Menu
  • HOME
  • TAGS

Change PIN of a Gemalto Smartcard through a script

Tag: smartcard,gemalto

We have to use the Gemalto IDPrime .Net card Smartcard. We get these USB Dongles and have to change the PIN.

Gemalto says via windows:

From the Start menu, choose Run and type PINTool.
Insert a IDPrime .Net card in the reader as prompted, and click OK. The change PIN interface appears
Enter the old PIN (the default PIN value is 0000), the new PIN and confirm the new PIN.
Click on Change Pin

http://support.gemalto.com/index.php?id=how_to_change_pin_in_a_idprime#.VWYTWUa8rV8

This works, but I want to set a new PIN/password via powershell or c#, i. e. under control of a program. How to do that or is impossible?

Best How To :

You should be able to change PIN via unmanaged PKCS#11 API that can be easily accessed from C# with a managed .NET wrapper called Pkcs11Interop which I am the author of.

Here is the code sample that may help you get started:

using Net.Pkcs11Interop.Common;
using Net.Pkcs11Interop.HighLevelAPI;

namespace ConsoleApplication
{
    class Program
    {
        static void Main(string[] args)
        {
            // Load PKCS#11 library provided by Gemalto
            using (Pkcs11 pkcs11 = new Pkcs11("gtop11dotnet.dll", true))
            {
                // Find first slot/reader with token/card present
                Slot slot = pkcs11.GetSlotList(true)[0];

                // Open RW session
                using (Session session = slot.OpenSession(false))
                {
                    // Login as normal user with current PIN
                    session.Login(CKU.CKU_USER, "0000");

                    // Set the new pin for the logged in user
                    session.SetPin("0000", "1111");

                    session.Logout();
                }
            }
        }
    }
}

Sign PDF with smartcard in web context using CAPICOM & iTextSharp

itextsharp,activex,digital-signature,smartcard,capicom

Use of PdfPkcs7 The server-side code contains this block after the calculation of the range stream digest and before forwarding data to the web page: PdfPKCS7 sgn = new PdfPKCS7( null, chain, DigestAlgorithms.SHA256, true ); byte[] preSigned = sgn.getAuthenticatedAttributeBytes( hash, sap.SignDate, null, null, CryptoStandard.CMS ); var hashedValue = Convert.ToBase64String(preSigned); In...

Smartcard PKCS11 AES Key Gen Failure

python,aes,smartcard,pkcs11

Figured it out on my own after a ton of digging through tons of examples: CKA_ID is a required attribute if you are going to make a persistent (CKA_TOKEN=True) object. Not sure how I was supposed to know that (never saw it in any documentation), but indeed it works beautifully...

How can I extract an X509 certificate from a smart card using Java?

java,smartcard

I could extract the certificate using the SUN PKCS#11 provider library. Details provided in the following article helped: http://www.developer.com/java/other/article.php/10936_3587361_8/Java-Applet-for-Signing-with-a-Smart-Card.htm

ADPU Service in iOS

ios,nfc,smartcard,apdu,contactless-smartcard

You can't. The only operation mode of NFC that the iPhone (6) currently supports is card emulation through an embedded secure element. iOS does not provide interfaces for other modes of operation (like host card emulation, reader/writer mode or peer-to-peer mode).

Howto list files on a smartcard with pyscard

python,smartcard,apdu,smartcard-reader,pyscard

In this answer I assume you are refering to a tachograph driver card according to the ECC regulation No 3821/85. In that case, you are right that the smartcard communicates using ISO/IEC 7816-4 APDUs and that it exposes a file structure based on ISO/IEC 7816-4. Once you opened a connection...

How to read binary blocks of mifare card?

nfc,smartcard,mifare,ndef,pcsc

So it seems that your tag is an NFC Forum Type 2 tag (find the NFC Forum Type 2 Tag Operation specification on the NFC Forum website). As you mentiion MIFARE this could, for instance, be a MIFARE Ultralight, MIFARE Ultralight C or NTAG tag. A block on a Type...

Getting started with SIM card

smartcard,gsm,javacard,sim-card

Yes, both are smart cards. Surely there are some specific applications: the SIM and USIM application theyself, the Remote File Management, Remote Application Management, browser application ([email protected], WIB), etc. The SIM card specification is defined first. Later on, the USIM specification. The backward compatibility is required so that subscribers...

number value to byte[6] array card reader

c#,smartcard,smartcard-reader,cardreader

The method should be something like: public static byte[] NumberToByteArray(float f, int decimals) { // A string in the format 0000000000.00 for example string format = new string('0', 12 - decimals) + "." + new string('0', decimals); // We format the number f, removing the decimal separator string str =...

