Comments on: JC101-6C: Specifying the APDU’s

By: Eric VÃ©tillard

Eric VÃ©tillard — Tue, 25 Mar 2008 14:27:30 +0000

Dammit! 10 years in the smart card industry, and I still can’t write a TLV correctly … I did fix it, though.

By: Yalcin Akdogan

Yalcin Akdogan — Tue, 25 Mar 2008 11:15:29 +0000

Excellent tutorial. Thank you very much.

just one correction !
On TLV: length of F1 and F2 are changed.

F1 03 48 6F 6D 65 F2 04 62 6F 62 F3 04 70 61 73 73

correct TLV:
F1 04 48 6F 6D 65 F2 03 62 6F 62 F3 04 70 61 73 73

Best regards.

By: Eric VÃ©tillard

Eric VÃ©tillard — Thu, 24 Jan 2008 21:22:00 +0000

At the ISO7816-4 layer, Lr is for me part of the response. Of course, depending on the protocol, it will be transmitted in various ways (like SW1 and SW2). This is also why I did not put it in gray (it does not have to be in the APDU buffer).

About security, don’t worry, it will come later. I never said that this spec was the final one…

About design, I am trying to avoid getting in big smart card debates. I hesitated a while before writing this post, because it is not Java enough for me. Now, I would admit that it is a good idea to return information on SELECT, but this goes beyond what I want to do in this tutorial.

Finally, about status words, I am not sure what you mean. I have reused status words defined in the ISO7816-4 spec, on top of the T=0 protocol, and I don’t see any conflict.

By: lexdabear

lexdabear — Wed, 23 Jan 2008 11:01:12 +0000

Good to see to see the process of a JC Applet interface definition from the beginning to the end.

Some remarks:
– I do not understand the reasoning behind Lr in the response. The application must set the offset and length of the APDU buffer in the APDU.sendBytes() anyway. Besides having always a data field (to stay consistent: no data means Lr = 0) the data field length is reduced by one byte.
– You mention that this is purely functional, without security features, but .. I think it should always be forbidden to retrieve secret data like keys, or in this example the password itself.
– Do you think it’s a good design that an applet provides information about it’s capabilities in the response to the SELECT APDU? For example the file control information could include the commands supported and the methods behind it.
– I would add that the application developer has to be aware of status words which might conflict with the ones already defined in ISO 7816 or JCRE (e.g. T=0 protocol handling).