On a very personal view, it feels a bit strange. After leaving Gemplus nine years ago to join the Trusted Logic adventure, after witnessing from the outside the Gemplus-Axalto merger, I am back under the control of a large company, and that feels a bit strange.

As far as I know, I will keep this blog open, and I will keep expressing my personal views about Java Card, mobile security, and a few more things. Just like I didn’t comment/apologize/criticize Trusted Logic’s views in the past, don’t expect me to comment/apologize/criticize Gemalto’s views today.

Trusted Logic (as an independent company) has been quite interesting; it even made me some kind of a security expert, which seemed extremely unlikely back in 2000. Finally, that chapter of Trusted Logic closes with a few realizations and a lot of dreams for the future. Let’s just hope that in the next chapter, Trusted Logic (as a Gemalto subsidiary) can make some of these things happen, with the support of its parent company.

Even if LG is not talking about it, the news is still good, as it means that Smart Card Web Servers are not going the same way as NFC and USB-SIMs, waiting for years for handsets to support the technology. LG even wants to go further than a single product, as stated in the last interesting sentence of the press release:

Beginning in 2009, LG plans to have the SCWS feature available on most LG HSDPA handsets.

Of course, right now, we have to continue working with SCWS SIM card based on Java Card 2, becaues there is no existing Java Card 3.0 SIM card. So, if you want to see your SIM-based content displayed on a LG Renoir phone, you will need to write your site with byte arrays and other fun things. Good luck!

But this Sesames is not like the previous ones, because it is named Smart Card Web Mashups, and here is its description from Gemalto’s own press release:

Smart Card Web Mashups is the first implementation of the Java Card 3.0 specifications through a technological solution that combines content and applications from various Web server. One of the servers is embedded in a USB device and provides personal data and services to the USB key holder, such as a contact book, notes, passwords, videos or images. The information is directly managed in a web browser via applications like YouTube or a Personal Information Manager (PIM) portal embedded in the USB key. The mashup technology allows enriching the services stored in the device with online content, or personalizing Web applications with personal data. For example, the contact book in the key enriches each address with a geographical map provided by an online service. Similarly, an online mapping service can be personalized with the contact book in the key to localize the persons.

The fact that mashups get the first Java Card 3.0-related Sesames award is a very good sign, because it truly is a new thing, in which the sensitive content from the card is mixed with generic content from the Web. There are many applications to this technique, and one thing that the press release does not say is that one of the great advantages of this technology is the ability to protect your privacy, by keeping some of the information local to your card.

So, congratulations to the Gemalto team, and let’s hope that we will get this technology to many more successes in smart cards, and beyond that.

However, this good design has some drawbacks: the specifications on the Multos site are for some dated “August 1997″. Such a stability is impressive; in August 1997, Java Card 2.0 was still a rough draft, far from stable, and even the final version was far from being a massively deployable product. On the other hand, this stability also shows that the technology has not evolved; while Multos remains a good basis for low-cost payment cards, it will most ilkely not be the basis for high-end SIM cards use for mobile payments in NFC-enabled phones. Olivier Piou mentions this in the press release, but he is only talking about

… commercially-demonstrated highest-security post-issuance activation service, which will be critical for example in mobile payment and NFC (Near Field Communication) applications.

I would love to know why Keycorp is selling now, and even more, why Gemalto is buying Multos rather than simply trying to replace them with their own products. By reading the press release, I get the feeling that the Multos infrastructure is what interests them, but this is just a guess, so I suppose that time will tell…