How to use GPShells open_sc command for a SC02 option 15 Card (J2A, J3A)?

Question

Hi,
my cards tell me as response to get-data 0066 command, that they are using SC02 option 15:
Global Platform version : 2.1.1
Global Platform Secure Channel Protocol: 02 option 15
What are the right parameters for GPShells open_sc command?
h3. GPShell help says:
open_sc -keyind x -keyver x -key xyz -mac_key xyz -enc_key xyz -kek_key xyz -security x -scp x -scpimpl x -keyDerivation x
For OpenPlatform 2.0.1' card only -keyind, -keyver, -mac_key and -enc_key are necessary.
For GlobalPlatform 2.1.1 cards -scp and -scpimpl should be not necessary to supply. But you must also specify -kek_key. If your card supports a Secure Channel Protocol Implementation with only one base key, specify this key with -key and omit the other keys.
If you have a card which uses key derivation you must enable the derivation mode with the -keyDerivation option and you must specify with -key the master (mother) key. -kek_key, -mac_key and -enc_key are not relevant, because they are calculated from the master key. See the sections #Options and #Key Derivation.
h3. GP-2.1.1-Spec says for SC Protocol 02 with option 15:
Initiation mode explicit, C-MAC on modified APDU, ICV set to zero, ICV encryption for CMAC session, 3 Secure Channel Keys,
h3. So, What are the right parameters for GPShells open_sc command?
Assumtions:
1. As my cards support GP 2.1.1 I sould not need to supply -scp and -scpimpl (acc. to GPShell help)
2. SCP 02 option 15 has three Secure Channel Keys (acc. to GP2.1.1. Spec) and does not support SCPImpl with only one base key (as mentioned in GPShell help).
Questions:
1. Are the 3 Secure Channel Keys mentioned in the Spec the keys -mac_key -enc_key -kek_key mentioned in GPShell help?
2. Where can I look for the correct values of -keyind and -keyver?
3. How can I check wether my card uses key derivation?
4. Can I freely choose the -security parameter from [ 0: clear, 1: MAC, 3: MAC+ENC ]
or is this determined by the SCP 02 option 15 to 1: MAC?
5. GPShells listgp211.txt uses
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f // Open secure channel
But that does not work for me (in fact: how can one open_sc command match for all GP Cards, if they use different
SCP 02 but with different options (as it is 15 in my case?)
It is no prob for me to dig into the specs, but I feel like there are some points not too clear there,
so I need experience too: trial and error.
That would be fine for me but locking all these cards does not feel so well, I'd be glad to perform some successful auth
to reset that damn counter ;)
Cheers,
Max

Answer 1

I managed to connect sucessfully to J2A-Card:
Main insight is that you have to specify 3 keys (can be the same key three times)
open_sc -security 1 -keyind 0 -keyver 0 -mac_key x -enc_key x -kek_key xh1. GPShell Trace:
mode_211
enable_trace
establish_context
card_connect
select -AID a000000003000000
Command --> 00A4040008A000000003000000
Wrapped command --> 00A4040008A000000003000000
Response <-- 6F658408A000000003000000A5599F6501FF9F6E06479181023100734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E01029000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f -kek_key 404142434445464748494a4b4c4d4e4f
Command --> 80CA006600
Wrapped command --> 80CA006600
Response <-- 664C734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E01029000
Command --> 805000000860A1D92C0D5BA76800
Wrapped command --> 805000000860A1D92C0D5BA76800
Response <-- 00000093014854952092FF020004B1B79602B1CB9486C7A12DEB85139000
Command --> 8482010010273C6B2808F0F5391350C479076D6951
Wrapped command --> 8482010010273C6B2808F0F5391350C479076D6951
Response <-- 9000
get_status -element 10
Command --> 80F21000024F0000
Wrapped command --> 84F210000A4F008EB97807E3B04F9200
Response <-- 07A000000003535001000108A0000000035350410948454C4C4F4A434F500100010A48454C4C4F4A434F50419000
List of Ex. Load File (AID state Ex. Module AIDs)
a0000000035350     1
     a000000003535041
48454c4c4f4a434f50     1
     48454c4c4f4a434f5041
get_status -element 20
Command --> 80F22000024F0000
Wrapped command --> 84F220000A4F00530272F4C196EACD00
Response <-- 07A000000003535001000948454C4C4F4A434F5001009000
List of elements (AID state privileges)
a0000000035350     1     0
48454c4c4f4a434f50     1     0
get_status -element 40
Command --> 80F24000024F0000
Wrapped command --> 84F240000A4F00F4B9DB41BAF2486E00
Response <-- 0A48454C4C4F4A434F504107009000
List of elements (AID state privileges)
48454c4c4f4a434f5041     7     0
card_disconnect
release_contexth1. JCOP Tools Trace
--Opening terminal
/card -a a000000003000000 -c com.ibm.jc.CardManager--Waiting for card...
ATR=3B F8 18 00 FF 81 31 FE 45 4A 43 4F 50 76 32 34    ;.....1.EJCOPv24
    31 43                                              1C
ATR: T=1, FI=1/DI=8 (31clk/etu), N=-1, IFSC=254, BWI=4/CWI=5, Hist="JCOPv241"
=> 00 A4 04 00 08 A0 00 00 00 03 00 00 00 00          ..............
(24218 usec)
<= 6F 65 84 08 A0 00 00 00 03 00 00 00 A5 59 9F 65    oe...........Y.e
    01 FF 9F 6E 06 47 91 81 02 31 00 73 4A 06 07 2A    ...n.G...1.sJ..*
    86 48 86 FC 6B 01 60 0C 06 0A 2A 86 48 86 FC 6B    .H..k.`...*.H..k
    02 02 01 01 63 09 06 07 2A 86 48 86 FC 6B 03 64    ....c...*.H..k.d
    0B 06 09 2A 86 48 86 FC 6B 04 02 15 65 0B 06 09    ...*.H..k...e...
    2B 85 10 86 48 64 02 01 03 66 0C 06 0A 2B 06 01    +...Hd...f...+..
    04 01 2A 02 6E 01 02 90 00                         ..*.n....
Status: No Error
cm>  set-key 255/1/DES-ECB/404142434445464748494a4b4c4d4e4f 255/2/DES-ECB/404142434445464748494a4b4c4d4e4f 255/3/DES-ECB/404142434445464748494a4b4c4d4e4f
cm>  init-update 255
=> 80 50 00 00 08 51 C6 9C 29 E2 B2 9E 89 00          .P...Q..).....
(49458 usec)
<= 00 00 00 93 01 48 54 95 20 92 FF 02 00 05 BD 1A    .....HT. .......
    6B E9 D3 D5 5C 10 15 5A 3B FE 74 3B 90 00          k...\..Z;.t;..
Status: No Error
cm>  ext-auth plain
=> 84 82 00 00 10 80 2B 5E A2 9A E4 CB AC FB 4B 10    ......+^......K.
    A2 5F E3 1A 87                                     ._...
(52746 usec)
<= 90 00                                              ..
Status: No ErrorCheers,
Max