Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to buy an evaluation security token (combined smart card/usb reader) for my business that works on:

  • Windows 7 x64
  • OS X 10.6.x x64
  • Ubuntu Linux (64 or 32 bit, 10.04 or 10.10, I can bend based on possible tokens)

Functionality I need is:

  • Login authentication
  • Authentication for whole-disk encryption (in Linux/Windows, Mac is flexible here)
  • Signing/encryption using PGP and x.509 certificates
  • RSA-2048 key-capable (1024 not good enough.)
  • I can manage the certificates myself
  • Open source middleware/drivers (not necessarily FOSS, just source available. Can flex on this, I just want to be able to audit the code. OpenSC-compatible on Linux would be great.)

Is there any token that can do all of this? Or would I need multiple ones to accomplish this? Or do I need to look at smart cards and readers to get this? I have been researching this for a while and have had a heck of a time even getting accurate information about products.

Also, I am in the USA, and it appears that EU export laws prevent me from buying from there, so those vendors are out. I was looking at Feitian tokens from Gooze, but since they are in France I can't buy.

share|improve this question
up vote 1 down vote accepted

I'm don't know exactly what software you're using for things like disk encryption, but most PKCS.11 cards will do most of what you want. Certificate management is a bit limited because of the way security works. You can't put your own private certificate on a card, the card has to generate it for you (USB tokens emulate cards, it doesn't have to physically be a card). There's a lot of complexity in here that I'm glossing over for simplicity sake.

If you can find software that accomplishes what you want and reads the industry standard PCKS.11 format, that single card can provide certificates for any purpose. Windows, Linux, Mac and other OSes already have login solutions. PGP and OpenSSL can both interface with PKCS.11. TrueCrypt can use it for Trivial Key storage (not familiar with TC, so not sure what that means exactly).

You can get standard PKCS.11 USB tokens that emulate a SmartCard reader and card. You can get them from a variety of sources, most advertise them as being able to "login to Windows" or similar. Not all SmartCards/Tokens are the same, the PKCS.11 cards have specific functionality.

StartSSL sells Aladdin tokens fairly cheap. Athena also sells actual Smart Cards.
Note: I have not used any USB Tokens, we use actual smart cards.

Because this stuff is all massively complex, there's not a whole lot of public information on it. Vendors often can't give a simple answer because it would depend on many factors. So to avoid misleading people they just don't say anything (besides how to contact them and have a consultant work out the details with you). I didn't even mention the Certificate Authority requirements for issuing Smart Card certificates from a hardware device...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.