Token and Smart-Card Workflows

import CryptoTokenKit

final class TokenDriver: TKSmartCardTokenDriver,
                         TKSmartCardTokenDriverDelegate {
    func tokenDriver(
        _ driver: TKSmartCardTokenDriver,
        createTokenFor smartCard: TKSmartCard,
        aid: Data?
    ) throws -> TKSmartCardToken {
        try Token(
            smartCard: smartCard,
            aid: aid,
            instanceID: "com.example.token:\(smartCard.slot.name)",
            tokenDriver: driver
        )
    }
}

NSExtension
  NSExtensionAttributes
    com.apple.ctk.driver-class = $(PRODUCT_MODULE_NAME).TokenDriver
  NSExtensionPointIdentifier = com.apple.ctk-tokens

sudo -u _securityagent /Applications/TokenHost.app/Contents/MacOS/TokenHost

final class TokenSession: TKSmartCardTokenSession, TKTokenSessionDelegate {
    func tokenSession(
        _ session: TKTokenSession,
        supports operation: TKTokenOperation,
        keyObjectID: TKToken.ObjectID,
        algorithm: TKTokenKeyAlgorithm
    ) -> Bool {
        switch operation {
        case .signData:
            algorithm.isAlgorithm(.rsaSignatureDigestPKCS1v15SHA256)
                || algorithm.isAlgorithm(.ecdsaSignatureDigestX962SHA256)
        case .decryptData:
            algorithm.isAlgorithm(.rsaEncryptionOAEPSHA256)
        case .performKeyExchange:
            algorithm.isAlgorithm(.ecdhKeyExchangeStandard)
        default:
            false
        }
    }
}

guard let manager = TKSmartCardSlotManager.default else { return }

for name in manager.slotNames {
    manager.getSlot(withName: name) { slot in
        guard let slot,
              slot.state == .validCard,
              let card = slot.makeSmartCard() else { return }
        communicate(with: card)
    }
}

func selectApplication(card: TKSmartCard, aid: Data) throws {
    try card.withSession {
        let (statusWord, _) = try card.send(
            ins: 0xA4,
            p1: 0x04,
            p2: 0x00,
            data: aid,
            le: nil
        )
        guard statusWord == 0x9000 else {
            throw TKError(.communicationError)
        }
    }
}

@available(iOS 26.0, iPadOS 26.0, *)
func readContactlessCard() {
    guard let manager = TKSmartCardSlotManager.default,
          manager.isNFCSupported() else { return }

    manager.createNFCSlot(message: "Hold card near iPhone") { session, error in
        guard let session else {
            handleNFCError(error)
            return
        }
        defer { session.end() }

        guard let slotName = session.slotName,
              let slot = manager.slotNamed(slotName),
              let card = slot.makeSmartCard() else { return }
        communicate(with: card)
    }
}

import Security

func tokenKey(tokenID: String) throws -> SecKey {
    let query: [String: Any] = [
        kSecClass as String: kSecClassKey,
        kSecAttrTokenID as String: tokenID,
        kSecReturnRef as String: true
    ]
    var result: CFTypeRef?
    let status = SecItemCopyMatching(query as CFDictionary, &result)
    guard status == errSecSuccess, let key = result else {
        throw TKError(.objectNotFound)
    }
    return key as! SecKey
}