crc32

NXP do a crc32 on 3D00000000120000010203040506070809101112131415161718 and get 0x9C1AF759

most crc32 give 0xa608e563 ..
eg :
fileformat.info/tool/hash All the hash you want...
networkdls
java.util.zip.CRC32;

I wonder what CRC32 they are using??

DESFire and King Croesus

DESFire Authentication and Key Derivation

Now Available!


_________________________________________________________________________

"rich as Croesus"
either very fine powder of the gold straight from the mines, or else get bigger pieces of old gold and hammer it out into very thin sheets - a bit like the old-fashioned cigarette papers - and then put these in a pot along with common salt, that's sodium chloride. And then heat that in a furnace to about 800 degrees centigrade, and ultimately you are left with pretty pure gold."
So the Lydians learned how to make pure gold coins. But no less importantly, they then employed craftsmen to stamp on them symbols indicating their weight, and thus their value. These first coins have no writing on them - dates and inscriptions on coins were to come much later - but archaeological evidence allows us to date our coins to around 550 BC, so the middle of Croesus's reign.


Gold Coin of Croesus, Kig of Lydia 550BC Turkey

- Once cards send money to each other, the reign of Croesus is finally over
_______________________________________________

Compile a Java Card Applet, Load onto JCOP card, execute..

ok this is how to
Compile a Java Card Applet, Load onto JCOP card, execute..

Applet Source is in \card\src\joe\Fred.java
joe is the package

Batch file to make CAP
_________________________________________________________
prompt $g
set JC_HOME=C:\card\java_card_kit-2_2_1
:: CARE set JAVA_HOME does NOT change javac version
set JAVA_HOME="C:\Program Files\Java\jre1.5.0_05"
set PATH=.;%JC_HOME%\bin;%JAVA_HOME%\bin;%PATH%
:: path overkill?
cd \card\src\joe
C:\card\jsdk13\bin\javac -g -classpath ".;%JC_HOME%\lib\api.jar" Fred.java
:: this JCOP card uses javacard 2.2.1 and javac 1.3
:: j1.5 gives: unsupported class file format of version 49.0.
:: nb classpath api.jar does give access to javacard.framework
set _CLASSES=C:\card\java_card_kit-2_2_1\lib\apduio.jar;C:\card\java_card_kit-2_2_1\lib\api.jar;C:\card\java_card_kit-2_2_1\lib\capdump.jar;C:\card\java_card_kit-2_2_1\lib\converter.jar;C:\card\java_card_kit-2_2_1\lib\offcardverifier.jar;
:: do this once only ......... xcopy /S C:\card\java_card_kit-2_2_1\api_export_files\*.* exp\
cd \card\src\
java -classpath "%_CLASSES%" com.sun.javacard.converter.Converter -config Fred.opt
____________________________________________________
You have to hunt around Oracle's archives to find the JDK1.3

____________________________________________________

____________________________________________________

Fred.opt


____________________________________________________
-out EXP JCA CAP
-exportpath joe\exp
-applet 0x1:0x0:0x0:0x0:0x1:0x3:0x1:0x0:0x1:0x1 joe.Fred
joe
0x1:0x0:0x0:0x0:0x1:0x3:0x1:0x0:0x1 1.0
____________________________________________________

Any old AID will do, but there are international Company standards in the Real World

To load the CAP I use jcManager
later on I'll try to do a low level load
Install for load etc etc
gpshell didnt load the HelloWorld that jcManager did,
so expect more difficulties

____________________________________________________
____________________________________________________

anubis script to run the Applet
(I copied CLA 80 and INS 20 from a wallet program)
I guess they can be anything...

____________________________________________________
atr = open();
prints(atr);
prints(" Select joe ");
cmd = new ApduCmd("00A404000A0100000001030100010100");
card_response = execute(cmd);
prints(card_response);
prints(" Get Data ");
cmd = new ApduCmd("B020000008111213141516171800");
card_response = execute(cmd);
prints(card_response);
____________________________________________________
right now the Applet just returns 2 bytes.
Now to get it to do Something interestng.
....
Also I would like to get NetBeans Card going with javac 1.3 and jcdk 2.2.1
 - is that even possible??

