Präambel: Die Humboldt-Universität zu Berlin, Unter den Linden 6, 10099 Berlin, im Folgenden als Humboldt-Universität bezeichnet, stellt für die Anwendung im Zusammenhang mit deutschen hoheitlichen Dokumenten, wie beispielsweise den neuen Personalausweis und den elektronischen Aufenthaltstitel, eine clientseitige eID-Basis-Software zum Bereitste…
Switch branches/tags
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
OpenSSL @ 43f277e


All relevant information about the eIDClientCore can be found at:

Warning: This is just proof-of-concept code and should NOT be used in production environments

Stories in Ready

Tested platforms:

  • Windows
  • Linux
  • Mac OS X
  • Android
  • iOS
  • Travis CI (Ubuntu Linux) Build Status


C library interface

For using eIDClientCore applications should use eIDClientCore.h The application initiates the electronic identification by calling nPAeIdPerformAuthenticationProtocol. To enter the PIN, the application shall define a user interaction call back. Also, the state call back informs the application about completed protocol steps.

The application may also choose to use eIDClientConnection.h which, by default, is basically a wrapper around libcurl. However, you may want to choose to replace the implementation of eIDClientConnection with a wrapper to your platform dependent solution.

JNI wrappers for Android

For android we build JNI wrappers to our C++ implementation. The public Java interface is accessed through the EidClient class Electronic identification is triggered similar to its C-counterpart. Additionally the Android application has to pass an implementation of the Reader class to do the actual communication with the card.

Building for Linux

First you have to download the eIDClientCore Git-Repository in your target intstallation directory:

git clone

You can then change in the eIDClientCore directory and install the prerequisites and the eIDClientCore by:

cd eIDClientCore
make all

If you want to install manually you can use the following guide. We assume that PREFIX is set to the directory eIDClientCore in the target installation directory.

Compiling Prerequisites from source

eIDClientCore has the following dependencies:

  • Crypto++
  • asn1c (at least version 0.9.23)
  • libexpat
  • PC/SC development files (if PC/SC smart card readers shall be used)
  • OpenSSL patched for RSA-PSK
  • libcurl (using the patched OpenSSL)


svn checkout cryptopp
sed -e "s%^#.*\(CXXFLAGS += -fPIC.*\)%\1%g" ${PREFIX}/cryptopp/GNUmakefile
make -C cryptopp all
make -C cryptopp install PREFIX=${PREFIX}

You can skip compilation of Crypto++ when using your distributions version of the library.


wget --ca-certificate=trusted_ca/COMODORSADomainValidationSecureServerCA.pem
tar xzf asn1c-0.9.24.tar.gz
cd asn1c-0.9.24
./configure --prefix=${PREFIX}
make install
cd -

If you want to use your distributions version of asn1c you will propably have to edit eidasn1's You need to change the commented lines so that they meet the version of asn1c.


echo "b08197d146930a5543a7b99e871cba3da614f6f0 expat-2.1.0.tar.gz" | sha1sum -c -
tar xzf expat-2.1.0.tar.gz
cd expat-2.1.0
./configure --prefix=${PREFIX}
make install
cd -

You can skip compilation of libexpat when using your distributions version of the library.


cd ${PREFIX}/OpenSSL_1_0_2-stable 
git submodule init 
git submodule update 
./config --prefix=${PREFIX} shared 
make install_sw 

OpenSSL is the only library that needs to be patched since it does currently not support RSA-PSK.


tar xzf curl-7.44.0.tar.gz
cd curl-7.44.0
./configure --prefix=${PREFIX} \
make install
cd -

If you want to use your distributions version of curl will need to make sure it uses the patched version of OpenSSL at runtime (see above).


To build the SimpleClient wxWidgets (Release >= 3.0.0) is required. The name of the required package in OpenSuse is wxWidgets-3_0-devel. Alternatively wxWidgets can be downloaded and compiled manually (

tar -xjf wxWidgets-3.1.0.tar.bz2 
cd wxWidgets-3.1.0
mkdir gtk-build
cd gtk-build
../configure --enable-unicode --enable-debug --prefix=${PREFIX}
make > /dev/null
make install
cd -

Compiling eIDClientCore from source

git clone
cd eIDClientCore
autoreconf -vis
env LD_LIBRARY_PATH=${PREFIX}/lib:${PREFIX}/lib64 ./configure --prefix=${PREFIX} \
    --with-openssl=${PREFIX} --with-libcurl=${PREFIX} \
    PKG_CONFIG_PATH=${PREFIX}/lib/pkgconfig:${PREFIX}/lib64/pkgconfig \
make install
cd -

Building for Android

We added a Makefile to automatically build eIDClientCore and its prerequisites for android. We assume that ANDROID_NDK_ROOT and ANDROID_SDK_ROOT are set to the root directory of Android's SDK and NDK respectively. Also, asn1c and ant should be available in the PATH.

git clone
cd eIDClientCore/android

On successfull compilation you can find a jar-file containing the library in eIDClientCore/android. Building for android has been verified on Debian/Wheezy with android-ndk-r9 and adt-bundle-linux-x86-20130729.

  • ANDROID_API defines the Android API version to use, we choose 'android-14' as default
  • ANDROID_ARCH defines the architecture to use, we choose 'arm' as default

Including the library in your Android project

To use the library in your project, you have two possibilities:

  1. Add eIDClientLib/bin/classes.jar to your build path and copy the following listed shared objects into your libs/armeabi folder:

  2. Reference the library with the android tools (see Android documentation). In this case all necessary files are copied automatically.

android update project \
  --path path/to/your/project \
  --library path/to/eiDClientLib

##Android example app


  • Add abstraction layer between ePACard and cryptographic functions
  • Remove unused/bloated interfaces
  • Check try...catch block around C-Interfaces
  • use OOP in nPA-EAC
  • Check the hash of the SSL/TLS certificate from the SP with the SP's Terminal certificate
  • Check if the Terminal certificate is up to date
  • Check the Subject URL of the Terminal certificate
  • remove the use of exceptions