eSigner 6.0 for Mac OS X Release Notes - web.3tweb.3t-europe.com/downloads/MacOSX/eSigner_Mac_6_0_5_Release… · Classic Client 6.3.5 - 002 for Mac Mountain Lion OS X. 6 ... The

eSigner 6.0 for Mac OS X

Release Notes

Document Reference : D1321875A

October 20th 2015

Contents

What’s New? ........................................................................................................................... 3

New Features ........................................................................................................................ 3

What’s Gone? .......................................................................................................................... 3

What’s in? ................................................................................................................................ 4

System Requirements ........................................................................................................... 4 Supported Operating Systems, Applications ........................................................................ 4 Supported Readers ............................................................................................................... 5 Supported Middleware .......................................................................................................... 5 Supported Smart Cards ........................................................................................................ 6 Supported Document Types ................................................................................................. 6 Compliant with the Following Standards ............................................................................... 6

What’s History? ...................................................................................................................... 6

Revision History .................................................................................................................... 6

What’s Up? ............................................................................................................................ 12

Known Issues ...................................................................................................................... 12 Product Limitations.............................................................................................................. 15 Observations ....................................................................................................................... 16

Where’s the Doc? ................................................................................................................. 16

3

These release notes provide particular details about eSigner 6.0.5 for Mac OS X – 001.

What’s New?

This section describes all the differences between this release eSigner 6.0.5 for Mac OS X – 001 and the previous release eSigner 5.2.1 for Mac OS X – 001.

New Features

Mac OS X 10.11 (El Capitan) is now supported.

eSigner now supports Gemalto SWYS reader.

All resources such as images and the GUI layout are now signed to detect unauthorized modifications.

The CFG_GUI_CUSTOM_BMP parameter is now supported. This HTML parameter allows the placing of a custom logo in the top right corner of eSigner windows.

The CFG_GUI_BUTTON_BMP parameter is now supported. This HTML parameter can be used in button mode to replace the label with a custom image.

What’s Gone?

No support has been removed from this version. Some versions of applications are not supported for certain versions of Mac. To know what is supported, please consult the matrix in “Supported Operating Systems and Applications”.

4

What’s in?

This section provides a full list of hardware, operating systems, peripherals and software that are supported by Gemalto for use with this current release of eSigner for Mac OS X It also lists the minimum system requirements to run eSigner for Mac OS X correctly.

System Requirements

The workstation must meet the normal system requirements to run the version of Mac OS installed.

Each user workstation must have at least:

200 MB of available hard disk space

an Intel processor

an Internet connection

An available COM or USB port

A CD ROM drive

Gemalto recommends that your machine has RAM at least equal to that normally recommended for the OS. If this RAM requirement is met, eSigner for Mac OS X should run normally.

Supported Operating Systems, Applications

The following support matrix shows the versions that are supported when using Classic Client as the middleware PKCS#11 module. Gemalto strongly recommends that all supported OS should be the latest versions.

V means the application has been validated for the OS. Gemalto recommends that you use this version.

S means the application is supported for the OS but has not been validated.

N means not supported for this release of eSigner.

4.2 means that you should use one of the previous releases of eSigner 4.2.21-006 (for V3 bundle) or 4.2.21-003 for V1 bundle.

4.4 means that you should use the previous releases of eSigner 4.4.

For details of the support provided for 4.2 or 4.3 versions, please refer to the corresponding eSigner Release Notes.

Note: The OS, applications and readers must also be supported by the version of Classic Client that is installed on the same Mac. Please refer to your Classic Client for Mac OS X documentation to know which versions are supported.

5

OS Supported

10.6 (Snow

Leopard) 32-bit

and 64-bit

10.7 Lion (32-bit)

10.7 Lion (64-bit)

10.8 Mountain

Lion 10.9

Mavericks

Last update:

22/02/2016

10.10 Yosemite

10.11 El Capitan

FF ESR 4.2 4.2 4.4 Lion 5.2 V V V

FF latest 4.2 4.2 4.4 Lion 5.2 V V V

Safari 6,7 N 4.2 4.4 Lion 5.2 N N N

Safari 8 N N N N S S S

Safari 9 N N N N V V V

Supported Readers

This release of eSigner supports all the readers that are supported by the version of Classic Client middleware that is installed in the same bundle. For a list of supported readers, please refer to the documentation of Classic Client for Mac. In particular, eSigner supports Gemalto’s CT700 and CT710 PIN pad readers, regardless of whether the PIN pad’s firewall option is set or not.