JavaCard CAP converter

Many problems trying to compile, Convert & Load a Java Applett onto a JCOP card

some lines from batch file

:: Compile the .java file
prompt $g
set JC_HOME=C:\card\java_card_kit-2_2_1
::set JAVA_HOME="C:\Program Files\Java\jre1.5.0_05"
set JAVA_HOME=\card\jre13
:: java 1.3 unsupported class file format of version 50.0.
:: java 1.5 gives eror  unsupported class file format of version 50.0.

set PATH=.;%JC_HOME%\bin;%JAVA_HOME%\bin;%PATH%
cd \card\src\joe
java -version
pause
javac -g  -classpath C:\card\java_card_kit-2_2_1\lib\javacardframework.jar Fred.java
pause
set _CLASSES=C:\card\java_card_kit-2_2_1\lib\apduio.jar;C:\card\java_card_kit-2_2_1\lib\api.jar;C:\card\java_card_kit-2_2_1\lib\capdump.jar;C:\card\java_card_kit-2_2_1\lib\converter.jar;C:\card\java_card_kit-2_2_1\lib\offcardverifier.jar;
::xcopy /S C:\card\java_card_kit-2_2_1\api_export_files\*.* exp\
:: this sems extreme  ....to copy !!!
java -classpath "%_CLASSES%" com.sun.javacard.converter.Converter -config Fred.opt








- so far havnt found the right combo of jcdk & jre

newer jcdk gave errors on CAP load...
they say JCOP can NOT do UNencrypted loads so we cant inspect the payload???

plan:
go back to
http://lavamunky.wordpress.com/2010/03/28/java-card-prog-compile/#comment-69



lavamonkey  - why does blogsearch not find monkey??
lava monkey  javacard compile - will blogsearch find this??

Java Swing/AWT  and Waiting for a Card
You need to use a "SwingWorker" which is a kind of Thread.

If not, your screen refreshes will freeze.

The main will need to be "invokeLater"

I wish Java AWT could do threads in a more simple fashion,

but this is how it is

    SwingWorker<String, String> waitForCard = null;
    String tap = "Tap";


    private void buttonPress(java.awt.event.ActionEvent evt)                          
    {                              


        jTextArea1.setBackground(Color.white);
        jButton1.setEnabled(false);
        jTextArea1.setText(tap);


        final String badRead = "badRead";
//SW SW SW SW SW SW SW SW SW SW SW SW SW SW SW SW 


        waitForCard = new SwingWorker<String, String>()
        {
            public String doInBackground()
            {
                do
                {
                    waitCard();  // waits for a card on the NFC card reader
                    if (this.isCancelled())
                           return("cancelled");
                }
                while ( rbal.contentEquals(badRead) );  // rbal example is Card BAlanc
                publish(rbal);   
 //publish an update, this will get added to a list and
// processed in bulk by the process() method at some point
/ ie if we want a sequence, eg clear the field after one second, do the work, publish
then "done" does the final clear


                waitCardGone();




                try {
                    Thread.sleep(1500);


                } catch (InterruptedException e) {
                    return("rupt");    // never seen?
                }


                return("blank");


            }
            @Override
            protected void process(List<String> chunks) {
                jTextArea1.setText(chunks.get(0));  // display your data
            }


            @Override
            protected void done()
            {
            jTextArea1.setText("");  // clear the text after 1.5 seconds
            jTextArea1.setBackground(mgreen);
            jButton1.setEnabled(true);


            } // done
        };    //waitForCard definition fin
//SW SW SW SW SW SW SW SW SW SW SW SW SW SW






        waitForCard.execute();


