Proprietary APDU CLA byte

Hi,
If I am creating proprietary APDU for the JavaCard applet. I think the CLA byte should be 0x80, because the 4 top most bits must be 1000 according to ISO/IEC 7816
and if I will not use the secure messaging and logical channels, the lower 4 bits must be 0000, which is 10000000 = 0x80.
Am I right?
Regards,
STeN

Hello,
thanks for the reply - sure I must avoid the possible collision with the Global Platform!
Other question - I think - but I am not sure about this - if the smart card manufacturer supports some extra proprietary APDUs (e.g. enumerating installed JavaCard applets, getting the free EEPROM space) by the smart card OS (i.e. Sm@rtCafe), I should also check those commands, to avoid possible collision, because I think those commands will be handled with higher priority then applet specific APDUs (by this I mean, that if I will send the APDU and OS detect that this is a command it supports, it will handle it and the APDU will nto be sent to the currently selected JavaCard applet)?
Thanks a lot for the reply and help
Regards,
STeN

Similar Messages

APDU LE byte

Hi,
it seems i do not understand the APDU. i want to send 4byte data and receive 2byte. So i sent:
80 01 00 00 04 10 20 30 40 02
The first 4byte are the header. LC is 4 for 4byte data (10 20 30 40) and then the LE byte follows with 02.
But on the card this does not work:
byte[] buffer = apdu.getBuffer();
short length = apdu.setIncomingAndReceive(); // length = 4, thats right
short expectedOutput = apdu.setOutgoing(); // expectedOutput = 256, why ???Iam not able to receive the LE byte. But in the ISO7816 this case (LC and LE not null) is one of the four cases which has to work with every card. Whats my fault ? :(

I guess your card is using the T=0 protocol.
Doc for setOutgoing states: "In T=0 (Case 4S) protocol, this method will return 256 with normal semantics."
So everything is working as designed (I'm not saying: at is should have been designed).
There is no problem if you know the expected length of the answer (that is the integer Ne, coded by Le) from the spec of the APDU and its input parameters excluding Le, and 0<Ne<256. In that case just set that Nr=Ne using setOutgoingLength and send Nr data bytes with sendBytes. The card will tell Nr to the reader (as part of a conventional status word), some glue code in the bowels of the Java runtime library or application should issue a Get Response command, and everything will be fine. This might work with Ne=256, coded by Le=00h, but do not bet on that without trying.
There is no problem either if you are happy with the default behavior of truncating the Nr bytes of outgoing data to Ne coded by Le. Just do as above as if you knew Ne was the maximum it could be, and everything will be fine.
If your in-card applet really needs (rather than know or assume) Ne, one option is to instead change the spec of the APDU and move Ne to P1,P2, or some of the ingoing data where you can get it.
Else, well... I'd rather not dive into these messy details if the previous three simple options apply.

Proprietary APDU response SW1SW2 values

Hi,
I have a question:
If the JavaCard applet responses the APDU command with the error code, should I follow some guide lin for the SW1 value? I.e. ISO/IEC 7816 is mentioning that SW1 value should be in the interval 61-6F... Is that used? Or is it 100% up to me, which SW1 values I will use for responses. For the success response I think that SW1SW2 value should be always 0x9000?
Thanks a lot for replies
Regards,
STeN

Hi Sten,
0x9000 is the SW to use for success. If you can find an ISO7816 SW that matches the error condition that you are trying to indicate I think it is a good idea to use that. ISO7816 also deffines the SW range from 0x9001 to 0x9ffff to be an application specific error condition.
Cheers,
Shane

How can I write a read a data on a SmartCArd

Hi everyone...
I would like to know. how I can write and read a data on a SmartCard maybe through a file(IO)
could you helpme please??
Thanks a lot...
Marcos

Try this mate
package com.reader;
import java.util.List;
import javax.smartcardio.Card;
import javax.smartcardio.CardChannel;
import javax.smartcardio.CardException;
import javax.smartcardio.CardTerminal;
import javax.smartcardio.CardTerminals;
import javax.smartcardio.CommandAPDU;
import javax.smartcardio.ResponseAPDU;
import javax.smartcardio.TerminalFactory;
import com.sun.javacard.apduio.Apdu;
* @author ic008391
public class Connector extends Thread
     * @param args
     * @param args
     public static void main(String[] args)
          List<CardTerminal> lct = null;
          Card crd = null;
          TerminalFactory tf = TerminalFactory.getDefault();
          CardTerminals cts = tf.terminals();
          CardChannel cch = null;
          try
               //create APDU Command
               Apdu apdu = new Apdu();
               apdu.command[Apdu.CLA] = (byte) 0X00;
               apdu.command[Apdu.INS] = (byte) 0XA4;
               apdu.command[Apdu.P1] = (byte) 0X04;
               apdu.command[Apdu.P2] = (byte) 0X00;
               //apdu.command[Apdu.P3] = (byte) 0X0a;
               byte[] data = {(byte)0xa0, (byte)0x0, (byte)0x0, (byte)0x0, (byte)0x62, (byte)0x3, (byte)0x1, (byte)0xc, (byte)0x6, (byte)0x1, (byte)0x7F};
//wallet 0xa0:0x0:0x0:0x0:0x62:0x3:0x1:0xC:0x6
// select 0x00 0xA4 0x04 0x00 0x0a 0xa0 0x0 0x0 0x0 0x62 0x3 0x1 0xc 0x6 0x1 0x7F
               lct = cts.list();
               System.out.println(lct);
               CardTerminal ct = lct.get(0);
               crd = ct.connect("T=0"); //Or "T=1"
               javax.smartcardio.ATR atr = crd.getATR();
               byte i[] =atr.getBytes();
               for (int n = 0; n < i.length; n++) {
          int x = (int) (0x000000FF & i[n]); // byte to int conversion
          String s = Integer.toHexString(x).toUpperCase();
          if (s.length() == 1) s = "0" + s;
          System.out.print(s + " ");
               System.out.println("");
               System.out.println("ATR"+(atr.getHistoricalBytes()).toString());
               System.out.println("ATR"+atr.toString());
               cch = crd.getBasicChannel();
               sleep(1000);
               ResponseAPDU r;
               //r = cch.transmit(new CommandAPDU(apdu.getCommand()));
               r = cch.transmit(new CommandAPDU(0,164,4,0,data));
               System.out.println(apdu);
               System.out.println(r);
               //Get Balance
               //0xB0 0x50 0x00 0x00 0x00 0x02;
               r = cch.transmit(new CommandAPDU(176,80,0,0));
               System.out.println(r);
               //cch.close();
          catch (CardException e)
               // TODO Auto-generated catch block
               e.printStackTrace();
          catch (InterruptedException e)
               // TODO Auto-generated catch block
               e.printStackTrace();
          finally
               try
                    crd.disconnect(true);
               catch (CardException e)
                    // TODO Auto-generated catch block
                    e.printStackTrace();
}