Change PIN of a Gemalto Smartcard through a script

smartcard,gemalto

You should be able to change PIN via unmanaged PKCS#11 API that can be easily accessed from C# with a managed .NET wrapper called Pkcs11Interop which I am the author of. Here is the code sample that may help you get started: using Net.Pkcs11Interop.Common; using Net.Pkcs11Interop.HighLevelAPI; namespace ConsoleApplication { class...

JavaCard applet emulating DESFireEV1

smartcard,javacard,mifare,emulation

The open source project you already found is indeed unfinished, incomplete, incorrect. NXP features an emulation that is avaiable by activation during prepersonalization (not on all cards i suppose) I have implemented an almost complete and tested DESFire applet(only supports transparent files and does not support native mode but...

Pcsc -smartcard get UID

java,nfc,smartcard,smartcard-reader,pcsc

I was able to find the solution and get the UID by changing the command APDU. Then I converted the result byte[] to hex UID. try { //get UID cmd apdu ResponseAPDU answer = cc.transmit( new CommandAPDU(new byte[] { (byte)0xFF, (byte)0xCA, (byte)0x00, (byte)0x00, (byte)0x00 } )); System.out.println("answer: " + answer.toString());...

NFC SWP applet selection returns 6999

android,nfc,smartcard,javacard,sim-card

Receiving status code 6999 in response to the SELECT (by AID) command is a clear indication that the applet was not found/not selectable. If the applet has been installed and is selectable (using the same AID) over the contact interface of the UICC/SIM card, then it is likely not made...

What is the reaction of JCRE to uploading an applet with promiscuous AID?

smartcard,javacard,globalplatform

I'll provide two answers, as you've asked two questions. Please try and ask one question per question. The .cap file is different because the single .cap file is little more than a .zip archive. You can simply change the file extension to .zip to see the contents. A .zip can...

Is it possible to program a “Java Card” - enabled smart card in any other language than Java?

c,embedded,smartcard,javacard

The general answer : Unfortunately no, currently there is no other way than using Java Card API to program a Java Card compatible card. The detailed answer: Some kind of cards have a mechanism named "Secure Box". As mentioned in the JCOP v2.4.2 r3 card Security target : The Secure...

Secure Box in JCOP card

smartcard,javacard,globalplatform,jcop,nxp-microcontroller

No they are native modules that need to implement a rather generic Java Card defined - byte array oriented - method interface (it's in the JCOP extensions, look for it). Normally you would need to program in C, e.g. using the Keil dev. kit and then send the resulting code...

Sending signature data in response APDU - Java Card

digital-signature,smartcard,javacard,apdu,ecdsa

It's probably that signLen is larger than the Ne value (incorrectly called Le in the JavaCard specifications). You are also abusing the Le value to mean (short) MESSAGE.length by the way. Ne indicates the maximum number of bytes that are expected to be send back.

how changing master key or other keys can provide security ?how used session key to keep the further communication between DESFire and reader?

security,session,authentication,nfc,smartcard

I'm not sure, whether the points below answer your question, which I consider as not very clear and further blurred by your added comments. The default key is known to all users of an evaluation kit - therefore you surely want to change it to a value only known to...

JavaCard - pure software implementation of ECC over GF(2^n)

security,cryptography,smartcard,javacard

Smart cards that are able to perform asymmetric cryptography always do this using a co-processor (that usually contains a Montgomery multiplier). Most smart cards (e.g. the initial NXP SmartMX processors) still operate using an 8 bit or 16 bit CPU. Those CPU's are not designed to perform operations on large...

Select root folder in SANKYO ICT3K5-3R6940 card reader

smartcard,smartcard-reader,cardreader

I solved the problem and want to add an answer to this question, maybe someone will need a help too. SANKYO ICT3K5 works with magnet stripe and chip based cards. For chip based cards you must activate IC Card functionality at first, then you can send commands to IC Card....

is it possible to return some data along with the status word 9000 on selecting an applet in javacard?

applet,smartcard,javacard,apdu

I guess you do the "good practice" of "if selectingApplet() then return" in process? You need to process the incoming APDU instead of simple return. You can return data to select the normal way, but be careful to return 0x9000 if the select was successful....

C on smartcards [closed]

c,smartcard

Due to their limited CPU power, SCs mostly have their own security/encryption hardware and OS. The latter for instance controls access to critical features like the interface and key storage. Also, some of them have countermeasures against typical attack scenarios like differential cryptoanalysis, etc. There are standards available, but which...

