AN2284 datasheet(26/40 Pages) STMICROELECTRONICS

26 / 40 page

7 ISO 7816-3 - Electronic Signal and Transmission Protocol

AN2284

26/40

This command (as the name suggests) puts information into a data object on the card. As with

the previous command, this is a card-specific command.

7.2.4

The Security API

Each component of the file system on a smart card has an associated list of access properties.

The access properties ensure that only authorized parties are allowed to access the particular

component of the file system. The authentication can be simple, such as requiring the reader to

provide a predefined personal identification number (PIN). Alternatively, it may be more

complicated, such as requiring the reader to prove that it possess some shared secret with the

card (e.g. a key) by encrypting or decrypting a string of bytes provided by the card.

A few of the functions provided by the security API are briefly discussed below.

Verify:

This command is sent by the application on the reader side to the security system on the card.

Its purpose is to convince the card that the reader knows a password maintained by the card in

order to restrict access to sensitive information stored on the card. The password-type

information may be associated with a specific file or to some or all of the file hierarchy. If the

Verify command fails i.e. the reader provides an incorrect password, an error is returned to the

reader.

Internal Authenticate:

This command allows the card to authenticate itself to the reader by proving that it possesses a

secret key shared with the reader. The reader application software first generates a random

number and encrypts it with some algorithm known to both card and reader. This constitutes a

challenge to the card. The card then decrypts this challenge with the secret key (that is stored

on the card) and sends the resulting data back to the reader. If the data received by the reader

matches the random number that it generated then the reader application software is assured

of the identity of the card.

External Authenticate:

This command is used in conjunction with the Get Challenge command to enable the reader

application software to authenticate itself to the card. The reader receives challenge data (a

random number) from the card and encrypts it with a secret key. This is then sent to the card

using the External Authenticate command. The card decrypts the data and compares it to the

random number that it generated in the previous Get Challenge command. If there is a match,

then the card is assured of the identity of the reader application.

Get Challenge:

This command is sent by the reader to the card. Its purpose is to provide the reader application

with a random number generated by the smart card. As previously described, this number is

used in the External Authenticate command.

Manage Channel:

AN2284 Datasheet(PDF) 26 Page - STMicroelectronics