RSAEncryption

Hello,
i want to use the RSA-Encryption to encryt the communication between the host and the javacard.
On the host side i use the following code to generate the private and public key and to create the cipher:
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
kpg.initialize(512);
KeyPair kp = kpg.genKeyPair();
publicKey = kp.getPublic();
privateKey = kp.getPrivate();
Cipher cipher = Cipher.getInstance("RSA");Then I send the exponent and the modulus to the card using normal apdus.
In the constructor of the applet i use the following code to init the key and the cipher:
protected WalletApplication(byte[] bArray, short bOffset, byte bLength) {
        serverPublicKey = (RSAPublicKey) KeyBuilder.buildKey(
                KeyBuilder.TYPE_RSA_PUBLIC,
                KeyBuilder.LENGTH_RSA_512, false);
        cipher = Cipher.getInstance(ALG_RSA_PKCS1 ,false);
        register();
    }But if i encrypt a message on the javacard and send it back to the host in order to decrypt it. I got an BadPaddingException. Can someone explain how to fix this problem.
Thanks.

Thanks for your answer, changing the parameter in the getInstance does not solve so the problem, so here is the complete code:
public class Client {
    private byte[] message;
    private Socket socketCard;
    private InputStream is;
    private OutputStream os;
    private CadClientInterface cad;
    private PrivateKey privateKey;
    private RSAPublicKey publicKey;
    public Client() {
        initRSA();
        connectToSmartCardSimulator();
    public void connectToSmartCardSimulator() {
        try {
            socketCard = new Socket("localhost", 9025);
            is = socketCard.getInputStream();
            os = socketCard.getOutputStream();
            cad = CadDevice.getCadClientInstance(CadDevice.PROTOCOL_T1, is, os);
            cad.powerUp();
            cad.exchangeApdu(selectAppletApdu());
            // send the public key to the card
            cad.exchangeApdu(sendExponentApdu(publicKey.getPublicExponent()));
            cad.exchangeApdu(sendModulusApdu(publicKey.getModulus()));
            // send a message to the card and get it back encrypted
            message = encryptMessage();
            cad.powerDown();
            socketCard.close();
            System.out.println(new String(message));
            System.out.println(new String(rsaDecrypt(message)));
        } catch (IOException ex) {
            ex.printStackTrace();
        } catch (CadTransportException ex) {
            ex.printStackTrace();
    private Apdu selectAppletApdu() {
        Apdu apdu = new Apdu();
        apdu.command[Apdu.CLA] = (byte) 0x00;
        apdu.command[Apdu.INS] = (byte) 0xa4;
        apdu.command[Apdu.P1] = (byte) 0x04;
        apdu.command[Apdu.P2] = (byte) 0x00;
        byte[] aid = {(byte) 0x20, (byte) 0xDC, (byte) 0xA1, (byte) 0xCA,
            (byte) 0xC9, (byte) 0xF5};
        apdu.setDataIn(aid);
        return apdu;
    private Apdu sendExponentApdu(BigInteger exponent) {
        Apdu apdu = new Apdu();
        apdu.command[Apdu.CLA] = (byte) 0xB0;
        apdu.command[Apdu.INS] = (byte) 0x20;
        apdu.command[Apdu.P1] = (byte) 0x02;
        apdu.command[Apdu.P2] = (byte) 0x00;
        apdu.setDataIn(exponent.toByteArray());
        return apdu;
    private Apdu sendModulusApdu(BigInteger modulus) {
        Apdu apdu = new Apdu();
        apdu.command[Apdu.CLA] = (byte) 0xB0;
        apdu.command[Apdu.INS] = (byte) 0x30;
        apdu.command[Apdu.P1] = (byte) 0x01;
        apdu.command[Apdu.P2] = (byte) 0x00;
        apdu.setDataIn(modulus.toByteArray());
        return apdu;
    public byte[] rsaDecrypt(byte[] data) {
        try {
            Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
            cipher.init(Cipher.DECRYPT_MODE, privateKey);
            byte[] cipherData = cipher.doFinal(data);
            return cipherData;
        } catch (InvalidKeyException ex) {
            ex.printStackTrace();
        } catch (IllegalBlockSizeException ex) {
            ex.printStackTrace();
        } catch (BadPaddingException ex) {
            ex.printStackTrace();
        } catch (NoSuchAlgorithmException ex) {
            ex.printStackTrace();
        } catch (NoSuchPaddingException ex) {
            ex.printStackTrace();
        return null;
   private void initRSA() {
        try {
            KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
            kpg.initialize(512);
            KeyPair kp = kpg.genKeyPair();
            publicKey = (RSAPublicKey) kp.getPublic();
            privateKey = kp.getPrivate();
        } catch (NoSuchAlgorithmException ex) {
            ex.printStackTrace();
   public static void main(String[] args) {
        Client client = new Client();
    private byte[] encryptMessage() throws CadTransportException, IOException {
        Apdu apdu = new Apdu();
        apdu.command[Apdu.CLA] = (byte) 0xB0;
        apdu.command[Apdu.INS] = (byte) 0x40;
        apdu.command[Apdu.P1] = (byte) 0x02;
        apdu.command[Apdu.P2] = (byte) 0x00;
        apdu.setDataIn("This is a test".getBytes());
        cad.exchangeApdu(apdu);
        return apdu.getDataOut();
public class WalletApplication extends Applet {
    // codes of CLA byte in the command APDUs
    final static byte Wallet_CLA = (byte) 0xB0;
    final static byte INS_SET_PUBLIC_KEY = (byte) 0x20;
