JCOP Tools init-update problem

Question

Hello, everybody!!!
I wanna simulate CardManager authentication behaviour and have some problems... Below i show you excerpts from my applet and the process of sending INITIALIZE UPDATE command to it using JCOP Shell.
If somebody has an idea to deal with this issue, please help.
Here's the definition of key i've used:
byte[] secKey = new byte[] {
      (byte)0x40, (byte)0x41, (byte)0x42, (byte)0x43,
      (byte)0x44, (byte)0x45, (byte)0x46, (byte)0x47
};This is done inside the constructor (secKey declared as a class field).
Next, i've added method to process INITIALIZE UPDATE command:
   private boolean processInitUpdate(APDU apdu) {
      byte[] buffer = apdu.getBuffer();
      if((buffer[ISO7816.OFFSET_CLA] != 0x80) &&
            (buffer[ISO7816.OFFSET_INS] != 0x50))
         return false;
      byte challengeLen = buffer[ISO7816.OFFSET_LC];
      byte dataRead = (byte)apdu.setIncomingAndReceive();
      if((challengeLen != 0x08) || (dataRead != 0x08)) {
         ISOException.throwIt(ISO7816.SW_WRONG_LENGTH);
      // Encrypted cryptogram buffer
      byte[] cryptogram = new byte[8];
      DESKey des_key = (DESKey)KeyBuilder.buildKey(
            KeyBuilder.TYPE_DES, KeyBuilder.LENGTH_DES, false);
      des_key.setKey(secKey, (short)0);
      Cipher cipher = Cipher.getInstance(Cipher.ALG_DES_ECB_NOPAD, false);
      cipher.init(des_key, Cipher.MODE_ENCRYPT);
      // Encrypt the incoming challenge
      cipher.doFinal(buffer, ISO7816.OFFSET_CDATA, (byte)8, cryptogram, (byte)0);
      // Output data
      byte[] keyDeriviation = new byte[] {
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00
      byte[] keyInfo = new byte[] {
            (byte)0xff, (byte)0x02
      // TODO generate random
      byte[] challenge = new byte[] {
            (byte)0x11, (byte)0x22, (byte)0x33, (byte)0x44,
            (byte)0x55, (byte)0x66, (byte)0x77, (byte)0x88
      // Calculate total length of the data to be sent
      short totalLen = (short)(keyDeriviation.length + keyInfo.length +
                               cryptogram.length + challenge.length);
      apdu.setOutgoing();
      apdu.setOutgoingLength(totalLen);
      apdu.sendBytesLong(keyDeriviation, (short)0, (short)keyDeriviation.length);
      apdu.sendBytesLong(keyInfo, (short)0, (short)keyInfo.length);
      apdu.sendBytesLong(challenge, (short)0, (short)challenge.length);
      apdu.sendBytesLong(cryptogram, (short)0, (short)cryptogram.length);
      return true;
   }This method returns true if command has been processed successfully.
I've used GlobalPlatform specification to properly parse command APDU and to generate response APDU.
Then i use JCOP Tools for Eclipse shell. I select above applet and define keys as follows:
set-key 255/1/DES-ECB/4041424344454647
set-key 255/2/DES-ECB/4041424344454647
set-key 255/3/DES-ECB/4041424344454647Then i use init-update command:
init-update 255Shell generates the following APDU command sequence:
80 50 00 00 08 C3 17 13 59 C6 0F ED ED 00We can see the challenge, generated by simulator: C3 17 13 59 C6 0F ED ED.
I got the response:
00 00 00 00 00 00 00 00 00 00 FF 02 11 22 33 44 55 66 77 88 4D 4C E8 7E 6A 04 B1 43 90 00It seems everything all right, but shell shows an error:
Status: No Error
jcshell: Error code: -5 (Authentication failed)
jcshell: Wrong response APDU: 00000000000000000000FF0211223344556677884D4CE87E6A04B1439000I think I set keys inside the shell incorrectly. I use triple-DES, but code uses simple DES. However, i use equal keysets for triple-DES so it's the same as DES.
What's wrong?
Thank you.

Answer 1

Hello everybody, again!
At last, I solved my problem. The issue was I incorrectly generated card cryptogram data. Cryptogram must be constructed using full triple DES algorithm. After that JCOP shell processes init-update 255 successfully.
Below I'll present working code for processing INITIALIZE UPDATE command in JCOP tools, maybe this will be helpful for somebody.
   private boolean processInitUpdate(APDU apdu) {
      byte[] buffer = apdu.getBuffer();
      // Whether this INITIALIZE UPDATE command?
      if((buffer[ISO7816.OFFSET_CLA] != 0x80) &&
            (buffer[ISO7816.OFFSET_INS] != 0x50))
         return false;
      byte challengeLen = buffer[ISO7816.OFFSET_LC];
      byte dataRead = (byte)apdu.setIncomingAndReceive();
      if((challengeLen != 0x08) || (dataRead != 0x08)) {
         ISOException.throwIt(ISO7816.SW_WRONG_LENGTH);
      // TODO generate random
      // Card challange
      byte[] challenge = new byte[] {
            (byte)0x11, (byte)0x22, (byte)0x33, (byte)0x44,
            (byte)0x55, (byte)0x66, (byte)0x77, (byte)0x88
      // DES Secure Channel Encryption Key (S-ENC) generation
      // Deriviation data array
      byte[] derivData = new byte[16];
      // Secure Channel Encryption Key data array
      byte[] s_enc_key = new byte[16];
      // The construction of deriviation data
      Util.arrayCopy(buffer, (short)(ISO7816.OFFSET_CDATA + 4), derivData, (short)12, (short)4);
      Util.arrayCopy(challenge, (short)0, derivData, (short)8, (short)4);
      Util.arrayCopy(buffer, ISO7816.OFFSET_CDATA, derivData, (short)4, (short)4);
      Util.arrayCopy(challenge, (short)4, derivData, (short)0, (short)4);
      // Construct and initialize Cipher with des_key
      DESKey des_key = (DESKey)KeyBuilder.buildKey(
            KeyBuilder.TYPE_DES, KeyBuilder.LENGTH_DES3_2KEY, false);
      des_key.setKey(secKey, (short)0);
      Cipher cipher = Cipher.getInstance(Cipher.ALG_DES_ECB_NOPAD, false);
      cipher.init(des_key, Cipher.MODE_ENCRYPT);
      // Generate session S-ENC key
      cipher.doFinal(derivData, (byte)0, (byte)derivData.length, s_enc_key, (byte)0);
      // Card Authentication Cryptogram generation
      // Cryptogram data array
      byte[] cryptogram = new byte[8];
      // Initial vector data
      byte[] initVector = new byte[] {
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00
      // Construct and initialize Cipher with s_enc_key
      des_key.setKey(s_enc_key, (short)0);
      cipher = Cipher.getInstance(Cipher.ALG_DES_CBC_NOPAD, false);
      cipher.init(des_key, Cipher.MODE_ENCRYPT, initVector, (short)0, (short)initVector.length);
      // Extract host challenge from input buffer
      byte[] hostChallenge = new byte[8];
      Util.arrayCopy(buffer, ISO7816.OFFSET_CDATA, hostChallenge, (short)0, (short)hostChallenge.length);
      // Step 1: Encrypt host challenge using ICV of binary zeroes
      byte[] inputData = xorOperation(initVector, hostChallenge);
      cipher.doFinal(inputData, (short)0, (short)inputData.length, cryptogram, (short)0);
      // Step 2: Encrypt card challenge using results of the previous operation
      inputData = xorOperation(cryptogram, challenge);
      cipher.doFinal(inputData, (short)0, (short)inputData.length, cryptogram, (short)0);
      // Step 3: Encrypt DES padding data using results of the previous operation
      byte[] pad = new byte[] {
            (byte)0x80, (byte)0x00, (byte)0x00, (byte)0x00,
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00
      inputData = xorOperation(cryptogram, pad);
      cipher.doFinal(inputData, (short)0, (short)inputData.length, cryptogram, (short)0);
      // Generate output
      byte[] keyDeriviation = new byte[] {
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00
      byte[] keyInfo = new byte[] {
            (byte)0xff, (byte)0x01
      // Calculate total length of the data to be sent
      short totalLen = (short)(keyDeriviation.length + keyInfo.length +
                               cryptogram.length + challenge.length);
      apdu.setOutgoing();
      apdu.setOutgoingLength(totalLen);
      apdu.sendBytesLong(keyDeriviation, (short)0, (short)keyDeriviation.length);
      apdu.sendBytesLong(keyInfo, (short)0, (short)keyInfo.length);
      apdu.sendBytesLong(challenge, (short)0, (short)challenge.length);
      apdu.sendBytesLong(cryptogram, (short)0, (short)cryptogram.length);
      return true;
   private byte[] xorOperation(byte[] op1, byte[] op2) {
      byte[] res = new byte[8];
      if((op1.length != 8) || (op2.length != 8)) return null;
      for(byte i = 0; i < res.length; i++) {
         res[i] = (byte)(op1[i] ^ op2);
return res;
Regards, Eugene.