Smart Card Handbook

Team DDU......Page 1
Contents......Page 8
Preface to the Third Edition......Page 16
Symbols and Notation......Page 18
Program Code Conventions......Page 20
Abbreviations......Page 22
1 Introduction......Page 36
1.1 The History of Smart Cards......Page 37
1.2 Application Areas......Page 40
1.2.2 Microprocessor cards......Page 41
1.2.3 Contactless cards......Page 43
1.3 Standardization......Page 44
2.1 Embossed Cards......Page 50
2.2 Magnetic-stripe Cards......Page 51
2.3 Smart Cards......Page 53
2.3.1 Memory cards......Page 54
2.3.2 Microprocessor cards......Page 55
2.3.3 Contactless smart cards......Page 56
2.4 Optical Memory Cards......Page 58
3.1 Physical Properties......Page 62
3.1.1 Card formats......Page 63
3.1.2 Card components and security features......Page 66
3.2 The Card Body......Page 73
3.2.1 Card materials......Page 75
3.2.2 Chip modules......Page 77
3.3 Electrical Properties......Page 87
3.3.1 Electrical connections......Page 88
3.3.2 Supply voltage......Page 90
3.3.3 Supply current......Page 93
3.3.5 Data transmission......Page 95
3.3.6 Activation and deactivation sequences......Page 96
3.4 Smart Card Microcontrollers......Page 97
3.4.1 Processor types......Page 101
3.4.2 Memory types......Page 105
3.4.3 Supplementary hardware......Page 115
3.5 Contact-type Cards......Page 126
3.6 Contactless Cards......Page 128
3.6.1 Close-coupling cards: ISO/IEC 10536......Page 136
3.6.2 Remote-coupling cards......Page 142
3.6.3 Proximity integrated circuit(s) cards: ISO/IEC 14 443......Page 143
3.6.5 Test methods for contactless smart cards......Page 188
4 Informatic Foundations......Page 190
4.1 Structuring Data......Page 191
4.2.2 8-bit code......Page 196
4.2.4 32-bit code (UCS)......Page 198
4.3 SDL Notation......Page 199
4.4 State Machines......Page 200
4.4.2 Practical applications......Page 201
4.5 Error Detection and Correction Codes......Page 204
4.5.1 XOR checksums......Page 206
4.5.2 CRC checksums......Page 207
4.5.4 Error correction......Page 209
4.6 Data Compression......Page 211
4.7 Cryptology......Page 212
4.7.1 Symmetric cryptographic algorithms......Page 217
4.7.2 Asymmetric cryptographic algorithms......Page 224
4.7.3 Padding......Page 234
4.7.4 Message authentication code and cryptographic checksum......Page 236
4.8.1 Derived keys......Page 237
4.8.4 Dynamic keys......Page 238
4.8.5 Key parameters......Page 239
4.8.6 Key management example......Page 241
4.9 Hash Functions......Page 243
4.10 Random Numbers......Page 245
4.10.1 Generating random numbers......Page 246
4.10.2 Testing random numbers......Page 248
4.11 Authentication......Page 251
4.11.1 Symmetric unilateral authentication......Page 253
4.11.2 Symmetric mutual authentication......Page 254
4.11.3 Static asymmetric authentication......Page 257
4.11.4 Dynamic asymmetric authentication......Page 258
4.12 Digital Signatures......Page 260
4.13 Certificates......Page 264
5 Smart Card Operating Systems......Page 268
5.1 Historical Evolution of Smart Card Operating Systems......Page 269
5.2 Fundamentals......Page 272
5.3 Design and Implementation Principles......Page 277
5.4 Completion......Page 280
5.5 Memory Organization......Page 284
5.6 Smart Card Files......Page 287
5.6.1 File types......Page 289
5.6.2 File names......Page 292
5.6.3 File selection......Page 296
5.6.4 EF file structures......Page 298
5.6.5 File access conditions......Page 302
5.6.6 File attributes......Page 305
5.7 File Management......Page 306
5.8 Sequential Control......Page 314
5.9 Access to Resources in Accordance with ISO/IEC 7816-9......Page 315
5.10 Atomic Operations......Page 323
5.11 Open Platform......Page 325
5.12 Downloadable Program Code......Page 328
5.13 Executable Native Code......Page 331
5.14 Open Platforms......Page 337
5.14.1 Java Card......Page 338
5.14.2 Multos......Page 357
5.14.4 Windows for Smart Cards......Page 358
5.14.5 Linux......Page 359
5.15 The Small-OS Smart Card Operating System......Page 361
6 Smart Card Data Transmission......Page 406
6.1 The Physical Transmission Layer......Page 408
6.2 Answer to Reset (ATR)......Page 412
6.2.1 ATR characters......Page 414
6.2.2 Practical examples of ATRs......Page 424
6.3 Protocol Parameter Selection (PPS)......Page 427
6.4 Data Transmission Protocols......Page 431
6.4.1 Synchronous data transmission......Page 432
6.4.2 The T = 0 transmission protocol......Page 438
6.4.3 The T = 1 transmission protocol......Page 444
6.4.4 The T = 14 transmission protocol (Germany)......Page 454
6.4.5 The USB transmission protocol......Page 455
6.5 Message Structure: APDUs......Page 456
6.5.1 Structure of the command APDU......Page 457
6.5.2 Structure of the response APDU......Page 459
6.6 Securing Data Transmissions......Page 460
6.6.1 The authentic mode procedure......Page 464
6.6.2 The combined mode procedure......Page 465
6.6.3 Send sequence counter......Page 467
6.7 Logical Channels......Page 469
7 Smart Card Commands......Page 470
7.1 File Selection Commands......Page 474
7.2 Read and Write Commands......Page 477
7.3 Search Commands......Page 485
7.4 File Manipulation Commands......Page 487
7.5 Identification Commands......Page 488
7.6 Authentication Commands......Page 492
