Michael Bender forwarded: > From: Joseph Smith <[EMAIL PROTECTED]> --- snip --- > Why can't you read a serial number ? In global platform, I like that fact > that you must authenticate to the card to have access to a serial number. > Consider me a bit paranoid, but that added security makes me feel better > about the cards. What end-users needs to know the serial number of their > card ? Even the DoD CAC card prints a serial number on the back of the card, > but they don't know anything about it. > How is that the fault of the card vendors ? > Some key diversification methods really do need the card serial number, as it may be the only item of information that they hope to rely on.
I guess two things are mixed up:
1) the card serial number is present in the CPLC string readable with Get Data 9F7Fh, the use of this command can require authentication.
2) the mutual authentication starts with an Initialise Update, in input the host sends its random, in response the card provide some diversification data that include the same card serial number (that can be used by the host to compute static keys from master ones, before computing session keys).
OOH, reading the list of available applications is _always_ under protection of such authentication, that is pity since it prevents a driver to rely on application AID to wake up/enable/... services offered by known applications.
--- snip --- > >>Still some cards use A0000000030000 and others A000000003000000 but > >>selection with partial AID is supported by most of them so "A000000003" > >>can work as well. > That "hack" as you referred to it isn't a hack. If you had to enter the > whole AID every time you selected the applet, you would complain that there > should be a way to enter a partial. Besides, I've never seen partials used > in deployment, only in developement when it's a pain to type the complete > AID. In deployment, the middleware will know the full AID. Again, that has > nothing to do with the user at Radio shack, but the techies. How is that > the fault of the card vendors ? But isn't that partail an adoption of the > standard anyway ? AID = RID + PIX. RID is fixed, PIX can be used to differentiate between apps. eURI (CEN/ISSS CWA 13987:2003) uses CEN's RID + "URI" as 1st 3 bytes of PIX, and that is the partial AID that must be used to select the eURI app on the card. (Last 3 bytes of PIX can then be used to denote versions, etc.)
AID are (obviously) also define in older standards (including ISO7816-5).
in current case "A000000003" is the registered RID for VISA Int.
it seems that Card Manager version <= 2.0.1 uses PIX = "0000"
and version >= 2.1 will use "000000" but I'm not fully sure of that, if it's the case:
- yes, PIX can be used to denote versions (or set of functionality for a generic product - VISA as well as MasterCard often use this "technique")
- yes, selection of CM by partial AID is safe and reliable.
Sylvain.
---
Visit the OpenCard web site at http://www.opencard.org/ for more information on OpenCard---binaries, source code, documents. This list is being archived at http://www.opencard.org/archive/opencard/
! To unsubscribe from the [EMAIL PROTECTED] mailing list send an email
! to
! [EMAIL PROTECTED]
! containing the word
! unsubscribe ! in the body.