Note: Safari has a limitation regarding the handling of a PIN pad reader. Safari does not recognize PIN pad readers and can manage TLS (ex SSL) smart card-based mutual authentication only through a transparent reader. If a PIN pad reader implements a fire wall option, such mutual authentication cannot be performed. This behavior is linked more to Classic Client, however it is reported here as eSigner is delivered as a bundle with Classic Client.

Supported Middleware

eSigner comes in a “bundle” with the correct corresponding version of the Classic Client middleware as follows:

If you are using El Capitan (Mac OS 10.11):

Classic Client 6.3.8 - 001 for Mac El Capitan OS X.

If you are using Yosemite (Mac OS 10.10):

Classic Client 6.3.6 - 001 for Mac Yosemite OS X.

If you are using Mavericks (Mac OS 10.9):

Classic Client 6.3.5 - 002 for Mac Mavericks OS X.

If you are using Mountain Lion (Mac OS 10.8):

Classic Client 6.3.5 - 002 for Mac Mountain Lion OS X.

6

Other Supported Middleware

Even though Gemalto has not tested this release of eSigner with third-party middleware, it operates over the PKCS#11 standard API and could operate correctly with other middleware providing the same standard interface. If you choose to use any non-Gemalto middleware, you do so at your own risk. Gemalto recommends that you test eSigner with the other middleware before deploying it to your users.

Supported Smart Cards

eSigner supports EZIO PKI and Classic TPC smart cards and all other cards that are supported by the installed version of Classic Client.

Supported Document Types

Some types of document can be signed by eSigner but only .txt files can be displayed inside the eSigner window.

The other document types that can be displayed outside of the eSigner window by starting the computer’s default application and signed by eSigner are:

.pdf

Compliant with the Following Standards

eSigner is compliant with:

IdenTrust 3.1 and 3.2. Note that only the ISPI plug-in is supported, not the ISIL plug-in (Java mode).

What’s History?

This section provides a history of the evolution of eSigner for Mac OS X.

Revision History

Changes in eSigner 6.0.5 - 001 (since eSigner 6.0.4 - 001)

eSigner no longer crashes in button mode when using a non-SWYS compliant reader.


Changed error message from “PKCS#11 Error - Web Site Not Trusted” to “Operation terminated” which could be displayed when user cancels transaction.

Counter information used in OTP generation has been removed from the Terminal signature.

7


It is now possible to sign data using XMLDSIG format. eSigner CFG_SIGNATURE_FORMAT attribute has been extended with a new parameter.

A warning message can be displayed if a smartcard is about to expire when signing document.


Signed local configuration file. The local.conf file is now signed and cannot be modified by end user.

Support for Identrust 3.2a is specified in the local.conf configuration file.

eSigner now supports Yosemite Operating System.


Improved local.conf error management.

Changes in eSigner 5.0.3 - 001 (since Mac eSigner 4.3.9 - 001)

The CustomLogo.File and CustomLogo.Transpcolor are now working as described in the documentation.

CFG_GUI_SHOWSIGNBUTTON HTML parameter is now working as described in the documentation.

The error message dialog could not be closed when loading an inappropriate file in browsing mode. The error message has been changed to a classic error dialog.

Changes in eSigner for Mac 4.3.9 - 001 since (eSigner for Mac 4.3.8 - 001)

Corrected Problems

This version corrected a problem where eSigner crashed when performing multiple signatures, when more than one document was being signed in the same session.

Supported HTML Parameters

This version of eSigner was NOT compliant with the IdenTrust IT-SIR-3.2a specification. It was compliant with IdenTrust IT-SIR-3.2. As a result, two optional HTML parameters were not supported for this version and should not be used:

Policyid – a list of policy IDs for certificates that are allowed to be used for signing

Postformvariable – flag to determine if the plug-in should post the plug-in’s calling parameters or not


Enhancements

The following enhancements have been made in this release:

The printing options have been improved to provide more flexibility. In multi-page mode it is now possible to print the whole document, the first sheet of the current page, or specify a start page and the number of sheets to be printed.

