output will be written
	#
	# A special value of 'stdout' is recognized.
	# Default: stdout
	#
	# debug_file = /tmp/opensc-debug.log;

	# The file to which errors will be written
	#
	# A special value of 'stderr' is recognized.
	# Default: stderr
	#
	# error_file = /tmp/opensc-errors.log;

        # Where to find the *.profile files for pkcs15init;

	profile_dir = /usr/share/opensc;

	# What reader drivers to load at start-up
	#
	# A special value of 'internal' will load all
	# statically linked drivers. If an unknown (ie. not
	# internal) driver is supplied, a separate configuration
	# configuration block has to be written for the driver.
	# Default: internal
	# NOTE: if "internal" keyword is used, must be the 
	# last entry in reader_drivers list
	#
	reader_drivers = openct, pcsc, ctapi;

	reader_driver ctapi {
		# module /usr/local/towitoko/lib/libtowitoko.so {
			# CT-API ports:
			# 0..3		COM1..4
			# 4		Printer
			# 5		Modem
			# 6..7		LPT1..2
			# ports = 0;
		# }
	}

	# Define parameters specific to your readers.
	# The following section shows definitions for PC/SC readers,
	# but the same set of variables are applicatable to ctapi and
	# openct readers, simply by using "reader_driver ctapi" and
	# "reader_driver openct", respectively.
	reader_driver pcsc {
		# Whether to transform some APDU's from one case to another
		# Possible values:
		#            none:   Don't transform any APDU's
		#        case4as3:   For T=0, send a case 4 APDU as case 3,
		#                    (no Lc byte) the card will send back
		# 		     a 61xx SW, and we will follow up with a
		#                    GetResponse command
		#                    The SCM SCR111, Sun SCF, and e-gate readers
		#                    seem to require this.
		#        case1as2:   For T=0, send a case 1 APDU as case 2.
		#                    (append an Le byte of 0)
		#                    The Sun SCF and e-gate readers seem to
		#                    require this
		# case1as2_always:   for any T=0/1, send a case 1 APDU as
		#		     case 2.
		#                    The Sun SCF reader may require this
		# Default: none
		#
		apdu_masquerade = none;
		#
		# This sets the maximum send and receive sizes.
		# Some IFD handlers do not properly handle APDUs with
		# large lc or le bytes.
		#
		max_send_size = 252;
		max_recv_size = 252;
		#
		# EXPERIMENTAL: Enable CCID pinpad support
		# implemented (at least) in the libccid driver.
		#use_ccid_pin_cmd = true;
	}

	# What card drivers to load at start-up
	#
	# A special value of 'internal' will load all
	# statically linked drivers. If an unknown (ie. not
	# internal) driver is supplied, a separate configuration
	# configuration block has to be written for the driver.
	# Default: internal
	# NOTE: When "internal" keyword is used, must be last entry 
	#
	# card_drivers = customcos, internal;

	# Card driver configuration blocks. 

	# For all drivers, you can specify ATRs of cards that
	# should be handled by this driver (in addition to the
	# list of compiled-in ATRs). 
	#
	# The supported internal card driver names are
	#  flex		Cryptoflex/Multiflex
	#  setcos	Setec
	#  etoken	Aladdin eToken and other CardOS based cards
	#  gpk		GPK 4K/8K/16K
	#  mcrd		MICARDO 2.1
	#  miocos	MioCOS 1.1
	#  openpgp	OpenPGP card
	#  tcos		TCOS 2.0
	#  emv		EMV compatible cards

	# GPK card driver additional ATR entry:
	card_driver gpk {
		# atr = 00:11:22;
	}

	# For card drivers loaded from an external shared library/DLL, 
	# you need to specify the path name of the module
	#
	# card_driver customcos {
		# The location of the driver library
		# module = /usr/lib/opensc/drivers/card_customcos.so;
		# atr = 00:11:22:33:44;
		# atr = 55:66:77:88:99:aa:bb;
	# }

	# Force using specific card driver
	#
	# If this option is present, OpenSC will use the supplied
	# driver with all inserted cards.
	#
	# Default: autodetect
	#
	# force_card_driver = miocos;

