Java Card applets access via web page, JavaScript and javax.smartcardio

Springcard blog describes an interesting way to access smart cards: via web browser, JavaScript and javax.smartcardio (PC/SC reader).

I'm in some doubt as to the usefulness of this... after all, a smart card is a trusted portable device and tying it down (leaving it in the reader connected to a PC) and making it directly accessible to the whole world via the internet (even if the webpage requires authentication) makes no sense.


Certainly, you could use this way for a mockup or demo where you need to authenticate directly to some TPM or HSM. But I don't see any commercial use-cases for this yet.

Contactless card + GUI = killer app.

This device from Toppan is a smart card with a built-in GUI: screen and buttons. It's not clear whether the card has on-board battery or whether the GUI is active only when the card is in the reader field. (Image used without permission.)

Nokia 6131/6212 - Crypto Capabilities

It looks like the secure chip in the Nokia NFC phones does not support Elliptic Curve Cryptography - RSA works fine though. I've tried to create ECC keypairs using NIST curve specifications SECP160K1 and SECT163K1 but the response is 0x6F03 (no such algorithm). However the latter curve does work (signature generation and verification OK) on my single and dual interface smart cards (JCOP20/JCOP30).

In my previous post I saw that the COS for the Nokia 6131 NFC is G&D SmartCafe Expert 3.1 In G&D's sparse public documentation and SmartCafe Expert 3.1 flyer only RSA is mentioned so I conclude ECC is definitely not supported. As an interesting side note, the flyer says the COS is JavaCard 2.2.1 compliant - which confirms a conclusion in an earlier post.


Since there are so few other mobiles with NFC I guess we'll have to wait for microSD cards with embedded NFC and secure elements which support ECC.

Secure Chip Identifier List

Useful resource: a list of ATR/ATS for secure chip ICs and their COSs. Mirror here.

From the list:

3B 88 80 01 00 73 C8 40 13 00 90 00 71
 Nokia 6131 NFC phone
 http://wiki.forum.nokia.com/index.php/Nokia_6131_NFC_-_FAQs
 Giesecke & Devrient’s (G&D) Sm@rtCafé Expert 3.1 

3B 8D 80 01 0D 78 80 84 02 00 73 C8 40 13 00 90 FF F8
 Nokia 6212 phone seen as NFC device
  

Edit: Rousseau also hosts a free Python ATR parsing service based on the list above.

I also found "Visa Approved Visa GlobalPlatform Card Products as of December 2007" which indicates the COS and IC vendor on VISA certified secure chips.
More (albeit slightly off-topic): "Visa Approved, Visa Smart Debit Credit (VSDC) Chip Cards as of December 2007"
A list of VISA-related documents can be found here (thanks to TwinTech and Google Translate).

Updated: JCOP feature info

Tracking back to a previous post where I listed features of NXP JCOP: NXP's linecard for PKI processors has been updated to document 75016728, including a new section about JCOP J2A and J3A (page 10).

Machine Readable Travel Documents

While hunting for info about file systems on Java Card I came across this very useful reference implementation of the ICAO MRTD standard by Radboud Uni. It demonstrates (among other things) how to wrap and unwrap SCP02 protected APDUs and how to chain object and byte arrays into a very rudimentary file system (see FileSystem.java).

PC/SC and contactless card ATS

I was recently puzzled by the different ATS values returned by my Omnikey Cardman 5321 (connected to PC) and my NXP PN531 (connected to embedded system). I tried with both the Nokia 6131 NFC and an NXP JCOP31 smart card; here's what the output looked like (all hex):

Nokia 6131 ...
... with PN531:

SENS_RES    0200
SEL_RES     38
NFCIDLENGTH 4
NFCID1      5039F5A8
ATS         0D 78 80 84 02 00 73 C8 40 13 00 90 00            .x....s.@....

... and with Cardman 5321:

(same NFCID1)
ATR         3B 88 80 01 00 73 C8 40 13 00 90 00 71

Smart card:
... with PN531:

SENS_RES    0400
SEL_RES     28
NFCIDLENGTH 4
NFCID1      E0742A86
ATS         0D 38 33 B1 4A 43 4F 50 33 31 56 32 32            .83.JCOP31V22

... and with Cardman 5321:

(again, NFCID1 is similar)
ATR         3B 89 80 01 4A 43 4F 50 33 31 56 32 32 4A

After scratching my head for a while I gave in and RTFM for the Cardman reader. And I was reminded again that glossing over details is never good, because in fact ATS != ATR. The PC/SC standard (PC/SC v2.01 “Interoperability Specification for ICCs and Personal Computer Systems”) requires that the driver convert the received ATS to an ATR.

The PC/SC specifications can be downloaded here.