From 1f47de655ef74db39de98dec86d0423c83533322 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Gonz=C3=A1lez?= Date: Wed, 5 Aug 2026 13:03:59 +0200 Subject: [PATCH 1/3] Expand Spanish DNIe background and versions, mention NFC interface Despite OpenSC working with DNIe 3.0 and 4.0 ID cards when used through their contact interface, the documentation for those versions has not been kept up to date, still referencing first-generation DNIe / DNI 2.0 cards that have not been issued to citizens for more than 10 years. These changes expand the DNIe documentation to mention the newer DNIe 3.0 and 4.0 iterations, which are largely similar in their wire protocol to older DNIe cards, while incorporating a secondary NFC interface that is not functional in OpenSC at the moment and has been quite sparsely documented. These additions summarize the background I've came to know after hands-on testing of a DNIe 4.0 card issued 2 years ago, which I tried to use through its NFC interface with OpenSC to no avail. While at it, I've elevated the support category of the Spanish eID card above unsupported, because I consider that OpenSC's support for its contact interface on its different versions goes beyond "incomplete, broken, or largely useless" and is mostly on par with e.g. that of the Italian eID. In fact, after reverse-engineering the official PKCS#11 DNIe module for contact interface support, I found it matches the almost the same ATRs, with a single extra ATR not covered by OpenSC that doesn't seem relevant in practice to me, and might match the missing uninitialized case mentioned in the DNIe card driver code comments. Moreover, the lack of contactless interface support does not seem to be a reason against this reclassification given that the supported hardware list begins with a disclaimer about OpenSC only working with contact interfaces unless otherwise noted. --- DNIe-(OpenDNIe).md | 15 +++++++++++---- ...orted-hardware-(smart-cards-and-USB-tokens).md | 2 +- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/DNIe-(OpenDNIe).md b/DNIe-(OpenDNIe).md index 0c5cddf..ccb0dfd 100644 --- a/DNIe-(OpenDNIe).md +++ b/DNIe-(OpenDNIe).md @@ -1,23 +1,30 @@ # DNIe (OpenDNIe) -Support for DNIe cards got merged by code from the OpenDNIe fork, by pull request #168. The code is now in Master. OpenSC does not support the Spanish Ceres cards. +Support for DNIe cards got merged by code from the OpenDNIe fork, by pull request #168. The code is now in Master. OpenSC does not support the Spanish Ceres cards, neither DNIe 3.0 or newer cards when used through its contactless (NFC) interface. ## DNIe background [DNIe](https://sede.sepe.gob.es/portalSede/en/firma-electronica/DNI-electronico) is one of the SpanishEid-s. Historically, there exists a patch for OpenSC which adds support for DNIe in OpenSC. -There were two different OpenSC implementations for Spanish National eID card (DNIe) support -* The official one provided by *Spanish irección General de la policía y de la Guardia Civil (DGP)* was based in OpenSC-0.11.8, released under GPLv3. It's not being currently maintained. +There were two different OpenSC implementations for first-generation Spanish National eID card (DNIe / DNI 2.0) support: + +* The official one provided by *Spanish Dirección General de la Policía y de la Guardia Civil (DGP)* was based in OpenSC-0.11.8, released under GPLv3. It's not being currently maintained. * *OpenDNIe* was an alternate LGPL implementation, written from scratch based on several documents and forums around DNIe. -From the public administration point of view the card has been procured by the Ministry of Interior (DGP's DNIe office), The chip card is a ST19WL34 provided by ST Microelectrónics and software has been procured by Fabrica Nacional De Moneda y Timbre (FNMT-RCM). +From the public administration point of view the card has been procured by the Ministry of Interior (DGP's DNIe office). The card chip is a ST19WL34 