OverView – OpenCT

# Overview

This is the easiest scenario and it is recommended:

    +----------------------------------------+
    |        Application, e.g. mozilla       |
    +------------------pkcs11----------------+
    |       PKCS11 library, e.g. OpenSC      |
    +----------------------------------------+
    |                 OpenCT                 |
    +----------------------------------------+
    |               Linux Kernel             |
    +----------------------------------------+

Mozilla can load security modules implementing PKCS11, OpenSC does that, and OpenSC has a direct interface to use OpenCT.

But sometimes you have this stacking:

    +----------------------------------------+
    |               Application              |
    +-----------------PC/SC------------------+
    |               PC-SC/Lite               |
    +---------------ifdhandler---------------+
    |                 Driver                 |
    +----------------------------------------+
    |                 Kernel                 |
    +----------------------------------------+

PC/SC (also called winscard) is a standard API popular on windows, so many applications want to use it to talk to smart cards. PC/SC-Lite is a free software for Linux, Mac OS X and BSD and implements this standard. It needs drivers in ifdhandler format so Vendors usualy ship drivers for in this format. Some vendors ship drivers that require kernel modules or kernel modifications, others have a generic driver that works with any kernel.

OpenCT has a driver in ifdhandler format, so you can use it in that place. But the direct mode combining for example OpenSC and OpenCT is prefered and a lot better tested.

Also there is a third model:

    +----------------------------------------+
    |               Application              |
    +-----------------CT/API-----------------+
    |                 Driver                 |
    +----------------------------------------+

This model is very, very simple, and was designed for DOS. It works well if you have only one application and one user. It is outdated. Still some applications want drivers in CT-API format and some vendors ship drivers in this format. OpenCT includes a CT-API driver, but it is not well tested, and not recommended for multi application or multi user environments.

# Why three faces?

OpenCT implements three difference ways how an application can use it, for a maximum of compatibility. The prefered way for an application is to use libopenct which implements the direct OpenCT mode. This mode works without the big PC/SC-Lite middleware, its code is a lot smaller, and still it offers the same features. Because it is smaller, we can debug it easier and fix problems faster. Also we use it everyday, so it is well tested.