Note: A “page” is a page of the document in eSigner. A “sheet” is a sheet of paper. A page may therefore be one or more sheets.

8


New Features

The following features have been added to this release:

Multi-page display: eSigner can be configured to display large data over multiple pages. This feature is activated by default (LargeData.MultiPageDisplay = 1). The Text.Plain.MaxGridSize is set to 360,000 characters by default. This is the maximum character matrix that eSigner will allow to be displayed as a single WYSIWYS window. When data exceeds the Text.Plain.MaxGridSize value, eSigner splits it into multiple pages and always displays in pop-up mode. Scrolling buttons allow the end-user to navigate across the multiple generated pages. Also see “Known Issues”.

In IdenTrust mode, eSigner is now compliant with IdenTrust IT-SIR-3.2a. As a result, two additional optional HTML parameters have been added to this release:

Policyid – a list of policy IDs for certificates that are allowed to be used for signing

Postformvariable – flag to determine if the plug-in should post the plug-in’s calling parameters or not

Some changes have been made to the eSigner installation:

eSigner and Classic Client are installed together from a single “Bundle” .pkg file. The corresponding versions of Classic Client are given in “Supported Middleware”.

Corrected Problems

When signing a document displayed in Firefox when using a PIN pad reader, the focus now remains on Firefox.

The eSigner 4.2.21 for Mac OS X – 006 installer did not set the correct access rights to certain resource files, thus preventing users without admin rights from using eSigner. A hotfix patch was issued to reset the access rights correctly. 4.3.5 sets the correct rights at installation.

Other Changes

The name of the config.reg file has changed to local.conf.

Improved management of different Classic Client card types to overcome the fact that Classic Client for Mac can only manage one card type at a time. Now, if a supported "V1" or "V3" card is inserted in the reader during installation, the installation sequence detects it and sets the configuration to support this card. If no card is present, a dialog box appears enabling the user to choose the card type to be supported (V1 or V3).

This dynamic card configuration process is delivered as an application that can be launched by the user at any time. It performs card detection and configures the settings accordingly.

Supported Applications

Support for the following has been removed from this version.

10.6 (Snow Leopard) – 32-bit and 64-bit versions

10.7 (Lion) – 32-bit version (the 64-bit version is still supported)

For these OS, customers should use eSigner 4.2.21-006 (for V3 bundle) or 4.2.21-003 for V1 bundle.

9


New Features:

V3 Bundle

eSigner 4.2.21 for Mac is delivered with the corresponding version of Classic Client for Mac (see “Supported Middleware”). This pairing is known as a “bundle”.

This version of eSigner for Mac (build 006) is the version that is used in the V3 bundle. The V3 bundle is for use with cards that are in the V2/V3 package of Classic Client. A detailed list of these cards can be found in the “Classic Client for Mac Release Notes”.

The other bundle is the V1 bundle that uses eSigner 4.2.21-003 for Mac. 4.2.21-003 has its own Release Notes. That bundle is for use with cards that are in the V1 package of Classic Client.

Caution: You can only have one of the two bundles installed at any one time on the same

Mac. Installing a bundle automatically overwrites the other bundle if present on the Mac.

Corrected Problems

A hotfix is available to resolve a problem concerning the necessary access rights to use the eSigner plug-in. The solution is for the user to install this hotfix using an Administrator account. The hotfix sets the correct access rights to the eSigner plug-in so that the user can use it normally under his or her own user account (which may not necessarily have administrator rights to the Mac). For further details, please refer to the “Known Issues” section.

The hotfix must be installed after the installation of the eSigner plug-in. Please contact Gemalto Technical Support to obtain this hotfix.


Corrected Problems

In 4.2.20 and earlier versions, there were problems in managing some combinations of multiple displaying parameters. Due to differences between different browsers in parameter restitution and synchronization to eSigner this could lead to eSigner windows displaying incorrectly. This could occur in particular when the validity of a parameter depends on the values of other parameters, such as CFG_SIGN_UNSEEN depending on CFG_GUI_BUTTON_MODE. In 4.2.21, the management of multiple displaying parameters has been improved in order to avoid these variable effects due to differences between browsers.

Related to the corrected point above, in certain particular cases with eSigner Mac 4.2.20, the eSigner window was not displayed with Safari and with Firefox10. These identified cases are now working correctly in version 4.2.21, with Safari and with Firefox10.


Added Firefox 10 , 11, 12, 14 and 15

Safari is once more supported (5.1.7).

10


Corrected Problems

The Cancel button in window mode, now works correctly and cancels the transaction (previously it had no effect).

The virtual PIN pad now displays the numbered keys in a random order as it is supposed to.

eSigner now refreshes when switching from window mode to pop-up mode as it is supposed to.


Safari was not supported in this version.

The only version of Firefox supported in this version was 13.

Changes in eSigner for Mac 4.2.16 - 001 since (eSigner for Mac 1.0 - 012)

The Software Information Report feature was replaced by the About feature that displays the version number of eSigner for Mac OS X

The version number was synchronized with eSigner for Windows. This is why the version number jumped from 1.0 to 4.2.

These Release Notes replaced the ReadMe.txt file of previous versions.

GUI Enhancements

The graphical user interface (GUI) has been completely changed to be relatively similar to eSigner 4.2 for Windows. For more details, please refer to the eSigner 4.2 for Mac OS X Installation and User Guide.

Data that displays in an external application can be displayed as a hyperlink. Click on the link to open the data in an external application. This depends on the ExternalData.View parameter in Config.reg file of eSigner). The config.reg file is described in the eSigner 4.2 for Mac OS X Integration Guide.

Save documents after signing button can be configured so that it is not available. This is determined by the Sign.Save.Button parameter in the config.reg file (activated or not).

If available, Save documents after signing button can be activated or not by clicking on it (appears grayed if not active).

Other Enhancements

The SHA-256 hash algorithm is now supported.

32-bit and 64-bit versions of eSigner are supported.

The name and location of the configuration file have changed. The file is now called config.reg instead of ConfigFileeSigner.cfg. It is located in the resource archive.

Embedded mode is now supported.

The following parameters have been added to the config.reg file:

Sign.CheckCertificateChain - Forces bypass of certification chain verification.

Sign.Hash.Mechanism - Specifies the hash algorithm (SHA1 or SHA256).

Sign.Save.Button - Hides the “Save after signing” button.

ISPI.mode.support – Enables (or not) support of ISPI rule set for IdenTrust mode.

Pin.EntryMode – Specifies virtual PIN pad or keyboard or both.

11

GUI.MinHeight – Specifies minimum height (in pixels) for the plug-in to be embedded in an HTML page.

GUI.MinWidth – Specifies minimum width (in pixels) for the plug-in to be embedded in an HTML page.

GUI.ConfigIHMDir - Points to the directory where eSigner is installed.

Pkcs11.ForcePin - Forces PIN entry when opening an PKCS#11 Slot.

Pin.MinimumSize - Specifies minimum PIN length.

Pin.MaximumSize - Specifies maximum PIN length.

Certificate.Pin.Request - Determines if a PIN is requested to view certificates in the card.

ExternalData.View.Mode - Determines behavior for files that need to be displayed in an external window or are non-viewable.

Note: The default values for these parameters (that is, those present in the config.reg file when eSigner is delivered) are given in the “eSigner for Mac OS X Integration Guide”.

Other Modifications

Now, if the file is too big to be displayed by the application, the message “Data to be signed has exceeded the limit” appears, and the Sign button is disabled.

No menus in the eSigner window:

Unlike the Windows version of eSigner, there are no menus (Post and Actions menus) in the eSigner window.

Corrected Problems

In previous versions of eSigner for Mac OS X (1.0), large data submitted to eSigner for signature could lead to a crash of eSigner and the used browser. Now eSigner detects when the data size exceeds the maximum allowed by the computer and denies signature by displaying an information message. Web applications have to be designed in a way to limit the size of submitted data. If the web application allows the user to determine the amount of data to be submitted for signature, the user needs to split transactions into sufficiently small chunks.

