Skip to content

Avoid non SELECT(AID) commands for probing #3108

@CardContact

Description

@CardContact

Further digging into #3107 I've extracted probing APDUs that are not SELECT(AID) APDUs:

00000010 [140479840638656] APDU: 00 CA DF 30 05
00008056 [140479840638656] SW: 6A 80
00000018 [140479840638656] APDU: 00 CB 3F FF 03 5C 01 7E 00
00005369 [140479840638656] SW: 6E 00
00000020 [140479840638656] APDU: 00 A4 00 0C 02 3F 00
00005586 [140479840638656] SW: 6A 86
00000011 [140479840638656] APDU: 00 A4 00 00 02 3F 00
00004883 [140479840638656] SW: 6A 86

The INS CA seems to be issued by the setcos driver.
The INS CB comes from the PIV driver.
The INS A4 seems to be related to the JPKI driver.

The issue with these APDUs is, that they potentially interfere with an application that is not supported by OpenSC.

In our case, the probing APDUs end up in a running applet that has an establish secure messaging channel. That channel is interrupted at plain APDUs for security reasons. SELECT(AID) for probing is fine, as those APDUs are handled by the JCVM and don't reach the applet. But all other APDUs are passed to the applet that uses the card in non-exclusive mode.

To have better coexistence with other card aware applications, we should avoid sending non SELECT(AID) APDUs for probing, unless we match the ATR on a white list. And that whitelist should be specific enough and not catch just all JavaCards.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions