In GlobalPlatform 2.2 and earlier, the API method GPSystem.setATRHistBytes allowed me to change the Historic Bytes for both contact and contactless interfaces.
However, in GlobalPlatform 2.3 that method has been altered, and now only changes the Historic Bytes for the contact interface. Those for the contactless interface remain unchanged by it.
So far, I haven't found a replacement method in any of the GlobalPlatform API packages (including the contactless extensions) which would allow me to continue changing the contactless historic bytes.
Does anyone know is this is still possible, or if not, why it has been removed from the API? I assume there must be a good reason!
Related
I'm going to write a Java Card applet to convert my card into an EMV compliant card.
1- The question is how can I do that?
As far as I know, there are four EMV specifications known as EMV Books which contain principles of EMV cards (Chip characteristics, file structure and also the list of APDU commands). Do I need any other specifications to implement my applet or these are all I need? If there are some other specifications which I need, are they freely available or they are proprietary?
2- Do EMV cards have an specific Applet AID?
EFT-Lab provided a good list of applet AIDs. As you see below, there are a lot of AIDs which belong to Visa International (as vendors) that all are "EMV" types. Why does Visa International have a lot of different AIDs for its EMV applets? What's the difference between these applets?
3- Is there any open source EMV applet? Is there any Java Card that has an EMV applet/package by default?
4- Is there any specific difference between contact and contactless EMV cards? (I mean in the file-structure or in the APDU commands)
1- The question is how can I do that?
Yes. Implement the specifications. If there are any other requirements (and surely there will be) then they should be referenced in the specs.
2- Do EMV cards have an specific Applet AID?
Because they offer specific functionality? You may even have multiple applications on the same card. Note that it is possible to select applications using a partial AID (see how the Debit & Credit card partially match). The VISA specific cards are likely used internally only, e.g. when servicing cash machines.
3- Is there any open source EMV applet? Is there any Java Card that has an EMV applet/package by default?
Not likely. It would be rather unusable because it would require EMVCo security evaluation to be accepted. So you need some kind of payment structure to pay for certification and audits. No open source initiative is likely to pony up the cash up front.
Often these kind of implementations require techniques to avoid vulnerabilities that need to remain secret; smart cards do not offer perfect security after all. That's perpendicular to open sourcing an implementation. So if there is anything out there it must be created out of academic interest (e.g. for testing the security of the protocol, proof of concept etc.).
4- Is there any specific difference between contact and contactless EMV cards? (I mean in the file-structure or in the APDU commands)
Generally it is more about which parts of the applet are available or not. The fact that most applets can be used in dual mode probably speaks for itself otherwise.
This paper seems to have a good introduction to the possible differences.
Is there any open source EMV applet? Is there any Java Card that has
an EMV applet/package by default?
Was working on a similar project and found this github repo. According to the owner:
This is a fully working EMV applet for javacard 2.2.1.
what's the current use of java cards? The documentation is either really old or really sparse.
After googling for some time, this is my perceived idea:
eID: signing document hash with private key, issued by central authority (government) - signing legal documents
unique ID - identification (of person) by ID, protected by PIN and secured by TLS
java connected edition web application - I've not been able to find any documentation for the usage of this, except template applications in IDEs. Why are APDU's still used when there's this layer available? Is the application for this non-existent?
Despite all the new functionalities, I see they're only used as identification for a central repository/provider? And the TLS is used to secure communication between the card and backend server?
Thanks.
SIM cards are usually Java Cards, banking cards from Mastercard and Visa are usually Java card, and so are many others. ePassports can be build using Java Card. There are secure elements within readers that are Java Card. Driver licenses, driver licenses, digital tachograph cards, access control cards, cards holding PGP keys, etc. etc. etc..
There are billions of Java Cards, and Java Card is the only reason why Java was claimed by Sun to be on 3 billion devices (and note that they will probably not count Android as that officially is not Java). Currently the JCF (Java Card Forum) is also pushing Java Card forward as secure / programmable element to be used in IoT devices.
eID can be and usually is used more than for just signing documents. It is mainly used for authentication. It may also be used just to verify specific attributes of a person such as his / her age. And it can of course be used to decrypt information if an encryption key pair is present.
So no, there are many more things that Java Card can be used for.
As for the connected edition: it requires highly expensive hardware (smart cards are products that rely on high volume where every cent matters). Furthermore, a lot of protocols are specified using APDU's: you cannot just replace that with HTTPS to the smart card without respecifying the protocols.
ISO/IEC 7816-4 is a horrible standard - if you can call it that - but it currently is the only broadly accepted one. Java Card RMI has not caught on either; I don't see why the connected edition will suddenly change that.
I've patched android with SEEK for Galaxy S3 and after some struggle I'm now able to send APDUs to SIM card and get proper responses.
I want to place my own applet inside SIM but since there is no way we can get the access to do so, I start to wonder if there is anyway we can issue a java card to work like a SIM card. All I need is a java card that the phone can't distinguish from a SIM, no network coverage is needed and I know it is almost impossible to create a SIM that works OK with operator and gives network coverage.
The reason for all this is I need to send APDUs and work with my applet, but if I insert a java card instead of a SIM card in GS3, it gives me no access at all.
So my question is this:
Is it possible to issue a java card so that it looks like a SIM by the phone (and not the operator)?
or Is it possible to change android so that it gives needed access when there is a java card in it, i.e. RIL works as usual?
EDIT
Okay, I think I'll try to issue a Java Card with following properties:
First, it will have an auto selected applet (default applet) that from now on will be call fake-UICC.
Second, in fake-UICC we'll emulate the file system of UICC (according to http://www.in2eps.com/fo-uicc/tk-fo-uicc-mf.html).
Third, since different class is used for SIM APDUs (0xA0) so All APDUs sent from RIL will be directed to fake-UICC by JCRE, since class+instruction is not recognized by normal Java Card. e.g. 0xA0A4 is select for SIM but 0x00A4 is select command for Java Card.
In last step, we will try to send exact same responses a real SIM would send to each APDU.
Maybe it won't work but I think it's worth a try.
SIM Card (UICC) accessed through SEEK is not the only secure element you can use in your cellphone.
On the market there are other Java Card solutions: mostly based on microSD slot (provided e. g. by GoTrust or Feitian Technologies), which you should be able to access through SEEK.
Some cellphones (Galaxy S3 is not this case, unfortunately) are equipped with a special secure element slot, which you can insert common smart card (mostly by Oberthur) into and access through SEEK (see http://www.nfcworld.com/technology/embedded-secure-element-ese/ for some devices with this feature).
There is an interesting article about SE options: http://nelenkov.blogspot.cz/2012/08/accessing-embedded-secure-element-in.html
If you know some other vendors offering microSD Java Card products, please write them down in comments and I will add them to my post. This answer is not supposed to be any advertisement for the companies mentioned above.
Well, Actually I'm not sure if this solution works or not, and as dear #Vojta mentioned in the comments under his answer I would like to discourage people from the following attempts. It will be difficult, time-consuming and probably with no useful results. He knows a lot more than me in this field.
Anyway, as you wanted I posted my suggestion:
Each file in the system file of the SIM/USIM card is linked to a hexadecimal number as its addresses (AID). These AIDs are defined in GSM and ETSI standards (GSM 11.11 for example). You can write some Javacard applets to simulate that system file.
As SIM/USIM card's AIDs are shorten than JavaCard AIDs, you might need to choose a Java Card that support partial AID selection and use this capability to refer incoming command to its associated applet.
I think you can simulate all the system file inside a single applet also and then make that applet default selected applet.
If you had any success with this solution, please inform us. :)
The GlobalPlatform smart-card standard defines irreversible state changes, such as card termination after too many failed authentications or initial card initialization. How does one learn about GlobalPlatform without burning through hundreds of smart-cards (which is expensive)?
Use a simulator. The JCOP toolset includes a simulator that runs within Eclipse, and implements GlobalPlatform commands.
When I've implemented e.g. the Secure Channel protocols myself, I compared the messages that my code generated with the messages generated by the simulator, using the default JCOP keys, until I was certain I had it right. It's just DES/3DES, but arranging the blocks to be encrypted/verified is tricky.
When I test against cards, I have a handful ready, and if authentication fails, I rotate cards, making sure that when I solve the problem I successfully authenticate against the cards with prior authentication failures.
I implemented GP Secure Channel protocols 01 and 02, and destroyed no more than two cards.
In addition the answer of pb2q, some cards may have additional access points next to the card manager which you may use to reset the card. Obviously, you need info on how to do it for a particular implementation, and quite possibly a key.
J2ME provides JSR 177 which has APIs to access the SIM as a smart card. I want to explore this more and see what all I can do with this, but, I cant find any documentation with respect to that. All documentation that I have found so far is very generic and only mentions how to access a smart card with the APDU APIs and not how I can use this to do anything on the SIM.
Any ideas on where to get started?
Mostly, JSR 177 is supposed to be used to extract the certificate that is on the SIM so you can encrypt/decrypt/sign data in a way that your MNO likes.
The difficulty in finding documentation comes from so few handset manufacturers having included a full JSR177 implementation in their phone.
That, in turn, presumably comes from the huge amount of external, security-related specs to read and understand before the JSR177 spec itself makes sense if you're not a cryptography protocols expert.
The TCK sources and supplemental Symbian/Nokia test code would be a good place to look but, unfortunately, none of that has been open-sourced yet.
Common commands like changing the SIM PIN code basically require an understanding of the binary protocol itself. Simply appending the correct sequence of bytes to an APDU GCF url will get it executed if the JSR177 implementation itself is correct.
If you have only looked at the Sun JavaME SDK, you should probably have a look at the APDU MIDlet example in the latest Series60 SDK and added documentation in Nokia's Java Developer's Library.