    final static byte P1_SET_PUBLIC_KEY_MODULUS = (byte) 0x01;
    final static byte P1_SET_PUBLIC_KEY_EXPONENT = (byte) 0x02;
    final static byte INS_CRYPTION_MODE = (byte) 0x40;
    final static byte P1_DECRYPTION_MODE = (byte) 0x01;
    final static byte P1_ENCRYPTION_MODE = (byte) 0x02;
    private RSAPublicKey publicKey;
    private Cipher cipher;
    public static void install(byte[] bArray, short bOffset, byte bLength) {
        new WalletApplication(bArray, bOffset, bLength);
    protected WalletApplication(byte[] bArray, short bOffset, byte bLength) {
        publicKey = (RSAPublicKey) KeyBuilder.buildKey(
                KeyBuilder.TYPE_RSA_PUBLIC,
                KeyBuilder.LENGTH_RSA_512, false);
        cipher = Cipher.getInstance(Cipher.ALG_RSA_PKCS1,false);
        // register the applet instance with the JCRE
        register();
    public boolean select() {
        return true;
    public void deselect() {
   public void process(APDU apdu) {
        byte[] buffer = apdu.getBuffer();
        if (selectingApplet()) {
            return;
        // verify the CLA byte
        if (buffer[ISO7816.OFFSET_CLA] != Wallet_CLA) {
            ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED);
        // check the INS byte to decide which service method to call
        switch (buffer[ISO7816.OFFSET_INS]) {
           case INS_SET_PUBLIC_KEY:
                switch (buffer[ISO7816.OFFSET_P1]) {
                    case P1_SET_PUBLIC_KEY_EXPONENT:
                        setServerKeyExp(apdu);
                        break;
                    case P1_SET_PUBLIC_KEY_MODULUS:
                        setServerKeyMod(apdu);
                        break;
                return;
            case INS_CRYPTION_MODE:
                switch (buffer[ISO7816.OFFSET_P1]) {
                    case P1_ENCRYPTION_MODE:
                        rsaEncrypt(apdu);
                        break;
                return;
            default:
                ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
    private void setServerKeyMod(APDU apdu) {
        byte[] buffer = apdu.getBuffer();
        byte byteRead = (byte) (apdu.setIncomingAndReceive());
        try {
            publicKey.setModulus(buffer, ISO7816.OFFSET_CDATA, byteRead);
        } catch (ArrayIndexOutOfBoundsException ex) {
            ISOException.throwIt((short) 0x6889);
        } catch (TransactionException ex) {
            ISOException.throwIt((short) (0x6803 + ex.getReason()));
    private void setServerKeyExp(APDU apdu) {
        byte[] buffer = apdu.getBuffer();
        byte byteRead = (byte) (apdu.setIncomingAndReceive());
        try {
           publicKey.setExponent(buffer, ISO7816.OFFSET_CDATA, byteRead);
        } catch (ArrayIndexOutOfBoundsException ex) {
            ISOException.throwIt((short) 0x6801);
        } catch (NullPointerException ex) {
            ISOException.throwIt((short) 0x6800);
        } catch (TransactionException ex) {
            ISOException.throwIt((short) 0x6803);
    private void rsaEncrypt(APDU apdu) {
        byte[] buffer = apdu.getBuffer();
        byte byteRead = (byte) (apdu.setIncomingAndReceive());
        cipher.init(publicKey, Cipher.MODE_ENCRYPT);
        short length = cipher.doFinal(buffer, (short) ISO7816.OFFSET_CDATA, byteRead, buffer, (short) ISO7816.OFFSET_CDATA);
        apdu.setOutgoing();
        apdu.setOutgoingLength((short) length);
        apdu.sendBytesLong(buffer, (short) ISO7816.OFFSET_CDATA, (short) length);
}Best regards,
Thorsten

Java 6: javax.smartcardio - can't get CPLC

Hello! I have a problem - can't get CPLC with classes from javax.smartcardio (get SW=6a88), but I easily get it with com.sun.javacard.apduio classes from Java Card Kit 2.2.2.
Here the test code for javax.smartcardio :
import java.util.List;
import javax.smartcardio.*;
public class TestSmartCardJSE60
public static void main(String[] args)
try
   TerminalFactory tf = TerminalFactory.getInstance("PC/SC", null);
   CardTerminals cts = tf.terminals();
   List<CardTerminal> avaiableTerminals = cts.list();
   CardTerminal ct = avaiableTerminals.get(0);
   Card card = ct.connect("*");
   try
    CardChannel channel = card.getBasicChannel();
    CommandAPDU capdu = new CommandAPDU(0x80, 0xCA, 0x9F, 0x7F);
    ResponseAPDU res = channel.transmit(capdu);
    System.out.printf("%s%n", res);
   finally
    card.disconnect(true);
catch(Exception e)
   e.printStackTrace();
}And here the same for com.sun.javacard.apduio
import com.sun.javacard.apduio.*;
public class TestSmartCardJCK222
public static void main(String[] args)
try
   CadClientInterface cad = CadDevice.getPCSCClientInstance(0);
   cad.powerUp();
   try
    Apdu capdu = new Apdu();
    capdu.command[Apdu.CLA] = (byte) 0x80;
    capdu.command[Apdu.INS] = (byte) 0xCA;
    capdu.command[Apdu.P1] = (byte) 0x9F;
    capdu.command[Apdu.P2] = 0x7F;
    cad.exchangeApdu(capdu);
    System.out.printf("%s%n", capdu);
    capdu.setLe(0x2D);
    cad.exchangeApdu(capdu);
    System.out.printf("%s%n", capdu);
   finally
    cad.powerDown(true);
catch(Exception e)
   e.printStackTrace();
}I run both tests under WindowsXP SP3 with ORGA ECO5000 Usb and JCOP21 smart card.
What is my problem? Actualy I want to use javax.smartcardio for my application, because classes from that package more useful than com.sun.javacard.apduio;
Any ideas?

