google-site-verification: google61fe8ba583a51912.html
MACRO NEPAL
Java Card for Smart Cards in Java
awiskar acharya
November 16, 2025
6:46 am

Overview

Java Card is a technology that allows Java-based applications to run on smart cards and other devices with limited memory and processing capabilities. It's widely used in SIM cards, payment cards, ID cards, and secure access systems.

Java Card Platform Architecture

1. Java Card Runtime Environment (JCRE)

// Basic Java Card applet structure package com.example; import javacard.framework.*; import javacard.security.*; import javacardx.crypto.*; public class BasicApplet extends Applet { // Constants private static final byte CLA_BASIC = (byte)0x80; private static final byte INS_SELECT = (byte)0xA4; private static final byte INS_GET_DATA = (byte)0xCA; private static final byte INS_STORE_DATA = (byte)0xDA; private static final byte INS_VERIFY_PIN = (byte)0x20; private static final byte INS_CHANGE_PIN = (byte)0x24; // PIN code private OwnerPIN pin; private static final byte PIN_TRY_LIMIT = (byte)3; private static final byte PIN_SIZE = (byte)4; // Data storage private byte[] storedData; private static final short DATA_SIZE = (short)256; // Cryptographic objects private AESKey aesKey; private Cipher aesCipher; public static void install(byte[] bArray, short bOffset, byte bLength) { new BasicApplet().register(bArray, (short)(bOffset + 1), bArray[bOffset]); } public BasicApplet() { // Initialize PIN pin = new OwnerPIN(PIN_TRY_LIMIT, PIN_SIZE); // Initialize data storage storedData = new byte[DATA_SIZE]; // Initialize cryptographic objects initializeCrypto(); register(); } private void initializeCrypto() { try { aesKey = (AESKey)KeyBuilder.buildKey( KeyBuilder.TYPE_AES, KeyBuilder.LENGTH_AES_128, false ); aesCipher = Cipher.getInstance(Cipher.ALG_AES_BLOCK_128_CBC_NOPAD, false); } catch (CryptoException e) { // Handle crypto initialization error } } public boolean select() { // Reset PIN validation on applet selection pin.reset(); return true; } public void deselect() { // Reset PIN when applet is deselected pin.reset(); } public void process(APDU apdu) { byte[] buffer = apdu.getBuffer(); // Check for SELECT command if (selectingApplet()) { return; } // Check CLA (Class byte) if (buffer[ISO7816.OFFSET_CLA] != CLA_BASIC) { ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED); } // Process commands based on INS (Instruction byte) switch (buffer[ISO7816.OFFSET_INS]) { case INS_VERIFY_PIN: verifyPIN(apdu); break; case INS_CHANGE_PIN: changePIN(apdu); break; case INS_STORE_DATA: storeData(apdu); break; case INS_GET_DATA: getData(apdu); break; default: ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED); } } private void verifyPIN(APDU apdu) { byte[] buffer = apdu.getBuffer(); // Get PIN data from APDU short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); short dataOffset = ISO7816.OFFSET_CDATA; // Check PIN if (pin.check(buffer, dataOffset, (byte)lc)) { // PIN verified successfully apdu.setOutgoingAndSend((short)0, (short)0); } else { // PIN verification failed ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } } private void changePIN(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); short dataOffset = ISO7816.OFFSET_CDATA; // Update PIN pin.update(buffer, dataOffset, (byte)lc); apdu.setOutgoingAndSend((short)0, (short)0); } private void storeData(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); short dataOffset = ISO7816.OFFSET_CDATA; // Store data (with bounds checking) if (lc > DATA_SIZE) { ISOException.throwIt(ISO7816.SW_WRONG_LENGTH); } Util.arrayCopyNonAtomic(buffer, dataOffset, storedData, (short)0, lc); apdu.setOutgoingAndSend((short)0, (short)0); } private void getData(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short le = apdu.setOutgoing(); if (le > DATA_SIZE) { le = DATA_SIZE; } // Send stored data apdu.setOutgoingLength(le); apdu.sendBytesLong(storedData, (short)0, le); } }

Cryptographic Applet Example

2. Secure Cryptographic Applet

package com.securecrypto; import javacard.framework.*; import javacard.security.*; import javacardx.crypto.*; public class CryptoApplet extends Applet { // Command constants private static final byte CLA_CRYPTO = (byte)0x84; private static final byte INS_GENERATE_KEY = (byte)0x40; private static final byte INS_ENCRYPT = (byte)0x42; private static final byte INS_DECRYPT = (byte)0x44; private static final byte INS_SIGN = (byte)0x46; private static final byte INS_VERIFY = (byte)0x48; private static final byte INS_GENERATE_RANDOM = (byte)0x4A; // PIN management private OwnerPIN adminPIN; private static final byte PIN_TRY_LIMIT = (byte)3; private static final byte PIN_SIZE = (byte)6; // Cryptographic keys private AESKey aesKey; private RSAPrivateKey rsaPrivateKey; private RSAPublicKey rsaPublicKey; private ECPrivateKey ecPrivateKey; private ECPublicKey ecPublicKey; // Ciphers and signatures private Cipher aesCipher; private Signature rsaSignature; private Signature ecdsaSignature; // Key buffers private byte[] tempBuffer; private static final short TEMP_BUFFER_SIZE = (short)512; public static void install(byte[] bArray, short bOffset, byte bLength) { new CryptoApplet().register(); } public CryptoApplet() { // Initialize PIN adminPIN = new OwnerPIN(PIN_TRY_LIMIT, PIN_SIZE); // Initialize temporary buffer tempBuffer = new byte[TEMP_BUFFER_SIZE]; // Initialize cryptographic objects initializeCryptoObjects(); register(); } private void initializeCryptoObjects() { try { // Initialize AES aesKey = (AESKey)KeyBuilder.buildKey( KeyBuilder.TYPE_AES, KeyBuilder.LENGTH_AES_256, false ); aesCipher = Cipher.getInstance(Cipher.ALG_AES_BLOCK_128_CBC_NOPAD, false); // Initialize RSA rsaPrivateKey = (RSAPrivateKey)KeyBuilder.buildKey( KeyBuilder.TYPE_RSA_PRIVATE, KeyBuilder.LENGTH_RSA_2048, false ); rsaPublicKey = (RSAPublicKey)KeyBuilder.buildKey( KeyBuilder.TYPE_RSA_PUBLIC, KeyBuilder.LENGTH_RSA_2048, false ); rsaSignature = Signature.getInstance(Signature.ALG_RSA_SHA_256_PKCS1, false); // Initialize ECC ecPrivateKey = (ECPrivateKey)KeyBuilder.buildKey( KeyBuilder.TYPE_EC_FP_PRIVATE, KeyBuilder.LENGTH_EC_FP_256, false ); ecPublicKey = (ECPublicKey)KeyBuilder.buildKey( KeyBuilder.TYPE_EC_FP_PUBLIC, KeyBuilder.LENGTH_EC_FP_256, false ); ecdsaSignature = Signature.getInstance(Signature.ALG_ECDSA_SHA_256, false); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } public void process(APDU apdu) { byte[] buffer = apdu.getBuffer(); if (selectingApplet()) { return; } if (buffer[ISO7816.OFFSET_CLA] != CLA_CRYPTO) { ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED); } // Check PIN for all operations except PIN verification if (buffer[ISO7816.OFFSET_INS] != INS_VERIFY_PIN && !adminPIN.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } switch (buffer[ISO7816.OFFSET_INS]) { case INS_VERIFY_PIN: verifyPIN(apdu); break; case INS_GENERATE_KEY: generateKey(apdu); break; case INS_ENCRYPT: encryptData(apdu); break; case INS_DECRYPT: decryptData(apdu); break; case INS_SIGN: signData(apdu); break; case INS_VERIFY: verifySignature(apdu); break; case INS_GENERATE_RANDOM: generateRandom(apdu); break; default: ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED); } } private void verifyPIN(APDU apdu) { byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); if (adminPIN.check(buffer, ISO7816.OFFSET_CDATA, (byte)lc)) { apdu.setOutgoingAndSend((short)0, (short)0); } else { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } } private void generateKey(APDU apdu) { byte[] buffer = apdu.getBuffer(); byte keyType = buffer[ISO7816.OFFSET_P1]; // P1 parameter specifies key type try { switch (keyType) { case 0x01: // AES // Generate random AES key RandomData random = RandomData.getInstance(RandomData.ALG_SECURE_RANDOM); random.generateData(tempBuffer, (short)0, (short)32); // 256-bit key aesKey.setKey(tempBuffer, (short)0); break; case 0x02: // RSA // Generate RSA key pair KeyPair rsaPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_2048); rsaPair.genKeyPair(); rsaPrivateKey = (RSAPrivateKey)rsaPair.getPrivate(); rsaPublicKey = (RSAPublicKey)rsaPair.getPublic(); break; case 0x03: // ECC // Generate ECC key pair KeyPair eccPair = new KeyPair(KeyPair.ALG_EC_FP, KeyBuilder.LENGTH_EC_FP_256); eccPair.genKeyPair(); ecPrivateKey = (ECPrivateKey)eccPair.getPrivate(); ecPublicKey = (ECPublicKey)eccPair.getPublic(); break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); } apdu.setOutgoingAndSend((short)0, (short)0); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } private void encryptData(APDU apdu) { byte[] buffer = apdu.getBuffer(); byte algorithm = buffer[ISO7816.OFFSET_P1]; short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); try { short encryptedLength; switch (algorithm) { case 0x01: // AES aesCipher.init(aesKey, Cipher.MODE_ENCRYPT); encryptedLength = aesCipher.doFinal( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0 ); break; case 0x02: // RSA rsaSignature.init(rsaPrivateKey, Signature.MODE_SIGN); encryptedLength = rsaSignature.sign( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0 ); break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); return; } // Send encrypted data back apdu.setOutgoing(); apdu.setOutgoingLength(encryptedLength); apdu.sendBytesLong(tempBuffer, (short)0, encryptedLength); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } private void decryptData(APDU apdu) { byte[] buffer = apdu.getBuffer(); byte algorithm = buffer[ISO7816.OFFSET_P1]; short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); try { short decryptedLength; switch (algorithm) { case 0x01: // AES aesCipher.init(aesKey, Cipher.MODE_DECRYPT); decryptedLength = aesCipher.doFinal( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0 ); break; case 0x02: // RSA rsaSignature.init(rsaPublicKey, Signature.MODE_VERIFY); boolean verified = rsaSignature.verify( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0, (short)256 ); if (!verified) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); return; } decryptedLength = lc; break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); return; } // Send decrypted data back apdu.setOutgoing(); apdu.setOutgoingLength(decryptedLength); apdu.sendBytesLong(tempBuffer, (short)0, decryptedLength); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } private void signData(APDU apdu) { byte[] buffer = apdu.getBuffer(); byte algorithm = buffer[ISO7816.OFFSET_P1]; short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); try { short signatureLength; switch (algorithm) { case 0x01: // RSA rsaSignature.init(rsaPrivateKey, Signature.MODE_SIGN); signatureLength = rsaSignature.sign( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0 ); break; case 0x02: // ECDSA ecdsaSignature.init(ecPrivateKey, Signature.MODE_SIGN); signatureLength = ecdsaSignature.sign( buffer, ISO7816.OFFSET_CDATA, lc, tempBuffer, (short)0 ); break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); return; } // Send signature back apdu.setOutgoing(); apdu.setOutgoingLength(signatureLength); apdu.sendBytesLong(tempBuffer, (short)0, signatureLength); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } private void verifySignature(APDU apdu) { byte[] buffer = apdu.getBuffer(); byte algorithm = buffer[ISO7816.OFFSET_P1]; short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); // For signature verification, data comes in two parts short dataLength = (short)(buffer[ISO7816.OFFSET_P2] & 0xFF); short signatureOffset = (short)(ISO7816.OFFSET_CDATA + dataLength); short signatureLength = (short)(lc - dataLength); try { boolean verified; switch (algorithm) { case 0x01: // RSA rsaSignature.init(rsaPublicKey, Signature.MODE_VERIFY); verified = rsaSignature.verify( buffer, ISO7816.OFFSET_CDATA, dataLength, buffer, signatureOffset, signatureLength ); break; case 0x02: // ECDSA ecdsaSignature.init(ecPublicKey, Signature.MODE_VERIFY); verified = ecdsaSignature.verify( buffer, ISO7816.OFFSET_CDATA, dataLength, buffer, signatureOffset, signatureLength ); break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); return; } if (verified) { apdu.setOutgoingAndSend((short)0, (short)0); } else { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } private void generateRandom(APDU apdu) { byte[] buffer = apdu.getBuffer(); short le = apdu.setOutgoing(); try { RandomData random = RandomData.getInstance(RandomData.ALG_SECURE_RANDOM); random.generateData(tempBuffer, (short)0, le); apdu.setOutgoingLength(le); apdu.sendBytesLong(tempBuffer, (short)0, le); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } }

Payment Application Example

3. EMV-like Payment Applet

package com.payment; import javacard.framework.*; import javacard.security.*; import javacardx.crypto.*; public class PaymentApplet extends Applet { // Command constants private static final byte CLA_PAYMENT = (byte)0x80; private static final byte INS_INITIALIZE = (byte)0x50; private static final byte INS_VERIFY_PIN = (byte)0x20; private static final byte INS_CHANGE_PIN = (byte)0x24; private static final byte INS_GET_BALANCE = (byte)0x5C; private static final byte INS_DEBIT = (byte)0x5A; private static final byte INS_CREDIT = (byte)0x52; private static final byte INS_GET_TRANSACTION_LOG = (byte)0x5E; // PIN management private OwnerPIN pin; private static final byte PIN_TRY_LIMIT = (byte)3; private static final byte PIN_SIZE = (byte)4; // Account data private short balance; private short dailyLimit; private short dailySpent; private byte[] lastTransactionDate; // Transaction log private byte[] transactionLog; private short logPointer; private static final short LOG_SIZE = (short)10; private static final short LOG_ENTRY_SIZE = (short)8; // Cryptographic objects private DESKey desKey; private Cipher desCipher; // Card data private byte[] cardNumber; private byte[] cardHolderName; private byte[] expiryDate; public static void install(byte[] bArray, short bOffset, byte bLength) { new PaymentApplet().register(); } public PaymentApplet() { // Initialize PIN pin = new OwnerPIN(PIN_TRY_LIMIT, PIN_SIZE); // Initialize account data balance = (short)0; dailyLimit = (short)10000; // $100.00 dailySpent = (short)0; lastTransactionDate = new byte[3]; // YYMMDD // Initialize transaction log transactionLog = new byte[LOG_SIZE * LOG_ENTRY_SIZE]; logPointer = (short)0; // Initialize card data cardNumber = new byte[16]; cardHolderName = new byte[26]; expiryDate = new byte[2]; // Initialize cryptography initializeCrypto(); register(); } private void initializeCrypto() { try { desKey = (DESKey)KeyBuilder.buildKey( KeyBuilder.TYPE_DES, KeyBuilder.LENGTH_DES3_3KEY, false ); desCipher = Cipher.getInstance(Cipher.ALG_DES_CBC_NOPAD, false); } catch (CryptoException e) { // Handle initialization error } } public void process(APDU apdu) { byte[] buffer = apdu.getBuffer(); if (selectingApplet()) { return; } if (buffer[ISO7816.OFFSET_CLA] != CLA_PAYMENT) { ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED); } switch (buffer[ISO7816.OFFSET_INS]) { case INS_VERIFY_PIN: verifyPIN(apdu); break; case INS_CHANGE_PIN: changePIN(apdu); break; case INS_INITIALIZE: initializeCard(apdu); break; case INS_GET_BALANCE: getBalance(apdu); break; case INS_DEBIT: debit(apdu); break; case INS_CREDIT: credit(apdu); break; case INS_GET_TRANSACTION_LOG: getTransactionLog(apdu); break; default: ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED); } } private void verifyPIN(APDU apdu) { byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); if (pin.check(buffer, ISO7816.OFFSET_CDATA, (byte)lc)) { apdu.setOutgoingAndSend((short)0, (short)0); } else { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } } private void changePIN(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); pin.update(buffer, ISO7816.OFFSET_CDATA, (byte)lc); apdu.setOutgoingAndSend((short)0, (short)0); } private void initializeCard(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); short offset = ISO7816.OFFSET_CDATA; // Parse initialization data // Structure: [cardNumber(16)][cardHolderName(26)][expiryDate(2)][initialBalance(2)] // Card number