JavaCard CAP converter

Many problems trying to compile, Convert & Load a Java Applett onto a JCOP card

some lines from batch file

:: Compile the .java file
prompt $g
set JC_HOME=C:\card\java_card_kit-2_2_1
::set JAVA_HOME="C:\Program Files\Java\jre1.5.0_05"
set JAVA_HOME=\card\jre13
:: java 1.3 unsupported class file format of version 50.0.
:: java 1.5 gives eror  unsupported class file format of version 50.0.

set PATH=.;%JC_HOME%\bin;%JAVA_HOME%\bin;%PATH%
cd \card\src\joe
java -version
pause
javac -g  -classpath C:\card\java_card_kit-2_2_1\lib\javacardframework.jar Fred.java
pause
set _CLASSES=C:\card\java_card_kit-2_2_1\lib\apduio.jar;C:\card\java_card_kit-2_2_1\lib\api.jar;C:\card\java_card_kit-2_2_1\lib\capdump.jar;C:\card\java_card_kit-2_2_1\lib\converter.jar;C:\card\java_card_kit-2_2_1\lib\offcardverifier.jar;
::xcopy /S C:\card\java_card_kit-2_2_1\api_export_files\*.* exp\
:: this sems extreme  ....to copy !!!
java -classpath "%_CLASSES%" com.sun.javacard.converter.Converter -config Fred.opt








- so far havnt found the right combo of jcdk & jre

newer jcdk gave errors on CAP load...
they say JCOP can NOT do UNencrypted loads so we cant inspect the payload???

plan:
go back to
http://lavamunky.wordpress.com/2010/03/28/java-card-prog-compile/#comment-69



lavamonkey  - why does blogsearch not find monkey??
lava monkey  javacard compile - will blogsearch find this??

Java Swing/AWT  and Waiting for a Card
You need to use a "SwingWorker" which is a kind of Thread.

If not, your screen refreshes will freeze.

The main will need to be "invokeLater"

I wish Java AWT could do threads in a more simple fashion,

but this is how it is

    SwingWorker<String, String> waitForCard = null;
    String tap = "Tap";


    private void buttonPress(java.awt.event.ActionEvent evt)                          
    {                              


        jTextArea1.setBackground(Color.white);
        jButton1.setEnabled(false);
        jTextArea1.setText(tap);


        final String badRead = "badRead";
//SW SW SW SW SW SW SW SW SW SW SW SW SW SW SW SW 


        waitForCard = new SwingWorker<String, String>()
        {
            public String doInBackground()
            {
                do
                {
                    waitCard();  // waits for a card on the NFC card reader
                    if (this.isCancelled())
                           return("cancelled");
                }
                while ( rbal.contentEquals(badRead) );  // rbal example is Card BAlanc
                publish(rbal);   
 //publish an update, this will get added to a list and
// processed in bulk by the process() method at some point
/ ie if we want a sequence, eg clear the field after one second, do the work, publish
then "done" does the final clear


                waitCardGone();




                try {
                    Thread.sleep(1500);


                } catch (InterruptedException e) {
                    return("rupt");    // never seen?
                }


                return("blank");


            }
            @Override
            protected void process(List<String> chunks) {
                jTextArea1.setText(chunks.get(0));  // display your data
            }


            @Override
            protected void done()
            {
            jTextArea1.setText("");  // clear the text after 1.5 seconds
            jTextArea1.setBackground(mgreen);
            jButton1.setEnabled(true);


            } // done
        };    //waitForCard definition fin
//SW SW SW SW SW SW SW SW SW SW SW SW SW SW






        waitForCard.execute();


    }                         

----------------------------------------------------------------------------------

public static void main(String args[])

    {

        java.awt.EventQueue.invokeLater(new Runnable()

        {

            public void run()

            {

                Framek f = new Framek();

                f.setLocation(Uti.centrePoint(f));

                f.setTitle("Card Balance ");

                f.setVisible(true);

                f.initk();  // initialise stuff

             }

        });

