PKCS15-PROFILE(5) OpenSC File Formats PKCS15-PROFILE(5) .SH "NAME" pkcs15-profile - format of profile for pkcs15-init .SH "DESCRIPTION" .PP The pkcs15-init utility for PKCS #15 smart card personalization is controlled via profiles. When starting, it will read two such profiles at the moment, a generic application profile, and a card specific profile. The generic profile must be specified on the command line, while the card-specific file is selected based on the type of card detected. .PP The generic application profile defines general information about the card layout, such as the path of the application DF, various PKCS #15 files within that directory, and the access conditions on these files. It also defines general information about PIN, key and certificate objects. Currently, there is only one such generic profile, pkcs15.profile. .PP The card specific profile contains additional information required during card initialization, such as location of PIN files, key references etc. Profiles currently reside in /usr/share/opensc .PP Basic PKCS#15 terminology: 1. MF (Master File) is root of the filesystem hierarchy 2. DF(PKCS#15) is directory containing the PKCS#15 files and directories 3. EF(ODF) (Object Directory File) is elementary file containing pointers to other elementary files (PrKDFs, PuKDFs, SKDFs, CDFs, DODFs, AODFs) 4. PrKDF (Private Key Directory File) is elementary file containing pointers to the private keys and additional information about the private keys 5. PubKDF (Public Key Directory File) is elementary file containing pointers to the public keys and additional information about the public keys 6. CDF (Certificate Directory File) is elementary file containing pointers to the certificates and additional information about the certificates 7. EF(TokenInfo) is elementary file with generic information about the card SYNTAX AND SEMANTICS .PP The block syntax of profile files is in general similar to the configuration file. The profile file, is composed of blocks, which, in general, have the following format: key [, name...] { block_contents } block_contents is one or more block_items where a block_item is one of * # comment string * key[, name...] = value; * block .PP At the root level, the profile contains several configuration blocks. The block keys are as follows: * cardinfo: Configuration for general information about card. * pkcs15: Control for some of the general aspects of the PKCS#15 put onto the card. * option: Profile options to modify the behavior of profile. * PIN: Configuration and limits for particular PIN type. * filesystem: Specification for filesystem that is to be created on the card. * macros .SS "Profile file configuration" .sp Configuration of Card Information .PP cardinfo { block_contents } Con- figuration for general information about card: .PP label = name; Card label (De- fault: OpenSC Card). .RE .PP manufacturer = name; Card manufac- turer (Default: OpenSC Project). .RE .PP min-pin-length = int; Minimal length of PIN (Default: 4). .RE .PP max-pin-length = int; Maxi- mal length of PIN, should be overridden in the per-card profile (Default: 8). .RE .PP pin-en- coding = value; En- coding type of PIN. Known parameters: * BCD: binary-coded decimal * ascii-numeric: ASCII numerical values * utf8 * half-nibble-bcd * iso9564-1 .sp (Default: ascii-numeric). .RE .PP pin-pad-char = value; Char- acter used for padding the PIN when needed (Default: 0x00). .RE .PP pin-domains = bool; Some cards need to keep all their PINs in separate directories. The particular keys in that domain will be put below the DF of the specified PIN. (Default: no) .RE .sp .RE .RE .sp Configuration of PKCS#15 .PP pkcs15 { block_contents } Con- trol for some of the general aspects of the PKCS#15 put onto the card. Parameters in this block are: .PP direct-certificates = bool; The PKCS#15 system must contain at least one CDF, it con- tains the certificates di- rectly or references to certificates. This options defines whether the cer- tificates should be put di- rectly in the CDF itself or not (Default: no). .RE .PP encode-df-length = bool; Save length of DF into ODF file. Useful if we store certificates di- rectly in the CDF for better better perfor- mance and robustness (Default: no). .RE .PP do-last-update = value; Store information about last update in the EF(TokenInfo) (De- fault: yes). .RE .PP pkcs15-id-style = value; Method to calculate ID of the crypto objects. Known parameters: * native: 'E' + num- ber_of_present_ob- jects_of_the_same_type * mozilla: SHA1(modu- lus) for RSA * rfc2459 SHA1(Se- quenceASN1 of public key compo- nents as ASN1 inte- gers) (De- fault: native) .sp .RE .PP minidriver-sup- port-style = value; Style of pkcs15-init support of minidriver. Known para- meters: * none * gemalto .sp (Default: none) .RE .sp .RE .RE .sp Configura- tion of Profile Op- tion .PP option name { block_con- tents } .PP The name speci- fies profile options to mod- ify the behav- ior of pro- file, it can be .PP .sp .RS 4 .ie n * .PP macros { block_con- tents } Macros are spec- i- fied in form of name = value; pairs. .RE .PP pkcs15 { block_con- tents } In- ner block for con- fig- u- ra- tion of PKCS#15 struc- ture. .RE .sp .RE .RE .sp Con- fig- u- ra- tion of PINs .PP PIN name { block_con- tents } .PP The name spec- i- fies PIN type, it can be .PP .sp .RS 4 .ie n * Known pa- ra- me- ters are: .PP at- tempts = int; De- fines num- ber of at- tempts for the given PIN (De- fault: 3). .RE .PP flags = value...; Flags de- fine prop- er- ties of the PIN. Pos- si- ble flags: * case-sen- si- tive * lo- cal * change-dis- abled * un- block-dis- abled * ini- tial- ized * needs-padding * un- block- ing- Pin * soPin * dis- able-al- lowed * in- tegrity-pro- tected * con- fi- den- tial- ity-pro- tected * ex- chan- g- eRef- Data .sp (De- fault: lo- cal,ini- tial- ized,needs-padding). .RE .PP auth-id = value; Value used for auth ID (De- fault: 0). .RE .PP min-length = int; Min- i- mal length of PIN (De- fault: value min-pin-length set in cardinfo block). .RE .PP max-length = int; Max- i- mal length of PIN (De- fault: value max-pin-length set in cardinfo block). .RE .PP ref- er- ence = int; Value of ref- er- ence of the PIN (De- fault: set in par- tic- u- lar card dri- ver). .RE .PP file = name; File with PIN, ob- so- lete op- tion (De- fault: None). .RE .PP off- set = int; Off- set of PIN in PIN file, ob- so- lete op- tion (De- fault: 0). .RE .PP en- cod- ing = value; En- cod- ing type of PIN. Pos- si- ble val- ues: * BCD * ascii-nu- meric * utf8 * half-nib- ble-bcd * iso9564-1 .sp (De- fault: value pin-en- cod- ing set in cardinfo block). .RE .PP stored-length = int; (De- fault: value max-pin-length set in cardinfo block). .RE .PP max-un- locks = int; (De- fault: 0). .RE .sp .RE .PP Val- ues in this block can be set by macros. That al- lows to spec- ify the par- tic- u- lar val- ues with the us- age of op- tion. .RE .sp Con- fig- u- ra- tion of Filesys- tem filesys- tem { block_con- tents } .PP This block con- tains the spec- i- fi- ca- tion for filesys- tem that is to be cre- ated on the card. The filesys- tem con- sists of sev- eral nested blocks rep- re- sent- ing DF and EF files. When the DFs or EFs are spec- i- fied in card spe- cific pro- file, this is added to the file sys- tem info spec- i- fied in the main pro- file. .PP EF name { block_con- tents } .PP This block de- fines el- e- men- tary file in PKCS#15 file hi- er- ar- chy. The name can be one of: .sp .RS 4 .ie n * .PP type = EF; Type must match type of file. .RE .PP acl = value; Value of ACL (Ac- cess Con- trol List) (De- fault: NONE) .RE .PP file-id = EF; File ID, rel- a- tive path. .RE .PP struc- ture = value; File struc- ture is one of: * TRANS- PAR- ENT * LIN- EAR-FIXED * LIN- EAR-FIXED-TLV * LIN- EAR-VARI- ABLE * LIN- EAR-VARI- ABLE-TLV * CYCLIC * CYCLIC-TLV .sp .RE .sp .RE .PP DF name { block_con- tents } .PP This block de- fines di- rec- tory file in PKCS#15 file hi- er- ar- chy. The name can be one of: .sp .RS 4 .ie n * .PP type = DF; Type must match type of file. .RE .PP path = value; Spec- i- fi- ca- tion of path of the di- rec- tory file. .RE .PP file-id = value; File ID, rel- a- tive path. .RE .PP aid = value; Value of AID, in XX:XX:XX:...:XX:XX:XX no- ta- tion. .RE .PP acl = value; Type must match type of file. .RE .PP size = int; Size of the file in bytes. .RE .PP EF name { block_con- tents } Block spec- i- fy- ing nested el- e- men- tary file. .RE .sp Typ- i- cally, the root DF is MF. It is manda- tory that pro- file file con- tains DF en- try for MF (Mas- ter File). Oth- er- wise the pro- file file is in- com- plete and can- not be used. .RE .PP The DF can con- tain other DF or MF blocks. For ex- am- ples how the filesys- tem struc- ture may look like, please re- fer to pkcs15.pro- file or any other present pro- file file. .RE .SH "SEE ALSO" .PP pkcs15-init(1), pkcs15-crypt(1) opensc 08/10/2026 PKCS15-PROFILE(5)