在iOS上使用智能卡进行TLS身份验证

Question

I need to implement TLS authentication using a smart card with installed certificate and its assosiated public-private key pair on it. I managed to get the TLS client authentication working by using a .p12 file imported to the applications bundle (client authentication based on this: iOS app SSL .p12 Authentication - bad certificate error (-9825) ), but my problem is that private key can never leave a smart card and therefore I can't do the client authentication using the API. There are smart card operations available that can be used for signing and decrypting with a private key on the card to proove the app has got access to the private key.

---

The question I need to know the answer for is, if there is a way of establishing TLS connection on iOS using either objective-c, C or C++ where a reference to a private key itself is not needed, but the connection can be established by signing a piece of given data with the private key and returning the signed piece of data when needed? Can you please provide me with some ideas or examples of how could this be done. Thank you.

Answer 1

If you are using Apple's APIs, I do not think you can perform client-authenticated TLS without handling the private key to the APIs.

Optionally, you can use OpenSSL to handle the TLS connection and call a PKSC#11 Engine to talk to the smart card for signing. I am also seeking for implementations, but this sounds a promising approach.