web-eid

Web eID client for authentication and signing with Estonian ID cards.

ID card support is provided by esteid-cryptoki which requires the OpenSC PKCS#11 module.

Authentication

Produce a Web eID authentication token for a server-issued challenge nonce:

let card = web_eid::IdCard::find()?;
let token = web_eid::authenticate(
    &card,
    "https://ria.ee",
    challenge_nonce,
    pin1,
)?;
let json = token.to_json()?;

Signing

Create a digital signature with the signing key:

let hash = web_eid::recommended_hash(&card)?;
let signature = web_eid::sign(&card, hash, data_to_be_signed, pin2)?;

ECDSA signatures are returned as the raw r || s concatenation as produced by the card. To verify a signature e.g. with OpenSSL it must be encoded into an RFC 3279 Ecdsa-Sig-Value.

License

Apache-2.0.