    }

NFC feuding, Symmetric vs PKC

NFC feuding

NXP’s Gingerbread Coup Leaves Rivals With a Bitter Taste     Dec 20 2010 

If Gingerbread supports Mifare, the most popular technology used for transit ticketing, it would put Inside at a significant disadvantage to supply NFC chips with secure elements, since NXP has declined to grant Inside a Mifare license. Of course, Inside faces a problem supplying chips for any NFC phone that supports Mifare, unless it partners with a Mifare licensee. Any Mifare support in Gingerbread is also expected to favor suppliers of Mifare tags.
....
Many in the industry, including telcos and service providers, are disappointed with the few tag-reading commands that Gingerbread and the first handset using it, the Nexus S, so far supports. “This API is useless for us,” said one telco, according to a source. Many telcos want to support retail payment, either hosting applications from banks or running the payment scheme themselves.

nfctimes
____________________________________________________________

future Symmetric Crypto should definitely be at least AES128
proprietary short keys are dangerous:
WikiPedia: "clone any MIFARE Classic card in not more than 10 seconds"

current 112 bit "triple DES" will surely be orphaned... will anyone continue to optimise DES chips?
........................

With symmetric crypto algorithms, NFC payment schemes currently require secret keys on Card and Reader.

Something like this:
1) Card to reader send Random1, and requested $ amount.
2) Reader to Card send encrypted Random1, send Random2 Card trusts Reader
3) Card to Reader send Encrypted Random2 Reader trusts Card (constructs card session key
4) Reader to Card send Send Signed transaction Card sure that transaction is complete
"Tearaway" logic must be in place in the reader if this sequence is broken.
.................................

If PKC were adopted
1) Card sends signed Amount to Reader Reader trusts card
2) Reader sends signed Acceptance to Card Card trusts Reader and completes transaction

Some nonce with known structure would be included in the signature




PKC (eg RSA public key) would mean
No Common Secret Key would be loaded onto Card
Each card could generate its own secret key, which would never leave the card.

A certification structure wold be required, to guard public keys. Note this is a lower order cryptographic problem.
Fast Large Integer Hardware arithmetic would be required.
 A desktop can validate a PKC signature in < 10msec, not sure about NXP speed.

Is it is possible to use symmetric crypto in a 2 stage transaction?
1) card sends amount & random & encrypted random Reader trusts Card (based on shared secret key
this exposes known plaintext, whereas the 4-step allows for 'session' keys. which are calculated using CardID.
The Card's key is derived from its ID so breaking one card doesnt break all,
So in practice a 4 step transaction is used.

I expect that PKC will eventually replace symmetric crypto.

Initialising cards with Secret Keys is an arduous and anxious process.

NSW TCard, OSPT GEMALTO M-pesa

NSW smart cart in court Elisabeth Sexton December 8, 2010
THE NSW cabinet.. $300 million litigation over the abandonment of a transport smartcard developed by the former .. ERG Ltd.
...
The appeal, .. relates to a decision by Justice Clifford Einstein in June giving ERG access to most, but not all, documents relevant ..

The government is suing ERG for $77 m ... Tcard contract. ERG has countered $215 m..

ERG was delisted .. last year
Ingot Capital ..run by Duncan Saville, which was ERG's largest shareholder ..


____________________________________________________________

London buses to go contactless (thought they already were?)
07 December, 2010 - 13:33
..from early 2012 and on the Underground around a year or so later,"
..visitors to London or occasional users to avoid the need to purchase an Oyster card,..
..
Barclaycard launched a combined contactless Oyster travel and debit card, OnePulse, in 2007.
..save TfL money on the commission it currently has to pay Oyster operators
...France, with Giesecke & Devrient, Infineon Technologies, Inside Secure and Oberthur Technologies announcing OSTP..
finextra
_______________________________________________
snapper
Google phone not so smart
__________________________________________

The Open Standard for Public Transport (OSPT) Alliance, ...two new members: Watchdata Technologies Ltd. and the Open Ticketing Institute of the Netherlands.

...interoperable transit fare collection solutions based on open standard security.

Founded in Beijing in 1994, Watchdata provides a range of products including smart cards, USB tokens, readers, .....

The Open Ticketing Institute ...to advance The Netherland’s e-ticketing system, OV-chipkaart. As a separate not-for-profit foundation..