Util.arrayCopyNonAtomic(buffer, offset, cardNumber, (short)0, (short)16); offset += 16; // Card holder name Util.arrayCopyNonAtomic(buffer, offset, cardHolderName, (short)0, (short)26); offset += 26; // Expiry date Util.arrayCopyNonAtomic(buffer, offset, expiryDate, (short)0, (short)2); offset += 2; // Initial balance balance = (short)((buffer[offset] << 8) | (buffer[offset + 1] & 0xFF)); apdu.setOutgoingAndSend((short)0, (short)0); } private void getBalance(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); // Return balance (2 bytes) buffer[0] = (byte)((balance >> 8) & 0xFF); buffer[1] = (byte)(balance & 0xFF); apdu.setOutgoingAndSend((short)0, (short)2); } private void debit(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); if (lc != 2) { ISOException.throwIt(ISO7816.SW_WRONG_LENGTH); } // Parse amount (2 bytes) short amount = (short)((buffer[ISO7816.OFFSET_CDATA] << 8) | (buffer[ISO7816.OFFSET_CDATA + 1] & 0xFF)); // Check balance if (amount > balance) { ISOException.throwIt((short)0x6A85); // Insufficient funds } // Check daily limit if ((dailySpent + amount) > dailyLimit) { ISOException.throwIt((short)0x6A86); // Daily limit exceeded } // Perform debit balance -= amount; dailySpent += amount; // Log transaction logTransaction((byte)0x01, amount); // 0x01 = debit apdu.setOutgoingAndSend((short)0, (short)0); } private void credit(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short lc = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); if (lc != 2) { ISOException.throwIt(ISO7816.SW_WRONG_LENGTH); } // Parse amount (2 bytes) short amount = (short)((buffer[ISO7816.OFFSET_CDATA] << 8) | (buffer[ISO7816.OFFSET_CDATA + 1] & 0xFF)); // Check for overflow if ((Short.MAX_VALUE - balance) < amount) { ISOException.throwIt((short)0x6A86); // Amount too large } // Perform credit balance += amount; // Log transaction logTransaction((byte)0x02, amount); // 0x02 = credit apdu.setOutgoingAndSend((short)0, (short)0); } private void getTransactionLog(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); short le = apdu.setOutgoing(); // Calculate how many log entries to return short entriesToReturn = (short)(le / LOG_ENTRY_SIZE); if (entriesToReturn > LOG_SIZE) { entriesToReturn = LOG_SIZE; } // Copy log entries to buffer short bytesToSend = (short)(entriesToReturn * LOG_ENTRY_SIZE); Util.arrayCopyNonAtomic(transactionLog, (short)0, buffer, (short)0, bytesToSend); apdu.setOutgoingLength(bytesToSend); apdu.sendBytes((short)0, bytesToSend); } private void logTransaction(byte type, short amount) { // Get current date (simplified - in real app, use secure clock) byte[] currentDate = getCurrentDate(); // Calculate log entry offset short offset = (short)(logPointer * LOG_ENTRY_SIZE); // Store transaction type transactionLog[offset] = type; offset++; // Store amount (2 bytes) transactionLog[offset] = (byte)((amount >> 8) & 0xFF); transactionLog[offset + 1] = (byte)(amount & 0xFF); offset += 2; // Store date (3 bytes - YYMMDD) Util.arrayCopyNonAtomic(currentDate, (short)0, transactionLog, offset, (short)3); // Update log pointer (circular buffer) logPointer = (short)((logPointer + 1) % LOG_SIZE); } private byte[] getCurrentDate() { // In a real application, this would get the date from a secure clock // For demonstration, return a fixed date byte[] date = new byte[3]; date[0] = (byte)0x18; // Year date[1] = (byte)0x01; // Month date[2] = (byte)0x01; // Day return date; } // Reset daily spent amount (should be called once per day) private void resetDailySpent() { dailySpent = (short)0; } }

