Cyberflex Access Cards Programmer's Guide. Cyberflex Access Software Development Kit 4.3. (2002-06)

Preface

P.1 Who Should Use This Guide

P.2 What Is in This Guide

P.3 Document Conventions

P.4 Acronyms

P.5 Other Sources of Information

1.1 Elements Found by Default on a New Card

1.1.1 Applications

1.1.2 Security Domains

1.1.3 Card Manager

1.2 Secure Channels

1.2.1 Stages in a Secure Channel Session

1.2.2 Security Levels for Secure Channels

1.3 Keys and Key Sets

1.3.1 Uses for Keys

1.3.2 Default Key Set

1.3.3 Session Keys and Static Keys

1.4 Application Privileges

1.4.1 Privileges and Attributes Specified in the Application Privileges Byte

1.4.2 Working with the Application Privileges Byte

1.5 DAP Verification

1.5.1 How Verification Requirements Are Set

1.5.2 Types of DAP Verification Supported

1.5.3 MAC Verification

1.5.4 MAC+Enc Verification

1.6 Life Cycle States and Transitions

1.6.1 Card Life Cycle States and Transitions

1.6.2 Applet Instance Life Cycle States and Transitions

1.6.3 Load File Life Cycle States and Transitions

1.6.4 Security Domain Life Cycle States and Transitions

1.6.5 Terminology

1.7 Other Card Elements

1.7.1 Global PIN

1.7.2 Card Production Life Cycle (CPLC) Data

1.7.3 Card Issuer and BIN Data

2 Guide to Using the Card Commands

2.1 Personalizing the Card

2.1.1 Roadmap for Personalizing a Card

2.2 Using Secure Channels

2.2.1 Establishing a Secure Channel

2.3 Working with Keys and Key Sets

2.3.1 Setting the Security Level for a Secure Channel Session

2.3.2 Data Authentication Patterns Supported

2.3.3 Protected Commands

2.3.4 Adding a Key Set to the Card

2.3.5 Retrieving Key Set Data

2.3.6 Changing Key Values and Key Set Version Numbers

2.4 Adding and Working with Card Applications

2.4.1 Creating an Applet Instance

2.4.2 Deleting Load Files and Applet Instances

2.4.3 Selecting an Application

2.4.4 Making an Application Selectable or Selected By Default

2.4.5 Blocking, Locking, and Terminating Card Elements and Cards

2.5 Working with Card Status and Other Data

2.5.1 Retrieving Life Cycle State Data

2.5.2 Changing the Life Cycle State of an Application

2.5.3 Retrieving Card Production Life Cycle Data

2.5.4 Adding and Updating Card Production Life Cycle Data

2.5.5 Retrieving Card Issuer Data or Card Issuer BIN Data

2.5.6 Adding and Updating Card Issuer Data and Card Issuer BIN

2.5.7 Updating AID Values

2.5.8 Adding and Updating the Global PIN

2.5.9 Other Data You Can Retrieve from the Card

2.6 Encrypting and Decrypting Commands

2.6.1 MAC Verification

2.6.2 MAC+Enc Verification

3 Card Commands

3.1 Introduction

3.2 Command Overview

3.3 Overview of Status Words

3.4 Delete

3.4.1 Example

3.4.2 Response Data

3.5 ExternalAuthenticate

3.5.1 Host Cryptogram Calculation

3.5.2 Example

3.6 GetData

3.6.1 Example

3.6.2 CPLC Response Data

3.6.3 Issuer BIN Response Data

3.6.4 Card Issuer Response Data

3.7 GetStatus

3.7.1 Example

3.7.2 Response Data

3.8 InitializeUpdate

3.8.1 Key Diversification

3.8.2 Example

3.8.3 Responce Data

3.8.4 Card Cryptogram Calculation

3.9 Install

3.9.1 Input Data for Adding a Load File to the Card

3.9.2 Input Data for Installing an Applet Instance

3.9.3 Input Data for Installing a Security Domain

3.9.4 Input Data for Making an Application Selectable

3.9.5 Example

3.9.6 Response Data

3.10 Load

3.10.1 Response Data

3.10.2 Format of Input Data: No Verification

3.10.3 Format of Input Data: First Block Verified

3.10.4 Format of Input Data: Final Block Verified

3.11.1 Format of Input Data

3.11 PinChange

3.12 PutData

3.13 PutKey

3.13.1 Format of Input Data

3.13.2 Response Data Returned by the Card

3.13.3 Key Encryption Mechanism

3.13.4 Key Check Value Processing

3.14 SelectApplication

3.14.1 Example

3.14.2 Response Data (Card Manager or Other Security Domain Selected)

3.14.3 Response Data (Applet Instance Selected)

3.15 SetStatus

3.15.1 Example

4 Working with Card Applets

4.1 Guidelines for Developing Applets

4.1.1 Card Resource Limitations

4.1.2 Java Card Development Requirements

4.1.3 General Programming Guidelines

4.1.4 Smart Card Development in a Multi-Application Environment

4.2 Roadmap for Developing a Card Applet

4.3 Writing a Sample Card Applet

4.3.1 Overview of the Sample Applet

4.3.2 Creating the Sample Applet

4.4 Converting Source Code to a Card Application

4.4.1 Step 1: Compile the Source Code

4.4.2 Step 2: Convert the Class File to a Program File

4.4.3 Step 3: Download the Program File as a Load File

4.4.4 Step 4: Instantiate the Applet

4.5 Sending APDU Commands to the Sample Application

5 Java Card 2.1.1 API Support

5.1 Support for the javacard.framework Package

5.2 Support for the javacard.security Package

5.3 Support Status for the javacardx.crypto Package

Appendix A Command Conventions and APDU Basics

A.1 Command Description Table Components

A.2 TPDU Protocol

A.3 ISO Protocol Basics

A.3.1 Case 1: No Input or Output

A.3.2 Case 2: Receive Mode

A.3.3 Case 3: Send Mode

A.3.4 Case 4: Send/Receive Mode

Appendix B Status Words