    }                         

----------------------------------------------------------------------------------

public static void main(String args[])

    {

        java.awt.EventQueue.invokeLater(new Runnable()

        {

            public void run()

            {

                Framek f = new Framek();

                f.setLocation(Uti.centrePoint(f));

                f.setTitle("Card Balance ");

                f.setVisible(true);

                f.initk();  // initialise stuff

             }

        });

    }

NFC feuding, Symmetric vs PKC

NFC feuding

NXP’s Gingerbread Coup Leaves Rivals With a Bitter Taste     Dec 20 2010 

If Gingerbread supports Mifare, the most popular technology used for transit ticketing, it would put Inside at a significant disadvantage to supply NFC chips with secure elements, since NXP has declined to grant Inside a Mifare license. Of course, Inside faces a problem supplying chips for any NFC phone that supports Mifare, unless it partners with a Mifare licensee. Any Mifare support in Gingerbread is also expected to favor suppliers of Mifare tags.
....
Many in the industry, including telcos and service providers, are disappointed with the few tag-reading commands that Gingerbread and the first handset using it, the Nexus S, so far supports. “This API is useless for us,” said one telco, according to a source. Many telcos want to support retail payment, either hosting applications from banks or running the payment scheme themselves.

nfctimes
____________________________________________________________

future Symmetric Crypto should definitely be at least AES128
proprietary short keys are dangerous:
WikiPedia: "clone any MIFARE Classic card in not more than 10 seconds"

current 112 bit "triple DES" will surely be orphaned... will anyone continue to optimise DES chips?
........................

With symmetric crypto algorithms, NFC payment schemes currently require secret keys on Card and Reader.

Something like this:
1) Card to reader send Random1, and requested $ amount.
2) Reader to Card send encrypted Random1, send Random2 Card trusts Reader
3) Card to Reader send Encrypted Random2 Reader trusts Card (constructs card session key
4) Reader to Card send Send Signed transaction Card sure that transaction is complete
"Tearaway" logic must be in place in the reader if this sequence is broken.
.................................

If PKC were adopted
1) Card sends signed Amount to Reader Reader trusts card
2) Reader sends signed Acceptance to Card Card trusts Reader and completes transaction

Some nonce with known structure would be included in the signature




PKC (eg RSA public key) would mean
No Common Secret Key would be loaded onto Card
Each card could generate its own secret key, which would never leave the card.

A certification structure wold be required, to guard public keys. Note this is a lower order cryptographic problem.
Fast Large Integer Hardware arithmetic would be required.
 A desktop can validate a PKC signature in < 10msec, not sure about NXP speed.

Is it is possible to use symmetric crypto in a 2 stage transaction?
1) card sends amount & random & encrypted random Reader trusts Card (based on shared secret key
this exposes known plaintext, whereas the 4-step allows for 'session' keys. which are calculated using CardID.
The Card's key is derived from its ID so breaking one card doesnt break all,
So in practice a 4 step transaction is used.

I expect that PKC will eventually replace symmetric crypto.

Initialising cards with Secret Keys is an arduous and anxious process.

NSW TCard, OSPT GEMALTO M-pesa

NSW smart cart in court Elisabeth Sexton December 8, 2010
THE NSW cabinet.. $300 million litigation over the abandonment of a transport smartcard developed by the former .. ERG Ltd.
...
The appeal, .. relates to a decision by Justice Clifford Einstein in June giving ERG access to most, but not all, documents relevant ..

The government is suing ERG for $77 m ... Tcard contract. ERG has countered $215 m..

ERG was delisted .. last year
Ingot Capital ..run by Duncan Saville, which was ERG's largest shareholder ..