Development Tools and Workflow

4. Java Card Development Setup

// Build script example (Ant build.xml) /* <project name="JavaCardApplet" default="build"> <property name="jckit.dir" value="/path/to/javacard-kit"/> <property name="applet.aid" value="0x01:0x02:0x03:0x04:0x05:0x06:0x07"/> <target name="build"> <javac srcdir="src" destdir="bin" bootclasspath="${jckit.dir}/lib/api.jar" target="1.1" source="1.1"/> <convert verbose="true" export="true" classdir="bin" jca="true" applet="0xa0:0x00:0x00:0x00:0x62:0x03:0x01:0x0c:0x06:0x01:${applet.aid}" i="MyApplet.cap"> <cap source="bin" package="com.example.MyApplet" /> </convert> </target> </project> */ // Testing framework example package com.test; import javacard.framework.*; import javacard.security.*; public class TestApplet extends Applet { private static final byte CLA_TEST = (byte)0x80; private static final byte INS_RUN_TESTS = (byte)0x70; public static void install(byte[] bArray, short bOffset, byte bLength) { new TestApplet().register(); } public void process(APDU apdu) { byte[] buffer = apdu.getBuffer(); if (selectingApplet()) { return; } if (buffer[ISO7816.OFFSET_CLA] != CLA_TEST) { ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED); } switch (buffer[ISO7816.OFFSET_INS]) { case INS_RUN_TESTS: runTests(apdu); break; default: ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED); } } private void runTests(APDU apdu) { byte[] buffer = apdu.getBuffer(); short testResults = 0; // Run various tests if (testMemory()) testResults |= 0x01; if (testCrypto()) testResults |= 0x02; if (testPIN()) testResults |= 0x04; // Return test results buffer[0] = (byte)(testResults & 0xFF); apdu.setOutgoingAndSend((short)0, (short)1); } private boolean testMemory() { try { byte[] testArray = new byte[100]; Util.arrayFillNonAtomic(testArray, (short)0, (short)100, (byte)0xAA); for (short i = 0; i < 100; i++) { if (testArray[i] != (byte)0xAA) { return false; } } return true; } catch (Exception e) { return false; } } private boolean testCrypto() { try { RandomData random = RandomData.getInstance(RandomData.ALG_SECURE_RANDOM); byte[] randomBytes = new byte[16]; random.generateData(randomBytes, (short)0, (short)16); return true; } catch (Exception e) { return false; } } private boolean testPIN() { try { OwnerPIN testPIN = new OwnerPIN((byte)3, (byte)4); byte[] testPinBytes = {(byte)0x12, (byte)0x34, (byte)0x56, (byte)0x78}; testPIN.update(testPinBytes, (short)0, (byte)4); return testPIN.check(testPinBytes, (short)0, (byte)4); } catch (Exception e) { return false; } } }