How to try using Native Methods in Java card applets?

smartcard,javacard,globalplatform

A native method is a method written in another programming language (i.e. not in Java) that can be invoked by a Java program. For smartcards, a native method is typically written in C code or machine code and is directly executed on the underlying smartcard processor (whereas Java Card applications...

Memory Access Performance in Java Card

performance,memory,smartcard,javacard

Of course, memory gets loaded on a page by page basis. If your array ends up in two or more pages, and only the first page gets loaded by the JIT (because reasons, it's very hard to track memory once the JIT and GC touch it) but the last one...

Performance measures : Java vs JavaCard [closed]

java,performance,time,smartcard,javacard

You run the algorithm is in two different platform, so the final machine language is not the same.

APDU MIFARE Classic 4K read value at specific sector/block

nfc,smartcard,mifare,apdu,smartcard-reader

The most easiest way to read a block from a MIFARE Classic card using this specific reader (SpringCard Prox'N'Roll PC/SC) is the reader-specific READ MIFARE CLASSIC (with specified key) command: FF F3 00 <BLOCK> 06 <KEY> 00 This command will try to authenticate using <KEY> as key A first (and...

Smart Card Reader T0 T1 communication on APDU level

smartcard,apdu,smartcard-reader

Ok, I re-read the spec (7816-3) again and again, maybe 5 times or more. These are my findings: According to the Spec there are no such things as "automatic" and "default" protocols whatsoever. 8.2.3 Interface bytes TA TB TC TD The “first offered transmission protocol” is defined as follows. If...

Javacard applet beginner

java,applet,smartcard,javacard

There is a development kits called JCIDE, is free. After installation, can be used directly, no configuration parameters. Unfortunately, when debugging, only set one breakpoint, but normal use is enough. I feel very good, recommended to you.

What is the meaning of out put of GP -I command?

smartcard,javacard,globalplatform

As suggested before: you can get detailed information from the GP specification. Consider -i a "dump data from card useful for debugging and other purposes". It dumps card data, CPLC and key template of the ISD. If you don't know what that means, read the specification.

Why Javacard prevent uploading different in AID .cap files of a single javacard program?

smartcard,javacard,globalplatform

1-What is the origin of first error? Is it illegal to upload two .cap file that are different in AID and have an equal PkgAID in two step? Yes. You have uploaded that package. Therefore, it is forbidden to upload the same package again. Here, you have two options: Directly...

Is this a vulnerability in my smart card .cap verifier and its atomicity?

smartcard,javacard

You can't apparently interpret the output from the tools and gpj does not really make it easy either. Applet AID and package AID are different things and only selectable applets can be selected. Not to mention the issuer security domain, which is a different thing in the first place. Also,...

Send APDU commands to USIM/SIM card in android

android,smartcard,at-command,javacard,sim-card

There can be two different types of applets present on your SIM card. Common applets Common applets written in plain JavaCard. This is the type of applet you are used to from the world of common smart cards. It has the process method and smart card is the passive subject...

Why my smart card accepts two different keys as its MAC key?

smartcard,javacard,3des,parity,globalplatform

You are only flipping the parity bit which is not used nor checked by the card (or software). Which means the outcome of ciphers is the same, yes.

Why all applets of a package are not installed? And why I can't delete them?

smartcard,javacard

You have a single applet installed: AID: 0102030405060708090002 (|...........|) App SELECTABLE: (none) And you have a package with 3 applets loaded: AID: 01020304050607080900 (|..........|) ExM LOADED: (none) 0102030405060708090002 (|...........|) 0102030405060708090001 (|...........|) 0102030405060708090000 (|...........|) You can only delete one existing applet 0102030405060708090002 and you can't delete the package 01020304050607080900 without either...

Is this a bug in Transaction mechanism in javacards?

transactions,smartcard,javacard

Although we cannot look into the card, it seems a higher chance that there is protection against this attack and that a countermeasure has been triggered. A useful countermeasure is to "mute" the card, so no information is leaked back to a possible attacker. This may mean that the card...

UID of a NFC/SWP-accessed SIM card

android,nfc,smartcard,sim-card

The 4 byte UID for type A (same for PUPI for type B) is allowed to be random (ISO 14443-3, chap. 6.4.4 "fixed unique number or random number"). Their purpose is only, to select one of several cards currently in the field of the reader. Therefore the description of UID...

Smart cards and their files

smartcard,javacard

Where are these applets in the card? (in the MF or in a DF?) Consider each Java Card application to be a DF directly below the MF. Though, be aware that Java Cards only make use of parts of the ISO 7816-4 file system concept and that the MF itself...