You're missing the Le byte, since you're expecting data back. Try it.

How can I read Extended APDU input to the same buffer

The following is the code I am currently using where inBuffer is an intermediate array of 1000 length. However, I do not want to allocate any buffers at all, and just want to send a command apdu of 1000 byte length and modify it in the code and return the modified buf in the response APDU.
// Read extended APDU input
byte[] buf = apdu.getBuffer();
short bytesRead = apdu.setIncomingAndReceive();
short dataOffset = apdu.getOffsetCdata();
// store first chunk in our intermediate byte array <-- how do i get rid of the intermediate array
Util.arrayCopyNonAtomic(buf, dataOffset, inBuffer, (short) 0, bytesRead);
// what is the overall length?
short overallLength = apdu.getIncomingLength();
short messageOffset = bytesRead;
if (bytesRead != overallLength){ // otherwise we're finished, all bytes received
     short received = 0;
     do{
               received = apdu.receiveBytes((short)0);
               Util.arrayCopyNonAtomic(buf, (short)0, inBuffer, messageOffset, received);
               messageOffset += received;
          } while(received != 0);
* REST OF CODE IN PROCESS METHOD
I have also tried replacing the above code with the following
short bytesLeft = (short) (buffer[ISO7816.OFFSET_LC] & 0x00FF);
if (bytesLeft < (short)55) ISOException.throwIt( ISO7816.SW_WRONG_LENGTH );
short readCount = apdu.setIncomingAndReceive();
while ( bytesLeft > 0){
// process bytes in buffer[5] to buffer[readCount+4];
bytesLeft -= readCount;
readCount = apdu.receiveBytes ( ISO7816.OFFSET_CDATA );
as shown in the javadocs API, but it does not compile.
This is my command APDU:
/send 800100000003E8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003E8
As you can see:
CLA - 80
INS - 01
P1 & P2 - 00
LC - 0003E8
Data - 1000 0s
LE - 03E8
I am using JavaCard 3.0 with JCOP in Eclipse. How can I read the extended length apdu to the same buffer? I have no problem in returning an extended length response APDU. Thanks a lot for the help.

You should not call the convenience method setIncomingAndReceive() in your first code. Please find out about the different APDU states. Furthermore, your Applet should implement the ExtendedLength tagging interface.

Problem in APDU-case 1:No command,no response

Hello evrybody.I have done a method in my java card applet which does not return any command data neither response data.
I wrote in my APDU script the following(as defined the case 1 in the Zhiqun Chen's book-page 102,says that "P3(the 5th field in the APDU buffer) has to be 0"):
//CLA INS P1 P2 P3
0xB1 0x50 0x00 0x00 0x00;
Howevr, the executed APDU script returns me the following:
com.sun.javacard.apdutool.ReaderWriterError: Encountered ";" at line 105, column
25.
Was expecting one of: <INTEGER_LITERAL> ...
<CHARACTER_LITERAL> ...
<STRING_LITERAL> ...
I have tried to add another 0x00 byte at the end of the above script line, as follwoing:
//CLA INS P1 P2 Lc Le
0xB1 0x50 0x00 0x00 0x00 0x00;
//WIth the idea that Lc=0(no command data) and Le=0(no response data)
I noticed that the method is working properly(does the work that has to do;I tested and I am definetely sure) but on the other hand the executed APDU script returns as SW1 SW2 the following:
CLA: b1, INS: 50, P1: 00, P2: 00, Lc: 00, Le: 00, SW1: 6f, SW2: 00 (!!!!)
Actually,I was waiting for SW1 SW2 == 90 00.
I do not know why this is returned.
Do you know what it is going wrong?
I will appreciate any help and guidance.
Thank you for you time.

I will give the code of my function.I think the problem is in the code of this method(function).I will give you in order to have a look at it:
private void delete_all_records(APDU apdu)
     ver_pin();
     byte[] buffer=apdu.getBuffer();
     byte get_P1=buffer[ISO7816.OFFSET_P1];
     byte P3=buffer[ISO7816.OFFSET_LC];
     //Check the appropriate syntax
     if (get_P1!=(byte)0) // || (P3!=(byte)0) )
     ISOException.throwIt (SW_SYNTAX_DEL_ERROR);
// else
     //Delete all the record.This for loop
     //deletes all the records' ids.
     for (short i=0;i<kostas.length;i++)
     kostas[(short)i].record_id=(byte)0;
I did not use any of the functions such as sendBytes() or apdu.setIncomingAndReceive because I did not want to take data either to return response data.Do you have any idea what's going on?
I will really apprecitae any help.Thank you for your time.