Best Practices and Security Considerations

5. Security Guidelines

package com.secure; import javacard.framework.*; import javacard.security.*; public class SecureApplet extends Applet { // Security best practices implementation // 1. Use secure random number generation private RandomData secureRandom; // 2. Implement proper PIN management private OwnerPIN pin; private static final byte PIN_TRY_LIMIT = (byte)3; // 3. Secure key storage private AESKey masterKey; // 4. Transaction counters private short transactionCounter; private short maxTransactionsPerSession = (short)10; // 5. Secure memory management private byte[] secureBuffer; private static final short SECURE_BUFFER_SIZE = (short)256; public SecureApplet() { // Initialize security components initializeSecurity(); } private void initializeSecurity() { try { // Initialize secure random secureRandom = RandomData.getInstance(RandomData.ALG_SECURE_RANDOM); // Initialize PIN pin = new OwnerPIN(PIN_TRY_LIMIT, (byte)6); // Initialize master key masterKey = (AESKey)KeyBuilder.buildKey( KeyBuilder.TYPE_AES, KeyBuilder.LENGTH_AES_256, false ); // Generate random key byte[] keyData = new byte[32]; secureRandom.generateData(keyData, (short)0, (short)32); masterKey.setKey(keyData, (short)0); // Initialize secure buffer secureBuffer = new byte[SECURE_BUFFER_SIZE]; // Clear sensitive data from memory Util.arrayFillNonAtomic(keyData, (short)0, (short)32, (byte)0); } catch (Exception e) { // Handle initialization errors securely ISOException.throwIt(ISO7816.SW_UNKNOWN); } } // Secure data processing private void processSecureData(APDU apdu) { if (!pin.isValidated()) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } // Check transaction counter if (transactionCounter >= maxTransactionsPerSession) { ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED); } byte[] buffer = apdu.getBuffer(); // Secure data processing with bounds checking short dataLength = (short)(buffer[ISO7816.OFFSET_LC] & 0xFF); if (dataLength > SECURE_BUFFER_SIZE) { ISOException.throwIt(ISO7816.SW_WRONG_LENGTH); } // Copy data to secure buffer Util.arrayCopyNonAtomic(buffer, ISO7816.OFFSET_CDATA, secureBuffer, (short)0, dataLength); // Process data... // Clear secure buffer after use Util.arrayFillNonAtomic(secureBuffer, (short)0, dataLength, (byte)0); // Increment transaction counter transactionCounter++; } // Secure key generation private void generateSecureKey() { try { // Generate key using secure random byte[] keyMaterial = new byte[32]; secureRandom.generateData(keyMaterial, (short)0, (short)32); // Set the key masterKey.setKey(keyMaterial, (short)0); // Clear key material from memory Util.arrayFillNonAtomic(keyMaterial, (short)0, (short)32, (byte)0); } catch (CryptoException e) { ISOException.throwIt(ISO7816.SW_UNKNOWN); } } // Secure memory cleanup public void deselect() { // Clear sensitive data when applet is deselected if (secureBuffer != null) { Util.arrayFillNonAtomic(secureBuffer, (short)0, SECURE_BUFFER_SIZE, (byte)0); } // Reset transaction counter transactionCounter = (short)0; // Reset PIN validation pin.reset(); } }

Key Java Card Features

  1. Limited Environment: Optimized for small memory footprint
  2. Security: Built-in cryptographic operations and secure element
  3. APDU Communication: ISO 7816 standard communication protocol
  4. Persistent Objects: Data persists across sessions
  5. Transaction Support: Atomic operations for data integrity
  6. GlobalPlatform: Standard for card management

Common Use Cases

  • Payment Systems: Credit/debit cards, e-wallets
  • Identification: National ID cards, employee badges
  • Mobile Communications: SIM cards
  • Access Control: Secure building access
  • Healthcare: Health insurance cards

Java Card technology enables secure, portable applications that can run on resource-constrained devices while maintaining high security standards.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper