PC/SC and contactless card ATS

I was recently puzzled by the different ATS values returned by my Omnikey Cardman 5321 (connected to PC) and my NXP PN531 (connected to embedded system). I tried with both the Nokia 6131 NFC and an NXP JCOP31 smart card; here's what the output looked like (all hex):

Nokia 6131 ...
... with PN531:

SENS_RES    0200
SEL_RES     38
NFCIDLENGTH 4
NFCID1      5039F5A8
ATS         0D 78 80 84 02 00 73 C8 40 13 00 90 00            .x....s.@....

... and with Cardman 5321:

(same NFCID1)
ATR         3B 88 80 01 00 73 C8 40 13 00 90 00 71

Smart card:
... with PN531:

SENS_RES    0400
SEL_RES     28
NFCIDLENGTH 4
NFCID1      E0742A86
ATS         0D 38 33 B1 4A 43 4F 50 33 31 56 32 32            .83.JCOP31V22

... and with Cardman 5321:

(again, NFCID1 is similar)
ATR         3B 89 80 01 4A 43 4F 50 33 31 56 32 32 4A

After scratching my head for a while I gave in and RTFM for the Cardman reader. And I was reminded again that glossing over details is never good, because in fact ATS != ATR. The PC/SC standard (PC/SC v2.01 “Interoperability Specification for ICCs and Personal Computer Systems”) requires that the driver convert the received ATS to an ATR.

The PC/SC specifications can be downloaded here.

OpenSC Project

New resource found, OpenSC Project :

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS#11 API so applications supporting this API (such as Mozilla Firefox and Thunderbird) can use it. On the card OpenSC implements the PKCS#15 standard and aims to be compatible with every software/card that does so, too.

In the Java section there are useful tips and links about JNI for PKCS#11, javax.smartcardio, PKCS#15 and GlobalPlatform.

Smart cards: The commercial project perspective

I came across a website containing very useful information for smart card projects: http://www.smartcardbasics.com/

It is an excellent starting point and reference source for any project leader since it contains - among other things - overviews of standards (ISO7816, FIPS120, EMV etc), smart card system planning, and security (systems, infosec, cryptography, and more).

OSS jcManager

I came across this useful open source tool for managing JCOP cards:
http://www.brokenmill.com/2010/03/java-secure-card-manager/


From the project homepage:

Motivation:
Some time ago there was a JCOP tools plugin for the eclipse IDE developed by IBM labs in Zurich but it is no longer available.

Features:
- low-level implementation according to GobalPlatform Card Specification
- supports both SCP01 and SCP02 card protocols
- open source
- cross-platform
- display detailed debug information to be able to understand the complex low-level operations – derivations, encryptions, padding, etc
- uses the musclecard pcsc java implementation for the low-level communication with readers/cards. Also, it is fully compatible with the IBM JCOP implementation - if you do have the offcard.jar library from IBM it will also seamlessly work with it.
- works with the majority of card readers (pcsc compatible). Tested with Schlumberger, Omnikey, etc

It's early days for this project but it looks very promising.

RFID Zapper

Easy, cheap, portable way to fry RFID tags: Rfiddler

Original article here.

"The gun was fabricated using a Nerf N-Strike Recon CS-6, with a 0.6 kilojoule camera flash driving a 50-turn copper spool."

It seems simple enough.

Implications:
1) Easy theft - "disappear" tagged items.
2) Easy impersonation - no interference from existing tags.

Applications:
Commercialisation on the grey market for use by crime syndicates: firstly, stealing from RFID-automated warehouses and dispatch centres; secondly, re-routing shipped items; thirdly, changing tariffs on shipped items; fourthly, clearing shipping containers illegally; fifthly, passport/ID disabling.

Moral of the story: beware taking the human out of the decision loop because you never know when they will become necessary again.

JCOP performance

Interesting and relevant to real-world implementation: JCOP performance differs between revisions.

Update on Java Card GDIs

For what it's worth, here are the most popular options currently available to Java Card developers:

• eclipse-jcde 0.1: Free plugin for Eclipse wrapping the Sun Java Card Development Kit. Use with Eclipse 3.5 (JDK1.5 or later) and JCDK 2.2.2 Classic , Java Card 2.2.2, GlobalPlatform 2.2 (including JC Export file 1.3). The GlobalPlatform API may also be useful for manually or programatically communicating with a smart card. If your target is Java Card 3.0, use Netbeans and JCDK3.0.1 instead.
  Note: a useful off-card interface for Java is Global Platform for Java SmartCardIO.
  
• Netbeans IDE 6.7: Free; use with Sun JCDK 3.0.1 Connected Edition.
• JCOP Tools 3.1.2: Free devkit from NXP (proprietary, requires an NDA). Use with Eclipse 3.3 (JDK1.4.2 or 1.5 only). Target OS is JCOP 2.2 (?). Includes libraries from GlobalPlatform 2.1.1, Java Card 2.2.1. Not all ECC functions (Java Card) are represented in the simulator.
  
• JCOP Tools 3.2.8: Latest version; free from NXP (proprietary, requires an NDA). Use with Eclipse 3.5 (JDK1.6). Target OS is JCOP 2.4.1 (supporting Java Card 2.2.2 and GlobalPlatform 2.1.1), and possibly JCOP 2.4.2 (Java Card 3.0, GlobalPlatform 2.2). Simulator includes most of the Java Card functionality.
• Giesecke&Devrient Sm@rtCafe Professional Toolkit 2.0: free demo. Supports Java Card 2.2.1 and GlobalPlatform 2.1.1; target OS is G&D Sm@rtCafe 3.x.

If there are more, please notify me.