WYSIWYS Feature Problem Corrected

Problem Description: If the eSigner window was partially hidden, the error message was correctly displayed. After hitting Cancel on the error message, if a new signature attempt was performed when the eSigner window was partially hidden, the error message was not displayed.

Changes in eSigner for Mac 1.0 - 012 since (eSigner for Mac 1.0 - 011)

Explicit Change PIN at first use with PIN pad

Integrate PIN policy management in PIN pad


Disable Unblock tab in PIN Change Tool

PIN Policy update (for PIN Change Tool)


Support of Leopard (10.5) and Snow Leopard (10.6) in the same package

Support of Classic Client 6.0 for Mac 10.6 V1 support

12


Support of Snow Leopard (10.6)

Support of PIN pad in SPE (Secure PIN Entry) mode.

What’s Up?

This section provides a list of the known issues at the time of this current release and also of the limitations of the product.

Known Issues

Automatic detection of smart cards in Yosemite using Core 2 duo hardware processor causes an installation issue. A workaround is to disconnect all readers during the installation process and select the smart card type manually.

For Identrust installations, the “Identrust.Version” parameter must always be specified.

Automatic detection of smart cards version when installing eSigner on Yosemite can cause issues when several readers are connected at the same time.

During message signature verification, eSigner may trigger a security alert when the default color profile has been changed. A workaround is to set the color profile back to the default settings in the system preference menu.

If a smart card is expired and has never been initialized, eSigner will first prompt an error stating that the certificate is not valid rather than the smart card is not initialized.

In browsing mode, when a user is loading a multi-page document from the hard drive, refresh issue can occur on the first rendering of the first page.

The Print button is not disabled when signing a document not supported by the eSigner internal viewer such as a Word, or .pdf file. #Ref193718

If a web page uses target=”_new” for opening a signature result in an external window. This one is considered as a pop-up window and is blocked by default in most modern browsers. #Ref189595

When ExternalData.View.Mode is set to 1, a button appears that is used to open an external application to display the document. However nothing happens when the button is clicked. This occurs in both Firefox and Safari. A workaround is to save the data on disk and open it manually with an appropriate application Ref #181030

When the eSigner banner is customized with a logo (integration customization), in embedded mode the logo displays correctly but the hyperlink to the given URL does not work. This is true for both Safari and Firefox. In pop-up mode, this feature works correctly for both browsers. Ref #181695.

If the multi-page display feature is deactivated (LargeData.MultiPageDisplay = 0), or the value of Text.Plain.MaxGridSize is increased from the default of 360,000 characters, the eSigner window may have difficulty in managing the data.

The Save button always appears and is enabled, even if the CFG_GUI_SHOWSAVEBUTTON parameter is set to 0 (meaning hide Save button). Refs #152920 and #159801

eSigner buttons greyed with semi-transparent white square:

13

When the certificate list is displayed, all eSigner buttons are covered by a semi-transparent white square. This semi-transparent white square is also present when clicking on the About button and on the Sign button.

Save After Signature button hidden by a white square:

When the Sign.Save.Button parameter is set to 2 in the local.conf file (meaning hide the Save After Signature button) the button is masked by a white square or rectangle in pop-up mode. Embedded mode works correctly for Mac. Ref #125688.

eSigner is grayed after cancelling a Save Signature File process: Ref #125559

When Save After Signature is activated, clicking the Sign button displays a File Save As window. After cancelling this window, all eSigner buttons are greyed and disabled.

Locally browsed file name hyperlink clickable when eSigner displays its contents:

eSigner displays a file's contents after browsing locally. The hyperlink file name is displayed and is clickable. After clicking on the hyperlink, the appropriate application is launched and displays the file contents.

-> The hyperlink file name should not be clickable if eSigner can display its contents.

When using the Print button in eSigner, some extra blank pages may be printed at the end of the document.

The following parameters have not been implemented:

CFG_GUI_BUTTON_BMP

CFG_GUI_BUTTON_BMP_URL

Practically, the button mode can only be used with text but not with a picture in the button.

When using the virtual PIN pad, hitting Enter on the Mac keyboard does not work, you have to click OK on the virtual PIN pad.