____________________________________________________________

London buses to go contactless (thought they already were?)
07 December, 2010 - 13:33
..from early 2012 and on the Underground around a year or so later,"
..visitors to London or occasional users to avoid the need to purchase an Oyster card,..
..
Barclaycard launched a combined contactless Oyster travel and debit card, OnePulse, in 2007.
..save TfL money on the commission it currently has to pay Oyster operators
...France, with Giesecke & Devrient, Infineon Technologies, Inside Secure and Oberthur Technologies announcing OSTP..
finextra
_______________________________________________
snapper
Google phone not so smart
__________________________________________

The Open Standard for Public Transport (OSPT) Alliance, ...two new members: Watchdata Technologies Ltd. and the Open Ticketing Institute of the Netherlands.

...interoperable transit fare collection solutions based on open standard security.

Founded in Beijing in 1994, Watchdata provides a range of products including smart cards, USB tokens, readers, .....

The Open Ticketing Institute ...to advance The Netherland’s e-ticketing system, OV-chipkaart. As a separate not-for-profit foundation..

The new open security standard, Cipurse, defines an authentication scheme, a secure messaging protocol, four minimum mandatory file types and a minimum mandatory command set to access these files types. It also specifies encryption keys and access conditions, and includes a cryptographic protocol that protects against differential power analysis (DPA) and differential fault analysis (DFA).

contactlessnews
pcworld
osptalliance
calypsotechnology
waazaa 14443-3.pdf
____________________________________
2010 SESAMES winner unveiled
notably:
"SESAMES IT SECURITY: The winner is GEMALTO with eGo. eGo gives access to services in touching objects with any parts of your body. It has no defined form factor and may be any object you should carry close to your body. The message wakes up a secure element and a usual wireless communication means."
- if I understood this I believe I would be excited (italics NOT in original)
secureidnews


________________________________________
Odd Java Hints:...
private static void PreserveStackTrace(Exception exception)
{
MethodInfo preserveStackTrace = typeof(Exception).GetMethod("InternalPreserveStackTrace",
BindingFlags.Instance | BindingFlags.NonPublic);
preserveStackTrace.Invoke(exception, null);
}
____________________________________
M-Pesa

since 2007, Kenya ... phone technology..
..M-Pesa ...those without a bank account to transfer funds .. a text message.
..Vodafone and Safaricom...Pesa is Swahili for money.
50% use the service to send money to..relatives, to pay for shopping..taxi ride ..
..
"The bank in my phone"
..register with Safaricom at an M-Pesa outlet... load money onto their phone. ..sent onto a third party by text message.
The recipient takes the phone to their nearest vendor,... pick up the cash.
..Mr Makusi says he no longer has to worry about being mugged while carrying cash.
..Seema Desai, director of the Mobile Money for the Unbanked (MMU)..
..Nick Hughes and Susie Lonie.. M-Pesa. .. Economist Innovation award..
...payment to the thousands of small one or two-cow milk producers.. decided to create a payment system using M-Pesa.
... Smart and Globe were active on a smaller scale in the Philippines in 2002
... March 2010 28.59bn (KES) $351m) was transferred using the service.
.. launched in Tanzania, Afghanistan and now South Africa, with trials underway in India.
.. One company that does let you pay with your mobile is Boku...buy virtual money..??? 65 countries..




The Bill and Melinda Gates Foundation has committed $500 million (Sh40 billion) over five years
..Global Savings Forum held in Seattle
..
.."In Kenya, M-Pesa is showing what storing and transferring money on mobile phones can do for poor people... at an enormous scale" Mrs Gates told the gathering.
..
.. $4.8 million (Sh384 million) will be used to expand M-Pesa into Tanzania
...mobile money transfer service had helped Kenyans cope with disasters better.
..
ShoreBank International..in Bangladesh will receive $10 million .. introducing bKash .. to be launched in .. March 2011.
..
nation

_________________________________________________
NFC:
Japan and South Korea ..in use for several years
Verizon, AT&T, and T-Mobile.. NFC system called Isis by 2012,
..Google Gingerbread smartphone, will have NFC technology
November 17, 2010
By ANTONY KARANJA in DALLAS TEXAS
bbc