The new open security standard, Cipurse, defines an authentication scheme, a secure messaging protocol, four minimum mandatory file types and a minimum mandatory command set to access these files types. It also specifies encryption keys and access conditions, and includes a cryptographic protocol that protects against differential power analysis (DPA) and differential fault analysis (DFA).

contactlessnews
pcworld
osptalliance
calypsotechnology
waazaa 14443-3.pdf
____________________________________
2010 SESAMES winner unveiled
notably:
"SESAMES IT SECURITY: The winner is GEMALTO with eGo. eGo gives access to services in touching objects with any parts of your body. It has no defined form factor and may be any object you should carry close to your body. The message wakes up a secure element and a usual wireless communication means."
- if I understood this I believe I would be excited (italics NOT in original)
secureidnews


________________________________________
Odd Java Hints:...
private static void PreserveStackTrace(Exception exception)
{
MethodInfo preserveStackTrace = typeof(Exception).GetMethod("InternalPreserveStackTrace",
BindingFlags.Instance | BindingFlags.NonPublic);
preserveStackTrace.Invoke(exception, null);
}
____________________________________
M-Pesa

since 2007, Kenya ... phone technology..
..M-Pesa ...those without a bank account to transfer funds .. a text message.
..Vodafone and Safaricom...Pesa is Swahili for money.
50% use the service to send money to..relatives, to pay for shopping..taxi ride ..
..
"The bank in my phone"
..register with Safaricom at an M-Pesa outlet... load money onto their phone. ..sent onto a third party by text message.
The recipient takes the phone to their nearest vendor,... pick up the cash.
..Mr Makusi says he no longer has to worry about being mugged while carrying cash.
..Seema Desai, director of the Mobile Money for the Unbanked (MMU)..
..Nick Hughes and Susie Lonie.. M-Pesa. .. Economist Innovation award..
...payment to the thousands of small one or two-cow milk producers.. decided to create a payment system using M-Pesa.
... Smart and Globe were active on a smaller scale in the Philippines in 2002
... March 2010 28.59bn (KES) $351m) was transferred using the service.
.. launched in Tanzania, Afghanistan and now South Africa, with trials underway in India.
.. One company that does let you pay with your mobile is Boku...buy virtual money..??? 65 countries..




The Bill and Melinda Gates Foundation has committed $500 million (Sh40 billion) over five years
..Global Savings Forum held in Seattle
..
.."In Kenya, M-Pesa is showing what storing and transferring money on mobile phones can do for poor people... at an enormous scale" Mrs Gates told the gathering.
..
.. $4.8 million (Sh384 million) will be used to expand M-Pesa into Tanzania
...mobile money transfer service had helped Kenyans cope with disasters better.
..
ShoreBank International..in Bangladesh will receive $10 million .. introducing bKash .. to be launched in .. March 2011.
..
nation

_________________________________________________
NFC:
Japan and South Korea ..in use for several years
Verizon, AT&T, and T-Mobile.. NFC system called Isis by 2012,
..Google Gingerbread smartphone, will have NFC technology
November 17, 2010
By ANTONY KARANJA in DALLAS TEXAS
bbc

M-Pesa, SSL snoopsM-Pesa, Cloud Cracking

M-Pesa
since 2007, Kenya ... phone technology..
..M-Pesa ...those without a bank account to transfer funds .. a text message.
..Vodafone and Safaricom...Pesa is Swahili for money.
50% use the service to send money to..relatives, to pay for shopping..taxi ride ..
..
"The bank in my phone"
..register with Safaricom at an M-Pesa outlet... load money onto their phone. ..sent onto a third party by text message.
The recipient takes the phone to their nearest vendor,... pick up the cash.
..Mr Makusi says he no longer has to worry about being mugged while carrying cash.
..Seema Desai, director of the Mobile Money for the Unbanked (MMU)..
..Nick Hughes and Susie Lonie.. M-Pesa. .. Economist Innovation award..
...payment to the thousands of small one or two-cow milk producers.. decided to create a payment system using M-Pesa.
...Smart and Globe were active on a smaller scale in the Philippines in 2002
...March 2010 28.59bn (KES) $351m) was transferred using the service.
..launched in Tanzania, Afghanistan and now South Africa, with trials underway in India.
..
One company that does let you pay with your mobile is Boku...buy virtual money..??? 65 countries..

