I've had several requests to clarify the Cyberflex atr issue.  It's pretty
confusing.

Cyberflex has two atrs.  One is called the "default loader atr" and the
other is called the "java atr."  If you have selected an applet to run at
reset, via the ManageInstance apdu InitCurrent option, then you'll get the
java atr.  If not, you'll get the default loader atr.

The default loader atr can't be changed.  The java atr is made up of three
parts, one of which is fixed, one is set by use of the ChangeJavaATR apdu,
and one of which is determined in an obscure and stupid way by the applet
itself.  As shipped from the factory, the java atr is not a valid 7816 atr.
If you forget to change it, or you change it to something that's invalid,
you won't be able to talk to the card using standard muscle drivers.

To make matters worse, the ChangeJavaATR apdu is not protected in any way,
so anyone can disable a Cyberflex card by setting an invalid atr.  You don't
need to validate any keys to do this.

So it makes sense to have a reader driver handy that can talk to a card with
an invalid atr.

I have seen other cards with invalid atrs, usually too many or not enough
historical bytes.  I haven't been keeping a list so I can't name names.
***************************************************************
Linux Smart Card Developers - M.U.S.C.L.E.
(Movement for the Use of Smart Cards in a Linux Environment)
http://www.linuxnet.com/smartcard/index.html
***************************************************************

Reply via email to