provided by ST Microelectronics, and its software has been procured by Fábrica Nacional De Moneda y Timbre (FNMT-RCM). * The DNIe card software is closely related to FNMT's Ceres card, being very similar in structure and design. * OpenDNIe is copyright 2011 of Juan Antonio Martinez ([GitHub](https://github.com/jonsito)). +In 2015, the DGP began issuing DNIe 3.0 cards. These cards feature an Infineon Technologies SLE78CLFX408AP dual-interface chip, enabling contactless operation via NFC. In practice, however, the NFC interface has been used almost exclusively by proof-of-concept Android applications distributed by CNP-FNMT through Google Play and the Spanish DNIe website, and a LGPLv3-licensed example Android app SDK. Among these, the DNIeRemote application is particularly relevant to OpenSC development, as it allows a computer to access a DNIe 3.0 card through the NFC interface of a smartphone, eliminating the need for a dedicated smart card reader, like the [Remote Smart Card Reader app provided by the vsmartcard project](https://frankmorgner.github.io/vsmartcard/remote-reader/README.html). Currently, both OpenSC and the DGP-distributed PKCS#11 DNIe module only supports DNIe 3.0 cards through the traditional contact interface, and cannot work with vsmartcard's Remote Smart Card Reader due to the different wire protocol of the NFC interface. + +In 2021, the DGP began issuing DNIe 4.0 cards. According to [official sources](https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?pag=REF_110), this version is primarily a visual refresh of the DNIe 3.0, introduced to comply with EU Regulation 2019/1157. + Resources: * The [official home page](http://www.dnielectronico.es) for the Spanish DNIe +* The [official page for the Spanish DNIe 3.0/4.0 electrical specifications](https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?pag=REF_083) +* [A technical specification sheet for the Spanish DNIe 3.0/4.0](https://www.dnielectronico.es/PDFs/CARACTERISTICAS_TECNICAS_DNIe_3.0.pdf) under the official home page domain ## Card capabilities diff --git a/Supported-hardware-(smart-cards-and-USB-tokens).md b/Supported-hardware-(smart-cards-and-USB-tokens).md index 3c44b60..11c3bae 100644 --- a/Supported-hardware-(smart-cards-and-USB-tokens).md +++ b/Supported-hardware-(smart-cards-and-USB-tokens).md @@ -17,6 +17,7 @@ Supported eID cards: * [ItalianEid](Italian-Infocamere) * [EstonianEid](Estonian-eID-(EstEID)) * [PortugueseEid](Portuguese-eID) +* [Spanish eID](Spanish-Ceres-DNIe) * [US CAC](US-CAC) * [UruguayanEid](Uruguayan-eID) @@ -84,7 +85,6 @@ Unclear/unsupported eID cards: * [Belgian eID](Belgian-Belpic) * [German EGK](German-eHBA,-eGK) * Malaysian MyKAD -* [Spanish eID](Spanish-Ceres-DNIe) * [Austrian eID](Austrian-"Bürgerkarte") * Italian Postecert * [Swedish BankID](Swedish-BankID) From 0f5b936285f190103b5d2d9c8e9446ef867f204c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Gonz=C3=A1lez?= Date: Wed, 5 Aug 2026 14:36:31 +0200 Subject: [PATCH 2/3] Mention usage of PACE for DNIe NFC channel, back it up with a paper --- DNIe-(OpenDNIe).md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/DNIe-(OpenDNIe).md b/DNIe-(OpenDNIe).md index ccb0dfd..14d143b 100644 --- a/DNIe-(OpenDNIe).md +++ b/DNIe-(OpenDNIe).md @@ -16,7 +16,7 @@ From the public administration point of view the card has been procured by the M * The DNIe card software is closely related to FNMT's Ceres card, being very similar in structure and design. * OpenDNIe is copyright 2011 of Juan Antonio Martinez ([GitHub](https://github.com/jonsito)). -In 2015, the DGP began issuing DNIe 3.0 cards. These cards feature an Infineon Technologies SLE78CLFX408AP dual-interface chip, enabling contactless operation via NFC. In practice, however, the NFC interface has been used almost exclusively by proof-of-concept Android applications distributed by CNP-FNMT through Google Play and the Spanish DNIe website, and a LGPLv3-licensed example Android app SDK. Among these, the DNIeRemote application is particularly relevant to OpenSC development, as it allows a computer to access a DNIe 3.0 card through the NFC interface of a smartphone, eliminating the need for a dedicated smart card reader, like the [Remote Smart Card Reader app provided by the vsmartcard project](https://frankmorgner.github.io/vsmartcard/remote-reader/README.html). Currently, both OpenSC and the DGP-distributed PKCS#11 DNIe module only supports DNIe 3.0 cards through the traditional contact interface, and cannot work with vsmartcard's Remote Smart Card Reader due to the different wire protocol of the NFC interface. +In 2015, the DGP began issuing DNIe 3.0 cards. These cards feature an Infineon Technologies SLE78CLFX408AP dual-interface chip, enabling contactless operation via NFC through a PACE channel, which requires a card-printed CAN to be established. In practice, however, the NFC interface has been used almost exclusively by proof-of-concept Android applications distributed by CNP-FNMT through Google Play and the Spanish DNIe website, and a LGPLv3-licensed example Android app SDK. Among these, the DNIeRemote application is particularly relevant to OpenSC development, as it allows a computer to access a DNIe 3.0 card through the NFC interface of a smartphone, eliminating the need for a dedicated smart card reader, like the [Remote Smart Card Reader app provided by the vsmartcard project](https://frankmorgner.github.io/vsmartcard/remote-reader/README.html). Currently, both OpenSC and the DGP-distributed PKCS#11 DNIe module only supports DNIe 3.0 cards through the traditional contact interface, and cannot work with vsmartcard's Remote Smart Card Reader due to the different wire protocol of the NFC interface. In 2021, the DGP began issuing DNIe 4.0 cards. According to [official sources](https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?pag=REF_110), this version is primarily a visual refresh of the DNIe 3.0, introduced to comply with EU Regulation 2019/1157. @@ -25,6 +25,7 @@ Resources: * The [official home page](http://www.dnielectronico.es) for the Spanish DNIe * The [official page for the Spanish DNIe 3.0/4.0 electrical specifications](https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?pag=REF_083) * [A technical specification sheet for the Spanish DNIe 3.0/4.0](https://www.dnielectronico.es/PDFs/CARACTERISTICAS_TECNICAS_DNIe_3.0.pdf) under the official home page domain +* [A paper discussing implementation details and a security assessment of the Spanish DNIe 3.0/4.0 contactless interface](https://webdiis.unizar.es/~ricardo/files/papers/RG-IFS-17.pdf) ## Card capabilities From dabd822c1f21972acb11ca6ec274f2bc789b137d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Gonz=C3=A1lez?= Date: Wed, 5 Aug 2026 14:40:21 +0200 Subject: [PATCH 3/3] Use better link for the DNIe contactless interface analysis paper --- DNIe-(OpenDNIe).md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DNIe-(OpenDNIe).md b/DNIe-(OpenDNIe).md index 14d143b..444de7a 100644 --- a/DNIe-(OpenDNIe).md +++ b/DNIe-(OpenDNIe).md @@ -25,7 +25,7 @@ Resources: * The [official home page](http://www.dnielectronico.es) for the Spanish DNIe * The [official page for the Spanish DNIe 3.0/4.0 electrical specifications](https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?pag=REF_083) * [A technical specification sheet for the Spanish DNIe 3.0/4.0](https://www.dnielectronico.es/PDFs/CARACTERISTICAS_TECNICAS_DNIe_3.0.pdf) under the official home page domain -* [A paper discussing implementation details and a security assessment of the Spanish DNIe 3.0/4.0 contactless interface](https://webdiis.unizar.es/~ricardo/files/papers/RG-IFS-17.pdf) +* [A paper discussing implementation details and a security assessment of the Spanish DNIe 3.0/4.0 contactless interface](https://ietresearch.onlinelibrary.wiley.com/doi/full/10.1049/iet-ifs.2017.0299) ## Card capabilities