Problem with select APDU

Hi all
I have a problem when trying to test an applet created by me like Sebastian Lorquet proposed in this post:
Re: Ask Global Platform SecureChannel
I managed to install my applet on the card, and when I check the applets it contains I can see that the AID of mine appears.
But when I use it and send APDUs through it, the SELECT command fails me.
The SELECT APDU instruction is:
Command -> 00A404000B0102030405060708090000
where 01 02 03 04 05 06 07 08 09 00 00 is the AID of my applet
The response is as follows:
Response <- 6D00 (Invalid instruction byte / Command not supported or invalid)
Do not understand why I get that answer.
I am using gpshell, and the command used is:
select -AID 0102030405060708090000
Thanks in advance
Edited by: bra_racing on 05-jul-2012 15:28

ah ok. Just answer me one thing, are you using below code ?
package test;
import javacard.framework.APDU;
import javacard.framework.Applet;
import javacard.framework.ISO7816;
import javacard.framework.ISOException;
import org.globalplatform.GPSystem;
import org.globalplatform.SecureChannel;
* @author shane
public class TestSecureChannel extends Applet {
    private final static byte INS_INIT_UPDATE = 0x50;
    private final static byte INS_EXT_AUTH = (byte) 0x82;
    private TestSecureChannel() {
        // empty
    public static void install(byte bArray[], short bOffset, byte bLength) throws ISOException {
        new TestSecureChannel().register();
    public void process(APDU apdu) throws ISOException {
        if (selectingApplet()) {
            return;
        byte[] buffer = apdu.getBuffer();
        byte cla = buffer[ISO7816.OFFSET_CLA];
        byte ins = buffer[ISO7816.OFFSET_INS];
        SecureChannel sc = GPSystem.getSecureChannel();
        if ((byte) (cla & 0x80) == 0x80) {
            switch (ins) {
                case INS_INIT_UPDATE:
                case INS_EXT_AUTH:
                    apdu.setOutgoingAndSend(ISO7816.OFFSET_CDATA, sc.processSecurity(apdu));
                    return;
                default:
                    // fall through
        switch (ins) {
            case (byte) 0x01:
                buffer[0] = sc.getSecurityLevel();
                apdu.setOutgoingAndSend((short) 0, (short) 1);
                break;
            default:
                ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
}If not above one then copy past your code here. For time being for what I understand it that to send get data command your currently selected application should be card manager.
Edited by: Umer on Jul 10, 2012 4:34 PM

Error "Cannot be resolved to a type" on OwnerPIN, APDU, ISO7816

The error I'm reffering to might clearify the fact that I'm new at Java/javaCard-development.
To learn how it all works I've downloaded an example and try to understand what happens.
I opened the source in Eclipse and get errors "Cannot be resolved to a type" on OwnerPIN, ADPU and ISO7816 classes. I have an Import javacard.framework statement and expected these types to be part of this library.
I guess I'm forgetting something somewhere but couldn't find the soluiton on internet.
import javacard.framework.*; // import all neccessary packages for java card*
import java.applet.;
import java.lang.Object;
public class classpgdata extends Applet {
final static byte PROP_CLASS = (byte) 0x80; // Class of the proprietary APDU commands
static {color:#ff0000}OwnerPIN{color} pin; // the PIN object
public void process({color:#ff0000}APDU{color} apdu) {
byte[] cmd_apdu = apdu.getBuffer();
if (cmd_apdu[{color:#ff0000}ISO7816{color}.OFFSET_CLA] == {color:#ff0000}ISO7816{color}.CLA_ISO7816) {
//----- it is the ISO/IEC 7816 class
switch(cmd_apdu[{color:#ff0000}ISO7816{color}.OFFSET_INS]) { // check the instruction byte
case INS_SELECT: // it is a SELECT FILE instruction
...

Hi,
What you need to do update your Java build path fr the project in your Eclipse project.
Project -> Properties then find Java Build Path.
In the Libraries tab add the {JCDK Home}/lib/javacardframework.jar by clicking the add external JARs button. You may also want to remove the standard Java Runtime (JRE) libraries as you do not build against these.
If you want to use the JC 2.2.1 CAP file converter, you may also want to ensure that the Eclipse compiler is set to compile as Java 1.3 in the Java Compiler section of the project properties.
KeesdeVink wrote:
import javacard.framework.*; // import all neccessary packages for java card
import java.applet.*;
import java.lang.Object;
It also looks like you have added two imports you don't actually want. You only need the javacard.framework.* import.
Cheers,
Shane
Edited by: safarmer on 23/09/2009 08:00

