On the road to Bandol

Google has introduced a tool to search code, which has already been exploited for a variety of good and bad things. This thing can be very useful small communities like the Java Card community, because it can allow us to find code based on our technology on the Web.

The problem is to find the right query. After a few experiments, I found out that looking for import + javacard + framework yields very good results, with very few false positives. A search for OwnerPIN also worked quite well.

You can find many applications there. I have not included links, but you can find them easily:

• Many, many samples, even old iButton applications, including a CoinPurse.
• Implementations of the Identity Alliance and MuscleCard card-edge specifications.
• Many test applets from 3GPP.
• Of course, an EAP engine.
• A KerberosSecurityService, from IBM.
• An OCL description of OwnerPIN, from Chalmers.
• An AES implementation in Java Card.
• Many other fun things.

For the people who have worked on Java Card 2.2’s RMI and Service framework, we can even find a few things by adding rmi or BasicService to the query. However, there only are a few such applications, and most of them are from Martijn Oostdijk, a researcher in Nijmegen. Not much hope on that front, but we already knew that.

Finally, I have also looked for more interesting things, like banking and government applications, but I have had no success so far. The conclusion is that there is no real surprise: our industry remains very closed, which is good (no sensitive source on the Web) and bad (very few samples, except from researchers and students); (almost) nobody uses the Java Card 2.2 features; and Java Card is used in a few open source authentication projects.