Sometimes the PIN entry screen does not have the focus when it should, or if focused, the focus is not in the text entry space. Just click the PIN pad screen in the text entry field to bring it in focus. This problem is caused by a third-party library. Gemalto has reported the problem to the suppliers of the third-party library.

When eSigner is called in embedded mode or button mode, if the user clicks the eSigner button more than once, multiple PIN entry windows open.

Normally the user will not notice this as the different PIN entry windows exactly overlap. Only the top one is visible. The event is only noticeable if the user moves the top window thus revealing the other window(s) behind it.

This behavior does not prevent the user from performing a Signature/Authentication. The user may enter a valid PIN in any of the opened windows and the signature will be performed and properly sent to the website. The extra superfluous windows will be closed.

If the user enters an invalid PIN, an “invalid PIN” message is displayed. The superfluous PIN entry windows are still there and may be used to enter the valid PIN.

Note: this behavior does not appear in pop-up mode where the Sign button is grayed and is not usable as soon as clicked.

When a WYSIWYS warning message is displayed to accept or refuse to perform a signature (Yes/No) and is not acknowledged by the user after a relatively long time (about 1 minute, depending on the machine) then the browser interprets eSigner as having crashed and displays the corresponding plug-in crash window.

If the user refreshes the page, the eSigner plug-in window reappears correctly and the user can sign (or refuse) the signature as before.

14

The WYSIWYS verification may last a certain time (typically between a few 10 ms to 500 ms for limited data size), if the user moves the mouse after clicking Sign, then a WYSIWYS warning message could be displayed.

If this occurs, the user should answer “No” to the WYSIWYS warning window and click Sign again without moving the mouse (and thus avoiding the display of the WYSIWYS message). The signature will proceed normally.

15

Product Limitations

Sometimes in multi-page mode, if the data is too large – the signature cannot be verified.

The Pkcs11.ForcePin parameter is valid only for V2/V3 cards and even then it depends on how the cards have been personalized. Ref#179286

The external viewer is not supported. Refs #181024 #181030

Certificate details window cannot be closed if the certificate viewer window has been closed first. Ref #181587

In button mode, Safari may have difficulty displaying buttons correctly if the user resizes the window to a size that is too large. Users should bear this in mind if they resize the window. Ref #181662

The msiexec.exe must NOT use the /forcerestart parameter otherwise the computer will restart after the installation of the bundle which means that Classic Client and eSigner will not be installed at all. Ref#183165.

In multi-page mode, if a single line of data is larger than the Text.Plain.MaxGridSize parameter, the data cannot be broken into multi-pages and eSigner returns an error to say the file is too large. You should make sure that no single line exceeds the MaxGridSize. As indicated earlier, when going to multi-page display, eSigner always displays in pop-up mode regardless of the window size parameter values. Ref #176970.

Text in documents to be signed must be limited to those in the ASCII range of 33-126. The following table is a reminder of the ASCII values in this range.

There are neither menus in the eSigner window nor eSigner-specific DDA shortcuts to perform actions without the mouse. Disabled people can use the built-in disabled user features of the Mac OS. The Mac OS features keyboard shortcuts to control mouse actions.

16

Observations

Buttons for multi-page navigation (previous, first, next, last page) are never disabled. Using them has no effect when they are irrelevant.

If the multi-page display feature is activated (LargeData.MultiPageDisplay = 1), and the user clicks Print, only the current page is printed – not the whole document. Ref #183214

Where’s the Doc?

This section describes the documentation that is provided with eSigner 6.0 for Mac OS X and where to find it:

eSigner 6.0 Documentation

Document Location Description

eSigner 6.0 for Mac OS X Installation & User Guide

Provided alongside the eSigner installation package

Describes how to install eSigner 6 and perform certain end-user tasks.

Release Notes (this document)

Provided alongside the eSigner installation package

Describes the features and environments supported in eSigner 6.

EULA Appears during installation when asked to accept terms and conditions

Describes the End User License Agreement – the terms and condition of use for eSigner 6.

Documents

eSigner 6.0 for Mac OS X Release Notes - web.3tweb.3t-europe.com/downloads/MacOSX/eSigner_Mac_6_0_5_Release… · Classic Client 6.3.5 - 002 for Mac Mountain Lion OS X. 6 ... The