Urgent ! writing a java card applet -APDU problem

hi
i'm fairly new to the java programming language. i'm trying to write an RSA java card applet to run on a java card simulator.
I am not sure at all what code i need to write for the CLA byte in the command APDU and what code i need to write for the INS byte in the command APDU, and where exactly to put it in my program.
if anybody knows please could you help me out.
So far i have written the code below.
thanx
louise
import javacard.framework.*;
import java.math.*;
import java.util.*;
/*the public key is the public part of the key. Anyone
can have it. It can only encrypt data, not decrypt.*/
public class publickey extends Applet{
//code of the CLA byte in the command APDU header
final static byte publickey_CLA = (byte)0x00;
//max number of characters for text message is 60
final static char MAX_TXT_MSG = 0x3c;
//MAX number of tries (3) before PIN is blocked
final static byte PIN_TRY_LIMIT = (byte)0x03;
//size of PIN must be 4 digits long
final static byte PIN_SIZE = (byte)0x04;
//below status word(SW) values are returned by applet
//in certain circumstances:
//signal that the PIN verification failed
final static short SW_PIN_VERIFICATION_FAIL = 0x6300;
//signal that PIN validation required for txt msging
final static short SW_PIN_VERIFICATION_REQUIRED = 0x630;
//instance variables declaration
OwnerPIN pin; //variable for holding owners pin
BigInteger n,e;
String owner;//variable for holding owners name
/*make a public key. Do not do it yourself, but
make a public key from a private key.*/
publickey(String iowner,BigInteger in,BigInteger ie){
owner=iowner;
n=in;
e=ie;
public void process (APDU apdu) {
byte[] buffer = apdu.getBuffer();
//check Select APDU command
if((buffer[ISO7816.OFFSET_CLA] ==0) &&
(buffer[ISO7816.OFFSET_INS] ==(byte) (0xA4)) )
return;
if(buffer[ISO7816.OFFSET_CLA] !=publickey_CLA)
ISOException.throwIt
(ISO7816.SW_CLA_NOT_SUPPORTED);
/*read the key back from a string.*/
publickey(String from){
StringTokenizer st=new StringTokenizer(from," ");
owner=st.nextToken();
n=readBI(st.nextToken());
e=readBI(st.nextToken());
/*use the key to encrypt a 'message' m. m should be a
number from 1 to n (n not included).
use makemessage to convert your message to a BigInteger.
BigInteger encrypt(BigInteger m){
return m.modPow(e,n);
/*make a string from this key.*/
public String toString(){
return owner+" "+printBI(n)+" "+printBI(e);
/*help methods for reading and writing:*/
final static int radix=36;
static String printBI(BigInteger b){
return b.toString(radix);
static BigInteger readBI(String s){
return new BigInteger(s,radix);
/* these methods convert an arbitrary message,
in the form of an array of bytes, to a message
suitable for encryption. To do this random bits
are added (this is needed to make cracking of the
system harder), and it is converted to a BigInteger.*/
BigInteger makemessage(byte[] input){
/*to understand this part of the program,
read the description of the BigInteger constructor
(in the standard java help). */
if(input.length>128 ||
input.length*8+24>=n.bitLength())
return new BigInteger("0"); //error! message to long.
byte[] paddedinput=new byte[n.bitLength()/8-1];
for(int i=0;i<input.length;i++)
paddedinput[i+1]=input;
paddedinput[0]=(byte)input.length;
for(int i=input.length+1;i<paddedinput.length;i++)
paddedinput[i]=(byte)(Math.random()*256);
return new BigInteger(paddedinput);
/*the inverse of makemessage.*/
static byte[] getmessage(BigInteger b){
byte[] paddedoutput=b.toByteArray();
byte[] output=new byte[paddedoutput[0]];
for(int i=0;i<output.length;i++)
output[i]=paddedoutput[i+1];
return output;
class privatekey{
/*the data of a key*/
BigInteger n,e,d;
String owner;
int bits;
Random ran;
/*unimportant things, needed for calculations:*/
static int certainty=32;
static BigInteger one=new BigInteger("1"),
three=new BigInteger("3"),
seventeen=new BigInteger("17"),
k65=new BigInteger("65537");
/*make a new key. supply the name of the owner of the
key, and the number of bits.
owner: all spaces will be replaced with underscores.
bits: the more bits the better the security. Every
value above 500 is 'safe'. If you are a really paranoid
person, you should use 2000.*/
privatekey(String iowner,int ibits){
BigInteger p,q;
bits=ibits;
owner=iowner.replace(' ','_');//remove spaces from owner name.
ran=new Random();
p=new BigInteger(bits/2,certainty,ran);
q=new BigInteger((bits+1)/2,certainty,ran);
n=p.multiply(q);
BigInteger fi_n=fi(p,q);
e=chooseprimeto(fi_n);
d=e.modInverse(fi_n);
/*read the key back from a string*/
privatekey(String from){
StringTokenizer st=new StringTokenizer(from," ");
st.nextToken();
n=readBI(st.nextToken());
e=readBI(st.nextToken());
d=readBI(st.nextToken());
/*some help methods:*/
static BigInteger fi(BigInteger prime1,BigInteger prime2){
return prime1.subtract(one).multiply(prime2.subtract(one));
static BigInteger BI(String s)
{return new BigInteger(s);}
BigInteger chooseprimeto(BigInteger f){
/*returns a number relatively prime to f.
this number is not chosen at random, it first
tries a few primes with few 1's in it. This
doesn't matter for security, but speeds up computations.*/
if(f.gcd(three).equals(one))
return three;
if(f.gcd(seventeen).equals(one))
return seventeen;
if(f.gcd(k65).equals(one))
return k65;
BigInteger num;
do{
num=new BigInteger(16,ran);
}while(!f.gcd(num).equals(one));
return num;
final static int radix=36;
static String printBI(BigInteger b){
return b.toString(radix);
static BigInteger readBI(String s){
return new BigInteger(s,radix);
/*returns the public key of this private key.*/
publickey getpublickey(){
return new publickey(owner,n,e);
/*the same encryption that the public key does.*/
BigInteger encrypt(BigInteger m){
return m.modPow(e,n);
/*decryption is the opposite of encryption: it
brings the original message back.*/
BigInteger decrypt(BigInteger m){
return m.modPow(d,n);
public String toString(){
return owner+" "+printBI(n)+" "+printBI(e)+" "+printBI(d);
/*this main demonstrates the use of this program.*/
public static void main(String[] ps){
say("************ make key:");
privatekey priv=new privatekey("sieuwert",92);
publickey pub=priv.getpublickey();
say("the public key:"+priv);
say("************ encrypt message:");
byte[] P="RUOK?".getBytes();
BigInteger Pc=pub.makemessage(P);
say("converted:\t"+printBI(Pc));
BigInteger C=pub.encrypt(Pc);
say("coded message: "+printBI(C));
say("************ decrypt message:");
BigInteger Pc2=priv.decrypt(C);
say("decoded:\t"+printBI(Pc2));
byte[] P2=publickey.getmessage(Pc2);
say("deconverted: "+new String(P2));
static void say(String s){
System.out.println(s);

Command APDU is not written in your source code, rather it is sent from PC or programmed Card Acceptance Device/ Card Reader/ Terminal.
The code installed in the Java Card should be able to handle the Command APDU received and process it accordingly, and finally your code should be able to send out response APDU.
You may think your code as a decoder, to retrieve each byte (CLA, INS, P1, P2, DATA, LC) using the Java Card API, you should be able to do it.
Also, I notice in your code that you want to work out with strings, but Java Card does not support strings, chars, long, float, double ...
to send out reponse APDU, there are certain steps that you can use, not just simply print like ordinary J2SE may use.
hope this will help u

Detect SELECT APDU

Hi everyone
I'm writing an applet (Java Card 2.1.1) and in the process method I'm trying to detect the SELECT APDU command, but it's not working. I send a SELECT APDU to my applet, it throws a SW_CLA_NOT_SUPPORTED exception, and it is selected. Ok, the command ends up doing what it is supposed to do, but my applet throws an exception, and it shouldn't.
Here's my code:
public void process(APDU apdu) throws ISOException {
byte[] buffer = apdu.getBuffer();
byte cla = buffer[ISO7816.OFFSET_CLA];
byte ins = buffer[ISO7816.OFFSET_INS];
if (cla == CLA_FUNCIONARIO) {
      try {
          switch (ins) {
              // all my cases
              default:
                  ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
      catch (UserException e) {
          ISOException.throwIt(e.getReason());
else if (selectingApplet()) {
      return;
else {
      byte tamanho_lido = (byte) apdu.setIncomingAndReceive();
      apdu.setOutgoing();
      apdu.setOutgoingLength((short) (tamanho_lido + 4));
      apdu.sendBytes((short) 0, (short) 4);
      apdu.sendBytes(ISO7816.OFFSET_CDATA, tamanho_lido);
      ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED);
}First of all, I don't know what exactly does the method selectingApplet - in several source codes I've seen around, the verification for the SELECT APDU is done like this:
(cla == ISO7816.CLA_ISO7816 && ins == ISO7816.INS_SELECT)But, there are some sample codes (like the JavaPurse on JCDK 2.1.1) that prove these two ways of checking the SELECT APDU is not equivalent. So, what's the difference between using the selectingApplet method and using the constants on the ISO7816 interface? Should I use both ways? Only one of them???
The big problem is what is actually happening to my card. As it can be seen in the code above, if the applet is about to throw an SW_CLA_NOT_SUPPORTED exception, it writes the whole command that it received, so I can see what got there (sort of a System.out.println debugging). And here's what happens: everytime I send the command 0x00 0xA4 0x04 0x00 0x06 0x01 0x02 0x03 0x04 0x05 0x06 0x00, it returns 0x00 0xC0 0x00 0x00 as the response data and 0x6E00 as the status word!!! I googled and I found that C0 is the INS byte of the GET RESPONSE command. What is this command? It's not documented on the GlobalPlatform 2.0.1' specification. And why the hell my applet says it received this command when I send it a SELECT APDU?
Any answer would be valuable :)
Thanks!

You are in the ISO7816 T=0 protocol. The 00CO000000 command is issued to receive the response to the previous SELECT command. You are not returning any data to the SELECT command, but the terminal side seems to insist on getting one.
The GetResponse command should not be passed to the Applet by your card operating system, I consider this a bug.
If you return data when selectingApplet() returns true, then you probably will not have any problem.

Clearing byte array field

Hello all,
I've encountered a problem in trying to reset fields in my applets which I just can't figure out, I'd appreciate some help with it.
Basically I have a method in a base class for my applets which sets the fields in my card. This works fine, the problem I have is when I tried to alter this method so that if the command APDU received does not contain the data field(i.e. a Case 2 APDU, 5 bytes long), then the designated byte array is set to null. The code is shown below.
// Method in applet
public void setSurname(APDU apdu) {
surname = setByteArrayVariable(apdu);
// Method in applets' base class
public byte[] setByteArrayVariable(APDU apdu) {
byte[] apduBuffer = apdu.getBuffer();
short len = apduBuffer[ISO7816.OFFSET_LC];
byte[] arrayname = null;
if(len != (short)0){
arrayname = new byte[len];
// copy buffer data into byte[]
short bytesRead = apdu.setIncomingAndReceive();
short Offset = (short)0;
while (bytesRead > 0) {
Util.arrayCopy(apduBuffer, ISO7816.OFFSET_CDATA, arrayname, Offset, bytesRead);
Offset += bytesRead;
bytesRead = apdu.receiveBytes(ISO7816.OFFSET_CDATA);
return arrayname;
What happens when I send the Case 2 APDU to the applet is that the CLA and INS bytes direct the apdu to the proper method to set the field and the byte array is set to null(success). At this point I expect the JCRE to return the sw 9000, however what actually happens is the applet throws the ISOException defined in the default case of the process method. Also I checked this method in the gemplus simulator and it works as expected, its only when I tried it in a GXP211_PK_IS card that the problem occurred, I've asked the Gemplus support about this but as yet have not heard anything in response. I cannot explain why this is happening, has anybody got any suggestions? Thanks,
Tony

The status word which is returned is 6D00(INS not supported), as this is what I throw in the process method when the switch doesn't match the INS byte with any of the cases. This is where my confusion comes from, if the method is called(through matching the CLA and INS bytes) how is it that after the method is completed(successfully, as the field is set to null) that the exception is thrown form the process method as if the method wasn't found? I have a workaround whereby instead of throwing the 6D00 I throw the ISO7816.SW_NO_ERROR in the default case of my process method, this can only be a temporary workaround though!!
I'm guessing that you check for surname != null later on ? I do check this but only when I'm trying to retrieve the surname from the card, basically, if(surname == null)ISOException.throwIt(ISO7816.SW_FILE_NOT_FOUND);
Doesn't sound like thats what you're getting at though??
(Will sort out the memory allocation, cheers.)
TIA for any help you can provide, leaving now for the day but hoping to hear from you tomorrow :)
Tony

Handling proprietary APDUs in an STK applet

Hello all,
I have developed a working STK applet, including a menu etc.
I also need this applet to accept proprietary APDUs from the GSM-phone. The way I understand that this should work, is that I have to SELECT my applet first (APDU: 00 a4 04 00 <AID length> <AppletAID>), and only then will the JCRE present my proprietary APDU to the applet.
This actually works: after SELECTing the applet, my custom APDU is presented to the 'process' method of the applet.
However, all STK events (eg menu-selection) are now presented to the process-method too, and no longer to the 'processToolkit' method as I had expected. Obviously this means that my applet stops functioning correctly as soon as I have SELECTed it.
Am I doing something wrong? What is the correct way of making a STK applet respond to both STK APDUs and custom APDUs?
Many thanks in advance,
JimboKarmeliet