NFC:
Japan and South Korea ..in use for several years
Verizon, AT&T, and T-Mobile.. NFC system called Isis by 2012,
..Google Gingerbread smartphone, will have NFC technology
bbc
................................
November 17, 2010
By ANTONY KARANJA in DALLAS TEXAS

The Bill and Melinda Gates Foundation has committed $500 million (Sh40 billion) over five years
....$4.8 million ..to expand M-Pesa into Tanzania through .. Vodafon..
..helped Kenyans cope with disasters better.
..ShoreBank Int..BRAC Bank .. Bangladesh will receive $10 million..go into introducing bKash..a mobile money ..
nation
________________________________________
SSL snoops

crypto
24March2010
A paper published today by Chris Soghoian and Sid Stamm [pdf] suggests that the threat may be far more practical than previously thought. They found turnkey surveillance products, marketed and sold to law enforcement and intelligence agencies in the US and foreign countries, designed to collect encrypted SSL traffic based on forged "look-alike" certificates obtained from cooperative certificate authorities. The products (apparently available only to government agencies) appear sophisticated, mature, and mass-produced, suggesting that "certified man-in-the-middle" web surveillance is at least commonplace and widespread enough to support an active vendor community. Wired's Ryan Singel reports in depth here.
http://files.cloudprivacy.net/ssl-mitm.pdf
pdf
http://www.wired.com/threatlevel/2010/03/packet-forensics/\
Law Enforcement Appliance Subverts SSL
marketing internet spying boxes to the feds. The boxes were designed to intercept those communications — without breaking the encryption — by using forged security certificates, instead of the real ones that websites use to verify secure connections. To use the appliance, the government would need to acquire a forged certificate from any one of more than 100 trusted Certificate Authorities.

Verisign has never issued a fake SSL certificate, and to do so would be against our policies,” said vice president Tim Callan.

___________________________________________

Cloud Cracking

..Amazon EC2 "Cluster GPU Instances": ..the power of two NVIDIA Tesla “Fermi” M2050 GPUs....
33.5 EC2 Compute Units (2 x Intel Xeon X5570, quad-core “Nehalem” architecture)2 x NVIDIA Tesla “Fermi” M2050 GPUsAPI name: cg1.4xlarge

GPUs are known to be the best hardware accelerator for cracking passwords, so I decided to give it a try: How fast can this instance type be used to crack SHA1 hashes?

Using the CUDA-Multiforce, I was able to crack all hashes from this file with a password length from 1-6 in only 49 Minutes (1 hour costs 2.10$ by the way.):
http://stacksmashing.net/2010/11/15/cracking-in-the-cloud-amazons-new-ec2-gpu-instances/
[cracking a hash is 1 thing, cracking a hash with a useful message is another]

_____________________________

arduino "smart card" or smartcard reader
arduino 8 bit controller - toys take over the world
__________________________
how to read SLE4442 smart card
com
______________________
From 64-bit Hexadecimal Representation To Decimal Floating-Point
cs
___________________
Engineers at the University of Kitakyushu have built this red snapper robot. Intended for wildlife surveys, this robot sports an array of sensors as well as a hand painted silicon body. It is decidedly more realistic looking than the Robofish and the Essex University robot fish.

botjunkie
watch
_________________________________________________________________________
Web Tech
One of the compelling reasons to use JSON instead of XML in current web applications are the imposed security restrictions in modern browsers; JSON can actually be retrieved from remote websites without too much trouble (using jsonp) while XML requires one to jump through a number of loops (such as a local proxy). Go figure!
http://norman.walsh.name/2010/11/17/deprecatingXML
______________________________
MasterCard Tap & Go
..New Zealand's first "tap and go" credit cards ..tomorrow..
..ANZ's Rugby World Cup MasterCards ..< $80 ....two seconds....terminals .. in Auckland's Eden Park and Wellington's Westpac Stadium.."corridors" of retailers around the stadiums.. protected by MC's "zero fraud liability" protection, .. ..has already been issuing prepaid and reloadable MasterCards with the embedded antennae, .. not been telling customers about the ..contactless feature. ....83 million MasterCard contactless cards on issue worldwide___________________________ stuff
_________________________________________

Australian Problems, Bangalore and Pune, AES-NI

Australian Problems
seem to have had a few since I tried to get on the bus in 95

The history of implementing public transport smart cards in Australia has seen mixed results. The first attempt to implement a smart card for public transport in NSW failed in 2008 and has since led to long-running legal troubles for the State Government. In Victoria, the Myki smart card system is up and running on trains, buses and trams in Melbourne, but has also had its fair share of troubles. Queensland has experienced less troubles with its go card system. Perth has also managed to implement a smart card system.