What does this default applets do?

smartcard,javacard,globalplatform

ExM means "Executable module" which means "package". N/A Yes. Have a look here for example: https://github.com/martinpaljak/AppletPlayground/blob/master/build.xml#L53 You really have to go and read some documentation before asking. This is a programming forum....

How to change master key of DESfire cards?What is deciphered key?

smartcard,mifare

Your decipheredKey is CBC-mode decrypted value of the new key with a zero initial vector. This is a Mifare DESFire feature: terminal always decrypts (even to hide plaintext!) and the DESFire card always encrypts. It is based on fact, that decryption and encryption using symmetric ciphers like DES, 3DES or...

Ways of generating a digital signature with .NET Framework

.net,visual-c++,c++-cli,smartcard,sign

In case someone else looks for an answer to this question, this article shows the way: In a nutshell, in C++/CLI it can be done this way: //X509Certificate2^ Certificate = get your certificate that has a corresponding private key RSACryptoServiceProvider ^ csp = safe_cast<RSACryptoServiceProvider ^>(Certificate->PrivateKey); csp.SignHash(); However, it is still...

Determine Facility Code and Card Number from ATR in C#

c#,.net,bytearray,smartcard,winscard

I'm not sure what the full-length number 3B050002F10673 is but, per the spec, you're only interested in the right-most 26 bits of it. Int64 start = 0x3B050002F10673; Int64 a_26_only = start & 0x3FFFFFF; //26 bits, 11 1111 1111 1111 1111 1111 1111 Then, per the spec, the right-most bit is...

Make 2 cardlet Java Card communicate

applet,smartcard,channel,javacard

Yes it's possible. You need a card that supports additional logical channels.In that case, you can select more than one applet simultaneously.(One applet per each channel) Fortunately current cards support some additional logical channels. But remember that if you want to select (at least) two applets of a single package...

what is diference between Security Domain with Delegated Management privilege and Authorized management?

smartcard,javacard,globalplatform

Security domain with AM privilege can perform all the Card Content Management operations without an authorization, However SD with a DM priviledge requires a Authorization of the Card Content MAnagement Operation from a SD with AM privilege via Token verification. Please go through Table 6-3 of GP2.2.1 for Privilege Assignment...

Two OwnerPIN object in Java Card

security,smartcard,javacard,apdu,pin-code

For user authentication, the OwnerPIN is certainly one good way to go (there are alternatives ofcourse, but OwnerPIN provides security features (e.g. tearing protection) that you would otherwise have to implement manually). For terminal authentication, nothing should prevent you from using an approach based on an instance of the OwnerPIN....

Unable to construct VERIFY_PIN_DIRECT control command

smartcard,apdu,smartcard-reader,openpgp,pcsc

OpenPGP uses variable length PIN and the PIN block must by popular convention (this case is not covered in the CCID specification) be sent as empty APDU with only the APDU header. See here for a hint: https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/reader-pcsc.c#L1391 Also, is your app open source? Maybe you want to contribute some...

ISO7816 - Odd INS codes?

smartcard,javacard,apdu

I am going to answer my own question after some research. My problem was an old ISO7816-3 standard as Guidot mentioned in his comment. According to current ISO7816-3 and ISO7816-4 odd INS codes are valid. The only invalid INS values according to current ISO are 6X and 9X. The reason...

An applet without any package, and a package without any applet

smartcard,javacard,globalplatform

yes it is an ISD (issues security domain), not App no One question per post please....

Extended APDUs and T=0/1 communication protocols

smartcard,javacard,smartcard-reader,globalplatform,pyscard

Q1: Changing Protocol is possible. Information which protocols are supported by hte card is transceived via ATR/ATS. The terminal then can decide which one to use. So it is dependend from your Terminal shell if protocols are selectable or not. For JCOP Shell this is /change-protocol. However is do not...

Javacard - power loss during garbage collection

transactions,garbage-collection,smartcard,javacard

Well I think it might be an implementation bug. In general, garbage collection is usually never needed and never used on smartcards. You should avoided it under any circumstances by good applet design. Because that way you never run into memory problems, which are bad for a smartcard thats installed...

Promag Card Reader PHP Accessing

php,smartcard,pcsc

As I am the developer of the PHP extension for accessing smartcards, I can say you are doing everything right. It seems your card reader is not supported. I use an Omnikey 5321 and SCM SCL011 for accessing smart cards and they work just fine. Since you are using Windows...