UniCredit smartcard

ernad.cert.pem

-----BEGIN CERTIFICATE-----
MIIEMTCCAhmgAwIBAgIUB9qcAwYeCYGSeUXD5uf5GmsSBicwDQYJKoZIhvcNAQEL
BQAwPzELMAkGA1UEBhMCSFIxHjAcBgNVBAoMFVphZ3JlYmFja2EgYmFua2EgZC5k
LjEQMA4GA1UEAwwHWkFCQUNBMjAeFw0yNTExMTExNjU4MjdaFw0yNzExMTExNjU4
MjdaMFAxCzAJBgNVBAYTAkJBMREwDwYDVQQKDAhlLWJhcGx1czEWMBQGA1UECwwN
NDIxODAyNTkwMDAwNjEWMBQGA1UEAwwNMDMwMTk3MDE5MDAxNTCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEA0R5XjZRH4M94B3urZzeMWkD+A68+Xps/FQ06M36I
8BS/46CpfUsfIga7E+mvE/HBNJHaCuvkyhuXiQJXVT7so4NQaJgdVJhKLqeQ091A
TiTOcUOfQJFHimHgLpkW9MWDUx7WIsj+kJAqxnpIr97o31Pkc3+XlTI3VN+pZmIv
OY8CAwEAAaOBlzCBlDAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUE
DDAKBggrBgEFBQcDAjBiBgNVHSMEWzBZoUmkRzBFMQswCQYDVQQGEwJIUjEeMBwG
A1UECgwVWmFncmViYWNrYSBiYW5rYSBkLmQuMRYwFAYDVQQDDA1aYWJhIFJvb3Qg
UUNBggwQQv+VzbQeFMbljPswDQYJKoZIhvcNAQELBQADggIBADsDTPXbKvJ2HhSn
Sj2FHKDQ0ppcDYqfA7TaLiRaEFX4ZIg4s9A7PT1Pp2b7txcNO3RTwHXbpghHsNqL
xCCf5MXSciVRCIiYo2d5Pp1C8XMtRbhMOhX7H/clCMzOlhfiDgSFcg0sN+BF8Uum
dGcgnM0xvuby2e7XRvmPIe0T9+EjgQUQcYZvNC8R7W6uk6cKjqkBl5BfuQHqBtnS
UwouxhSYNnmJ7xp7ifyIiLFVW6I4GIv4sghxElaiCdyXWcLPg0NYvPGeihid17bP
XMqWUpnAK+dtSKAAwqQi/tyLUBMQQZQCOxer4rTd4q3Om7aZAmTz00T3DCBy3RgJ
maV8ylt5rb3sejmXl0CTK4iq7Y+NFAgUiRyY22VV4cv95xb8pieFyKQNjGMtA407
emwQ0yJAmwsOqPEj4aNx0SdpnNToI+jX4WaZprn3SLzKLw/pxAQY0HbF/au98K3O
kbER+ekZl1pActK1A0NgjO6wiYeX5GNqgvbIYwyfF0cEfS4C5FXk68R3R2ynz4EJ
amZJU5tlMod/CYtRw1pnHJz/Il8y+N5kEQNzMGsVshBWLAhqenTdJW8rCeRS84nD
Afrz2qCdSQvDtNp4yqMqLxF6F8pz0qg1RoJgd9LDgAaZDm5ip0SgdTlpkGofM6GE
ekwE0si7fyGq9zZxAfWAHZTUC/p7
-----END CERTIFICATE-----

ernad.txt

ERNAD THE DOSADNI

ernad.txt.sig.base64

base64 ernad.txt.sig

cScUsbdnJ3HQ/uiHiV7x9IT6Cbx+ldnAyZVbbvqO2FOEM814VX+ANBgC5OmJz84JEy6vYw8gTfR/
89uRHjpDXneCkNn6mkKOame+cxc+7hlyxGFDl//2CBv0U5hkcG91tj+S/YhrlbGHMYAYKJQlpe1w
yaOPFFzMKdIBhtKiD1E=

UNICREDIT_SMARTARD.md

UniCredit SafeNet eToken on Arch Linux

Guide for accessing UniCredit bank smartcard (SafeNet eToken 5110) on Arch Linux.

Hardware

Bus 001 Device 018: ID 0529:0620 Aladdin Knowledge Systems Token JC

Installation

1. Install Required Packages

# Core smartcard infrastructure
sudo pacman -S ccid opensc pcsc-tools

# Start PC/SC daemon
sudo systemctl enable --now pcscd

2. Create udev Rule for USB Permissions

echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="0529", ATTR{idProduct}=="0620", MODE="0666", GROUP="plugdev"' | \
  sudo tee /etc/udev/rules.d/99-safenet-token.rules

sudo udevadm control --reload-rules
sudo udevadm trigger

3. Install SafeNet Authentication Client (AUR)

OpenSC does not support SafeNet eToken natively. Install proprietary PKCS#11 module:

yay -S sac-core sac-gui

This provides:

• /usr/lib/libeToken.so - PKCS#11 module
• SACTools - GUI management tool

4. Restart pcscd

sudo systemctl restart pcscd

Verify Token Access

List Readers

opensc-tool --list-readers

Output:

Nr.  Card  Features  Name
0    Yes             SafeNet eToken 5100 [eToken 5110 SC] 00 00

List Token Slots

pkcs11-tool --module /usr/lib/libeToken.so -L

Output:

Slot 0 (0x0): SafeNet eToken 5100 [eToken 5110 SC] 00 00
  token label        : USB key
  token manufacturer : SafeNet, Inc.
  token model        : eToken
  serial num         : 03076257
  pin min/max        : 6/20

List Objects on Token (requires PIN)

pkcs11-tool --module /usr/lib/libeToken.so --login -O

Output:

Private Key Object; RSA
  label:      0301970190015
  Usage:      decrypt, sign, signRecover, unwrap
  Access:     sensitive, always sensitive, never extractable, local

Public Key Object; RSA 1024 bits
  label:      0301970190015
  Usage:      encrypt, verify, verifyRecover, wrap

Certificate Object; type = X.509 cert
  label:      0301970190015
  subject:    DN: C=BA, O=e-baplus, OU=4218025900006, CN=0301970190015
  serial:     07DA9C03061E0981927945C3E6E7F91A6B120627

Certificate Details

pkcs11-tool --module /usr/lib/libeToken.so --login \
  --read-object --type cert --label "0301970190015" -o cert.der

openssl x509 -inform DER -in cert.der -text -noout

Field	Value
Subject	CN=0301970190015, OU=4218025900006, O=e-baplus, C=BA
Issuer	Zagrebačka banka d.d. (ZABACA2)
Validity	Nov 11, 2025 → Nov 11, 2027
Key	RSA 1024-bit
Usage	Digital Signature, TLS Client Auth

Digital Signature Example

Create a Document

echo "ERNAD THE DOSADNI" > ernad.txt

Sign the Document

pkcs11-tool --module /usr/lib/libeToken.so --login --pin YOUR_PIN \
  --sign --mechanism SHA256-RSA-PKCS \
  --input-file ernad.txt --output-file ernad.txt.sig

Verify the Signature

pkcs11-tool --module /usr/lib/libeToken.so \
  --verify --mechanism SHA256-RSA-PKCS \
  --input-file ernad.txt --signature-file ernad.txt.sig

Output:

Signature is valid

Export Certificate for Recipient

# Export as DER
pkcs11-tool --module /usr/lib/libeToken.so --login --pin YOUR_PIN \
  --read-object --type cert --label "0301970190015" -o ernad.cert.der

# Convert to PEM
openssl x509 -inform DER -in ernad.cert.der -out ernad.cert.pem

Files to Send

File	Description
ernad.txt	Original document
ernad.txt.sig	Digital signature (RSA-SHA256)
ernad.cert.pem	Your certificate (public key)

Recipient Verification

The recipient can verify the signature using:

openssl dgst -sha256 \
  -verify <(openssl x509 -in ernad.cert.pem -pubkey -noout) \
  -signature ernad.txt.sig ernad.txt

Output:

Verified OK

GUI Tool

Launch SafeNet Authentication Client GUI:

SACTools

Troubleshooting

Permission Denied

If you get LIBUSB_ERROR_ACCESS:

# Quick fix
sudo chmod 666 /dev/bus/usb/001/018  # Adjust device path

# Permanent fix - unplug and replug token after creating udev rule

Token Not Detected

# Check if pcscd is running
sudo systemctl status pcscd

# Restart pcscd
sudo systemctl restart pcscd

# Scan for cards
pcsc_scan

OpenSC Cannot Handle Card

OpenSC's generic PKCS#15 driver does not support SafeNet eToken. You must use the proprietary libeToken.so module from sac-core package.

Installed Packages Summary

Package	Purpose
ccid	USB CCID smartcard reader driver
opensc	Smartcard utilities
pcsc-tools	PC/SC diagnostic tools
sac-core	SafeNet PKCS#11 module (libeToken.so)
sac-gui	SafeNet GUI tools (SACTools)
libp11	OpenSSL PKCS#11 engine

Author

Ernad Husremović, hernad@bring.out.ba