6985 and 6881 for any subsequent APDU. Where is the source of the problem?

Question

Hi.
I'm trying to load applet to Athena Card (Java Card compliant) with JCOP Tools. Although the load process finishes successfully, subsequent install [for install and for make selectable] APDU is responded with 6985 error code - �Condition of use not satisfied� (according to Global Platform specification 2.2.1). After that any APDU sent to the card is responded with 6881 error code - �Logical channel not supported� (according to ISO/IEC 7816-4 document).
I'm sure that these errors are not sent from our applet. First of all I double checked the install routine of the applet and it does not send such error. Second, I don't use any logical channel, only the main one.
What may be the source of this behavior?
Thank you in advance,
Best regards, neutrino.

Answer 1

I have JCOP41 v 2.3.1 and it has RetailMAC.
I'm implementing now this algorithm and it's too complicated. Could you give me suggestions on how to implement it?
I have already wrote these lines (not completed yet, but I'm sure you will understand what I'm trying to do). Please forgive me for ugly code. I'm a C# developer and I do not have enough Java experience in my background.
    // Here goes section of Retail MAC signing/verification
    // Coded by Gregory Stein.
    private static final byte BAC_MAC_VERIFY = 1;
    private static final byte BAC_MAC_SIGN = 2;
    private static final byte BAC_KS_MAC_VERIFY = 3;
    private static final byte BAC_KS_MAC_SIGN = 4;
    private byte[][] lastMAC = new byte[2][8];
    private byte[] mac = new byte[8];
     * @author Gregory Stein
     * Generates the signature of all/last input data
     * using Retail MAC algorithm as defined in Global
     * Platform specification Appendix B.1.2.2 and as described in
     * ISO 9797-1: MAC Algorithm 3 with output
     * transformation 3, without truncation, and with DES taking
     * the place of the block cipher.
      * @param input input buffer containing data to be sign
      * @param inputOffset the offset into the input buffer at which to begin signature generation
      * @param inputLength the byte length to sign
      * @param signatureBuffer the output buffer to store signature data
      * @param signatureOffset the offset into sigBuff at which to begin signature data
      * @return number of bytes of signature output in sigBuff
     private short sign(byte[] input, short inputOffset, short inputLength,
               byte[] signatureBuffer, short signatureOffset, byte instance)
          short signBytes = 0;
          Cipher cipherDES = Cipher.getInstance(Cipher.ALG_DES_CBC_ISO9797_M2, false);
          DESKey keyDES;
          byte[] iv;
          if (instance > 2) {
               iv = lastMAC[1];
               keyDES = bacKSmacKey3;
          } else {
               iv = lastMAC[0];
               keyDES = bacKmacKey3;
          cipherDES.init(keyDES, Cipher.MODE_ENCRYPT, iv, (short)0, (short)8);
          cipherDES.doFinal(input, inputOffset, inputLength, mac, (short)0);
          cipherDES = Cipher.getInstance(Cipher.ALG_DES_ECB_NOPAD, false);
          cipherDES.init(keyDES, Cipher.MODE_DECRYPT, mac, (short)0, (short)8);
          cipherDES.doFinal(inBuff, inOffset, inLength, outBuff, outOffset)
          // Here I'm writing now
          switch(instance)  {
               case BAC_MAC_VERIFY:
               case BAC_MAC_SIGN:
               case BAC_KS_MAC_VERIFY:
               case BAC_KS_MAC_SIGN:
          return signBytes;
     // End of signing/verification sectionPlease advise me, how can I reduce this code? Or improve it in some way?
Thank you in advance.
Best regards, neutrino.