South Australia and the Australian Capital Territory are in the midst of roll-outs.

Clark said Visa was currently conducting a trial in New York's transit system with a payWave app on the iPhone

zdnet
________________________
Bangalore and Pune are vying to be the first city in India to deploy a contactless smart card fare system on city buses .. idsuperstore.ca.

Bangalore’s .. nearing completion, ..1,000 buses. Pune, .. a definitive November 14 launch date..
______________________________
AES on Intel
The Intel® AES New Instructions (AES-NI) Sample Library .. Advanced Encryption Standard (AES) block cipher using the new AES-NI instructions available in Intel Core™ i5, i7, Xeon® 5600 series and newer processors.
intel

.. all new 2010 Intel® Core..Westmere.
..
28.0 cycles per byte to 3.5 cycles per byte
_______________________________________
AES-NI in truecrypt, but note the arguments:
truecrypt apparently doesnt have a "true" free licence - tghe disatinction seems moot to me

truecrypt really doesn't do anything useful that you can't do better with proper open source choices, like dmcrypt/luks.

but:

a lot easier to use, has a simple gui for easy creation of encrypted containers, partitions and drives, supports multiple cores!! and AES-NI, no need to create multiple dmcrypt-devices and a raid above them, to use multiple cores (on slower systems with fast disks/ssds without hadrware acceleration (VIA Eden, AES-NI, ... ) especially on older dual/quadcore-systems where cpu can be a real bottleneck for system-performance if you have your system encrypted, and want copy data on other fast encrypted discs (internal sata/sas or external e-sata/usb3).

From the performance-point of view:

..

Now I get ~570mb/s on a single core (i7 620M [dualcore]) with dmcrypt [aes-ni-support] and with truecrypt ~1600-1700mb/s on both cores.

Without AES-NI truecrypt (6.0) got about 250mb/s while dmcrypt on one core got about 100mb/s [older kernel/dmcrypt, think 110-120mb/s would be possible on an up2date kernel/dmcrypt]

..

I will keep my dmcrypt for the operating system (since truecrypt for linux-system encryption isn't supported) and use truecrypt for external drives.

Another thing, truecrypt runs on windows, linux, mac, solaris, ... , especially for external harddrives you want to use on more than operating system, sticking with dmcrypt just doesnt work.

phoronix
____________________________________________________

...

Bling Tag, Passport country

Bling Tag - dont lose your phone.


nearfieldcommunicationsworld       bling nation

Bling Tag, .. an NFC-enabled sticker that you stick to the back of your mobile phone. .. you don’t need any identification.. paying with Bling is as simple as tapping your phone onto a merchant’s Bling Box.

..downtown Palo Alto.. Bling Tags available at a few local shops. The Tag itself is free ..Just stick the Tag to your phone and you’re halfway done.
...
The first time you pay for goods at participating merchants, you’ll need to jump through one additional hoop .. When checking out at the cashier, simply tap the Tag on the Bling Box..The cashier will ask you for your phone number and use that to authorize the purchase. ..The verification code is only required on your initial purchase,..
....any phone that can accept SMS text message will work just fine.

The Bling Tag is tied to your credit card...  Bling is offering a $20 credit to first time users...
intomobile
.....

Business Model
Wences Casares, house in Chile

paymentsviews
______________________________________________________________________

Bling targets a small community which has a decent..financial asset size, and which is served primarily by local community banks. They sign up one or more of the banks, and an assortment of frequently-visited local merchant
......
Bling looks like a foreign ATM to the bank. Settlement in batch is done at night, between Bling and the banks, as a private, not network, settlement. The merchant doesn’t have to submit any clearing transactions – as long as they got the Blinger confirmation, they know their account will be credited that day.
http://paymentsviews.com/2009/10/19/blinging-it-home-a-look-at-bling-nation/

..............
The pitch to merchants is primarily cost – transactions are about 50% cheaper than traditional card acceptance.