	# Below are the framework specific configuration blocks.

	# PKCS #15
	framework pkcs15 {
		# Whether to use the cache files in the user's
		# home directory.
		#
		# At the moment you have to 'teach' the card to the
		# system by:
		# pkcs15-tool -L
		#
		# WARNING: Caching shouldn't be used in setuid root
		# applications.
		# Default: false
		#
		use_caching = true;
		# Enable pkcs15 emulation
		# Default: yes
		enable_pkcs15_emulation = yes;
		# Try pkcs15 emulation code first (before the normal
		# pkcs15 processing).
		# Default: no
		try_emulation_first = no;
		# Enable builtin emulators
		# Default: yes
		enable_builtin_emulation = yes;
		# list of the builtin pkcs15 emulators to test
		# possible values: esteid, openpgp, netkey, netkey,
		# starcert, infocamere, postecert
		builtin_emulators = esteid, openpgp, netkey, netkey, starcert, infocamere, postecert;

		# additional pkcs15 emulators (dynamic or builtin with
		# a different atr etc.) 
		# emulate foo {
			# module = builtin;
			# atr = 11:22:33:44;
		#}
	}
	
	# Estonian ID card and Micardo driver currently play together with T=0 only.
	# In theory only the 'cold' ATR should be specified, as T=0 will be the preferred
	# protocol once you boot it up with T=0, but be paranoid.
	
	# Generic format: card_atr <hex encoded ATR (case-sensitive!)>
	# Only parameter currently understood is force_protocol
	card_atr 3b:6e:00:ff:45:73:74:45:49:44:20:76:65:72:20:31:2e:30 {
		force_protocol = t0;
	}
	card_atr 3b:fe:94:00:ff:80:b1:fa:45:1f:03:45:73:74:45:49:44:20:76:65:72:20:31:2e:30:43 {
		force_protocol = t0;
	}
}

# For applications that use SCAM (pam_opensc, sia_opensc)
app scam {
	framework pkcs15 {
		use_caching = false;
	}
}

# Parameters for the OpenSC PKCS11 module
app opensc-pkcs11 {
	pkcs11 {
		# Maxmimum number of slots per smart card.
		# If the card has fewer keys than defined here,
		# the remaining number of slots will be empty.
		#
		# Note that there is currently a compile time
		# maximum on the overall number of slots
		# the pkcs11 module is able to handle.
		num_slots = 4;

		# Normally, the pkcs11 module will create
		# the full number of slots defined above by
		# num_slots. If there are fewer pins/keys on
		# the card, the remaining keys will be empty
		# (and you will be able to create new objects
		# within them).
		#
		# Set this option to true to hide these empty
		# slots.
		hide_empty_tokens = true;

		# By default, the OpenSC PKCS#11 module will
		# try to lock this card once you have authenticated
		# to the card via C_Login. This is done so that no
		# other user can connect to the card and perform
		# crypto operations (which may be possible because
		# you have already authenticated with the card).
		#
		# However, this also means that no other application
		# that _you_ run can use the card until your application
		# has done a C_Logout or C_Finalize. In the case of
		# Netscape or Mozilla, this does not happen until
		# you exit the browser.
		lock_login = true;

		# Normally, the pkcs11 module will not cache PINs
		# presented via C_Login. However, some cards
		# may not work properly with OpenSC; for instance
		# when you have two keys on your card that get
		# stored in two different directories.
		#
		# In this case, you can turn on PIN caching by setting
		# cache_pins = true
		#
		# Default: false
		cache_pins = false;

		# Set this value to false if you want to enfore on-card
		# keypair generation
		#
		# Default: true
		soft_keygen_allowed = true;
	}
}

# Parameters for the OpenSC PKCS11-Spy module, that logs all the
# communication between a pkcs11 module and it's calling application:
#    app <--> pkcs11-spy <--> pkcs11 module
app pkcs11-spy {
	spy {
		# Where to log to.
		#
		# By default, the value of the PKCS11SPY_OUTPUT environment
		# variable is used. And if that one isn't defined: stderr
		# is used.
		#
		#output = /tmp/pkcs11-spy.log;

		# Which PKCS11 module to load.
		#
		# By default, the value of the PKCS11SPY environment
		# variable is used. And if that one isn't defined,
		# opensc-pkcs11.so is used.
		#
		#module = opensc-pkcs11.so;
	}
}