# Welcome to OpenPACE’s documentation!

OpenPACE implements Extended Access Control (EAC) version 2 as specified in BSI TR-03110 [1]. OpenPACE comprises support for the following protocols:

Password Authenticated Connection Establishment (PACE):

  Establish a secure channel with a strong key between two parties that only share a weak secret.

Terminal Authentication (TA):

  Verify/prove the terminal’s certificate (or rather certificate chain) and secret key.

Chip Authentication (CA):

  Establish a secure channel based on the chip’s static key pair proving its authenticy.

Furthermore, OpenPACE also supports Card Verifiable Certificates (CV Certificates) and signing requests as well as easy to use wrappers for using the established secure channels.

The handlers for looking up trust anchors during TA and CA (i.e. the CVCA and the CSCA certificates) can be customized. By default, the appropriate certificates will be looked up in the file system.

OpenPACE supports all variants of PACE (DH/ECDH, GM/IM), TA (RSASSA-PKCS1-v1_5/RSASSA-PSS/ECDSA), CA (DH/ECDH) and all standardized domain parameters (GFP/ECP).

OpenPACE is implemented as C-library and comes with native language wrappers for:

- Python

- Ruby

- Javascript

- Java

- Go

Note

OpenPACE only implements the cryptographic protocols of the EAC. If you actually want to exchange data with a smart card, you need to take care of formatting and sending the data in the form of APDUs. If this is what you’re trying to do, you should have a look at the npa-tool of the OpenSC Project [2].

## Further Reading

- Download OpenPACE
- Compiling and Installing OpenPACE
  - Setting up a development environment using Vagrant
  - Creating a fat binary for Windows, Linux and macOS
  - Compiling on Linux, Unix and similar
  - Compiling for Windows
    - Compiling with Visual Studio
- Usage of OpenPACE
  - Using `libeac`
    - Programming with OpenPACE
  - Using `cvc-create` to Create the EAC PKI
  - Using `cvc-print`
  - Creating the Document PKI and EF.CardAccess/EF.CardSecurity
- Extended Access Control Specification
  - Password Authenticated Connection Establishment
    - Protocol Specification
    - ECDH Mapping
    - DH Mapping
  - Terminal Authentication
    - Protocol Specification
  - Chip Authentication
    - Protocol Specification

## Where to get help

Do you have questions, suggestions or contributions? Feedback of any kind is more than welcome! You can contact us through our GitHub repositories or the project trackers.

[ 1 ]

https://www.bsi.bund.de/dok/TR-03110-en

[ 2 ]

https://github.com/OpenSC/OpenSC/