Thanks for the feedback joscar.
I finally managed to get it to work. It took me a while to realise that the data-part of the envelope APDU also requires a length byte, even if the envelope is "unrecognized" (silly me, yes, I know). So this is what the command should look like (for GSM SIMs):
A0 C2 00 00 <TotalLen><UnkownTLV><DataLen><Data>
Example:
A0 C2 00 00 09 4E 07 12 34 56 78 90 12 34
With 4E being an invalid TLV (and 09 and 07 the obvious length bytes).
I do have one remark, though. I read the 03.19 spec, to check for reserved (BER-)TLV values, and could find no objection to e.g. 0x4F. Perhaps I missed it, but I thought this could be used. However, the applet was not being triggered, and the SIM returned an error (6F 00).
By accident I found in the 101 220 spec that 4F is indeed also reserved, as are most other values!
So my question is this: which values in the range 0x00-0xFF are still available for unrecognized envelope events, and will remain not-reserved in the wide future? I really can't find it in the specs.
Thanks all,
Jimbo.

Exchanging APDU's with selected applet fails

Hi all,
1. I developed a cardlet( normal, sample one) using JCOP
2. Installed, selected and excanged APDU's with this applet ( on Nokia 6212,6131 and JCOP cards)
3. Now i tried it on a SE of SIM. In this case, installation and selection succeeds but exchanging APDU's with selected applet is partial. by 'partial' what i mean is:
i am using 0x90 as CLA byte for personalisation (now i am not checking the CLA byte from cardelt code)
private static final byte STORE=0x01;
private static final byte GET=0x02; , and these are INS values for getting and storing personalisation data.
if i send STORE command like */send 90010000084142434445464748* (8 data bytes ), only first 5 bytes are being transferred to applet (i tested this fact by returning the buffer(apdu.getBuffer()) length from process(APDU apdu) function ), not the actual data. ie, only CLA, INS, P1, P2, and LC fields are being transferred to applet. so, currently the actual personlisation data is not been transferred to selected applet.
Is there any specific data format that has to be send to a selected applet ?
or
In which point i am going wrong ?
This is the cardlet code i'm using
import javacard.framework.APDU;
import javacard.framework.ISO7816;
import javacard.framework.Applet;
import javacard.framework.ISOException;
import javacard.framework.Util;
public class TestCard extends Applet
    private static final byte STORE=0x01;
    private static final byte GET=0x02;
    private static byte personalized=0x00;
    private static byte[] value=null;
   // private static byte testByte;
    public static void install(byte[] bArray, short bOffset, byte bLength)
        // GP-compliant JavaCard applet registration
        new TestCard().register(bArray, (short) (bOffset + 1), bArray[bOffset]);
    public void process(APDU apdu)
        // Good practice: Return 9000 on SELECT
        if (selectingApplet())
            return;
        byte[] buf = apdu.getBuffer();
        switch (buf[ISO7816.OFFSET_INS])
            case STORE:
                value=new byte[buf[ISO7816.OFFSET_LC]];
                //testByte=(byte)buf.length;
                Util.arrayCopy(buf, (short)(ISO7816.OFFSET_LC+1), value, (short)0, buf[ISO7816.OFFSET_LC]);
                personalized=(byte)0x01;
                break;
            case GET:
                if(personalized==0x00)
                    ISOException.throwIt((short)0x6999);
                    break;
                //value=new byte[]{testByte};
                apdu.setOutgoing();
                apdu.setOutgoingLength((short)value.length);
                apdu.sendBytesLong(value, (short)0, (short)value.length);
                break;
            default:
                // good practice: If you don't know the INStruction, say so:
                ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
}and this is the JCOP script i'm using
/echo Opening terminal
/terminal "winscard:4|OMNIKEY CardMan 5x21-CL 0"
/echo Resets card
/atr
/echo Selecting TestCard Applet
/select 11223344556600
/echo Sending 8-byte Personalisation data ABCDEFGH (4142434445464748)
/send 90010000084142434445464748
/echo Reading personalised data
/send 90020000and the output trace is
/echo Opening terminal
Opening terminal
/terminal "winscard:4|OMNIKEY CardMan 5x21-CL 0"
--Opening terminal
/echo Resets card
Resets card
/atr
--Waiting for card...
ATR=3B 88 80 01 01 02 03 04 00 81 C0 00 4C             ;...........L
/echo Selecting TestCard Applet
Selecting TestCard Applet
/select 11223344556600
=> 00 A4 04 00 07 11 22 33 44 55 66 00 00             ......"3DUf..
(84234 usec)
<= 90 00                                              ..
Status: No Error
/echo Sending 8-byte Personalisation data ABCDEFGH (4142434445464748)
Sending 8-byte Personalisation data ABCDEFGH (4142434445464748)
/send 90010000084142434445464748
=> 90 01 00 00 08 41 42 43 44 45 46 47 48             .....ABCDEFGH
(168449 usec)
<= 90 00                                              ..
Status: No Error
/echo Reading personalised data
Reading personalised data
/send 90020000
=> 90 02 00 00                                        ....
(22838 usec)
<= 00 00 00 00 00 00 00 00 90 00                      ."3DUf.... // here not getting the actual needed data.
Status: No ErrorThanks and regards
Sunil

Hi all,
after lot of trial and error and research, i found that in the above code, i am not using
apdu.setIncomingAndReceive();this is where the problem lies. i set incoming mode after reading the apdu buffer and the problem solved.
thanks and regards
sunil

Proprietary APDU CLA byte

Similar Messages

Maybe you are looking for