7.7 Commands for Cryptographic Algorithms......Page 497
7.8 File Management Commands......Page 503
7.10 Commands for Completing the Operating System......Page 509
7.11 Commands for Hardware Testing......Page 512
7.12 Commands for Data Transmission Protocols......Page 516
7.13 Database Commands: SCQL......Page 517
7.14 Commands for Electronic Purses......Page 521
7.15 Commands for Credit and Debit Cards......Page 524
7.16 Application-Specific Commands......Page 525
8.1 User Identification......Page 526
8.1.1 Testing a secret number......Page 528
8.1.2 Biometric methods......Page 533
8.2 Smart Card Security......Page 545
8.2.1 A classification of attacks and attackers......Page 546
8.2.2 Attacks and defensive measures during development......Page 552
8.2.3 Attacks and defensive measures during production......Page 555
8.2.4 Attacks and defense measures while the card is in use......Page 556
9 Quality Assurance and Testing......Page 600
9.1 Card Body Tests......Page 601
9.2 Microcontroller Hardware Tests......Page 608
9.3 Evaluating and Testing Software......Page 609
9.3.1 Evaluation......Page 610
9.3.2 Test methods for software......Page 616
9.3.3 Dynamic testing of operating systems and applications......Page 624
10 The Smart Card Life Cycle......Page 632
10.1 The Five Phases of the Smart Card Life Cycle......Page 633
10.2.1 Generating the operating system and producing the chip......Page 635
10.2.2 Producing card bodies without integrated coils......Page 647
10.2.3 Producing card bodies containing integrated coils......Page 656
10.2.4 Combining the card body and the chip......Page 663
10.3 Phase 2 of the Life Cycle in Detail......Page 665
10.4 Phase 3 of the Life Cycle in Detail......Page 673
10.5 Phase 4 of the Life Cycle in Detail......Page 685
10.6 Phase 5 of the Life Cycle in Detail......Page 687
11 Smart Card Terminals......Page 690
11.1 Mechanical Properties......Page 695
11.2 Electrical Properties......Page 698
11.3 Security Technology......Page 700
11.4.1 PC/SC......Page 702
11.4.2 OCF......Page 706
11.4.4 MUSCLE......Page 707
12 Smart Cards in Payment Systems......Page 708
12.1.1 Electronic payments with smart cards......Page 709
12.1.2 Electronic money......Page 714
12.1.3 Basic system architecture options......Page 716
12.2 Prepaid Memory Cards......Page 719
12.3.1 The CEN EN 1546 standard......Page 720
12.3.2 Common Electronic Purse Specifications (CEPS)......Page 736
12.3.3 Proton......Page 737
12.3.4 The Mondex system......Page 738
12.4 The EMV Application......Page 743
12.5 The Eurocheque System in Germany......Page 749
13 Smart Cards in Telecommunications......Page 758
13.1.1 Multiple-access methods......Page 762
13.1.2 Cellular technology......Page 765
13.1.3 Cell types......Page 767
13.1.4 Bearer services......Page 768
13.2 The GSM System......Page 770
13.2.1 Specifications......Page 772
13.2.2 System architecture and components......Page 775
13.2.3 Important data elements......Page 776
13.2.4 The subscriber identity module (SIM)......Page 780
13.2.5 General Packet Radio System (GPRS)......Page 821
13.2.6 Future developments......Page 822
13.3 The UMTS System......Page 824
13.4 Microbrowsers......Page 829
13.5 The Wireless Identification Module (WIM)......Page 837
13.6 Public Card Phones in Germany......Page 839
14.1 Contactless Memory Cards for Air Travel......Page 846
14.2 Health Insurance Cards......Page 849
14.3 Electronic Toll Systems......Page 854
14.4 Digital Signatures......Page 857
14.5 The PKCS #15 Signature Application......Page 868
14.7 Tachosmart......Page 875
15.1.1 Microcontrollers......Page 878
15.1.2 Applications......Page 881
15.1.3 System considerations......Page 883
15.2 Formulas for Estimating Processing Times......Page 885
15.3 Timing Formulas for Typical Smart Card Commands......Page 893
15.4 Typical Command Processing Times......Page 895
15.5 Application Development Tools......Page 899
15.6 Analyzing an Unknown Smart Card......Page 903
15.7 Life-Cycle Models and Process Maturity......Page 905
15.7.1 Life-cycle models......Page 909
15.7.2 Process maturity......Page 917
15.8 The Course of a Smart Card Project......Page 920
15.9 Design Examples for Smart Card Applications......Page 921
15.9.1 An electronic purse system for arcade games......Page 923
15.9.2 Access control system......Page 925
15.9.3 Testing the genuineness of a terminal......Page 929
16.1 Glossary......Page 932
16.3 Literature......Page 1020
16.4 Annotated Directory of Standards and Specifications......Page 1029
16.5.1 Data objects compliant with ISO/IEC 7816-4......Page 1065
16.5.2 Data objects compliant with ISO/IEC 7816-6......Page 1066
16.7 Selected RIDs......Page 1067
16.8 Trade Fairs, Conferences and Conventions......Page 1068
16.9 World Wide Web Addresses......Page 1069
16.10.2 ATR parameter conversion tables......Page 1079
16.10.4 Sampling times for serial data......Page 1081
16.10.5 The most important smart card commands......Page 1082
16.10.6 Summary of utilized instruction bytes......Page 1086
16.10.7 Smart card command coding......Page 1088
16.10.8 Smart card return codes......Page 1091
16.10.9 Selected chips for memory cards......Page 1093
16.10.10 Selected microcontrollers for smart cards......Page 1095
Index......Page 1102