In low crime-areas you may see people sitting at outdoor cafe tables with their cellphones on the table.

Not Where snatchers are (most of the world?)

_______________________________
NFC card
The new device is the shape of a thick (3.9mm) bank card and can be used to display and store coupons, tickets, prepaid funds, adverts and membership of loyalty programmes — without the need for a mobile network connection. It includes a 2.2inch 320 by 240 pixel colour liquid crystal display and control keys that enable the user to switch between a number of screens. The device is fully NFC compliant and is compatible with ISO 14443 Type A and B contactless card systems as well as Sony's FeliCa technology.
via   0x9000.blogspot
nearfieldcommunicationsworld
______________________________________________________
Sort fast

Gusfield, Dan (1999), Algorithms on Strings, Sequences and Trees. Cambridge: University Press.
the Boyer-Moore string search algorithm, invented by Bob Boyer and J Strother Moore in 1977, in a variant devised by Nigel Horspool.
effbot
__________________________

Passport

Java implementation

...open source Java Cardimplementation of the passport we provide at
sourceforge
..we can remotely detect the presence of a passport of a particular
country,..

_____________________________________________________________________

Books ... on refactoring

com forrst
Clean-Code-Handbook
I liked "Implementation Patterns" better. (
refactoring
com
Patterns of Enterprise Application Architecture
amazon
codeproject
java build sorry state
safaribooksonline $36.50 /month
___________________________________

C# how to throw

try
{
var r = new RethrowProperly();
r.DoSomething();
}
catch (DivideByZeroException ex)
{
throw;
}
Now the call stack points directly at the line of code in DoSomething where the calculation is done.
_______________________________
Bit Hack #4. Unset the n-th bit.
y = x & ~(1<<n)
   catonmat
_______________________________


Security threat?
(i have not understood nor investigated this press clippping)

theregister

a universal Padding Oracle affecting every ASP.NET web application," Rizzo explains. "In short, you can decrypt cookies, view states, form authentication tickets, membership password, user data, and anything else encrypted using the framework's API.

"The vulnerabilities exploited affect the framework used by 25 per cent of the internet websites. The impact of the attack depends on the applications installed on the server, from information disclosure to total system compromise," he adds.

More details of the security weakness are due to be outlined at a presentation during the Ekoparty conference in Argentina this week.

Rizzo told threatpost that the attack might be exploited to allow a "moderately skilled attacker" to break into a website in an hour or less.

"The first stage of the attack takes a few thousand requests, but once it succeeds and the attacker gets the secret keys, it's totally stealthy. The cryptographic knowledge required is very basic," Rizzo said. ® via code project

__________________
celent
South Korea CL NFC
.....................................
Indeed, as the RPA starts its rollout of an integrated ticketing system here, TFL will begin to make the Oyster system redundant in London. From next year customers will be able to pay onto buses and trains directly with their contactless credit or debit cards, cutting out the need for an integrated system in between.
irishtimes
_________________________________

Sad day.
Sun Forums have been replaced by Oracle.


Sun forums were a great learning place, well attended, with serious answers
part of a radical re-make of the work/learning experience of C21
I cant overstate the importance of this and other forums. Enabling me to teach myself Java, Database, X.509, SSL, etc etc
The readiness of others to reply, sometimes in a gruff manner (rtfm) was continually amazing

Oracle:
update: today 1Nov2010 Oracle forums look fine
..
is this true?
It seems that ther is no carry-over, old topics from Sun are not indexed.
no search result for SSH jsch
"secure Sockets" does turn up a couple of rambling requests dating post 25Sep2010

on Sun, I got called a Zombie occasionally.
Because I found an old thread, usually via Google. Sometimes these old threads contained answers. Sometimes I was guilty of waking the zombie, but other google users sometimes arrived.
Sun had zombie-watchers who seemed to prowl the forums seeking to 'lock' any thread awakened by zombies.
Understandable from a neat-and-tidy perspective, but actually hindering me in searching for solutions.
The issue is moot now...