?? 105-107.html
字號:
<!-- Edit EirGrabber 3.01 -->
<HTML>
<HEAD>
<TITLE>Smart Card Developer's Kit:The Schlumberger Multiflex Smart Card</TITLE>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="102-105.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="107-109.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<P>All the commands in Table 5.13 are described in detail in the 3K Multiflex documentation on the CD-ROM.
</P>
<H4 ALIGN="LEFT"><A NAME="Heading11"></A><FONT COLOR="#000077">Protected-Mode Commands</FONT></H4>
<P><TT>Stamped Increase</TT> and <TT>Decrease</TT> commands are examples of a technique a terminal can use to guard against rogue cards. Protected-mode commands are how a card protects itself against rogue terminals.</P>
<P>In order for the terminal to execute a command that has been given a protected-mode access condition, the terminal must first get a random eight challenge from the card using the <TT>Get Challenge</TT> command. The terminal encrypts this challenge using a specific key shared with the card and returns the encrypted challenge—the cryptogram—along with the protected mode command. The card decrypts the cryptogram and if it gets the challenge it sent, then it knows the terminal possesses the same key as it does and it executes the command. If the cryptogram does not successfully decrypt, the card aborts the command and returns an error status.</P>
<P>Suppose the <TT>Update</TT> command has been given a protected mode access condition on a selected transparent file using key 1 in the external authentication key file and the terminal wants to write <TT>ab</TT> into the first 2 bytes of the file. The terminal begins by sending the card a <TT>Get Challenge</TT> command. This is to get the plain text of the cryptogram it has to return to the card with the <TT>Update</TT> command:</P>
<TABLE WIDTH="100%"><TR>
<TH WIDTH="14%" ALIGN="LEFT">CLA
<TH WIDTH="14%" ALIGN="LEFT">INS
<TH WIDTH="11%">
<TH WIDTH="11%">
<TH WIDTH="50%" ALIGN="LEFT">Data Length
<TR>
<TD COLSPAN="5"><HR>
<TR>
<TD>C0<SUB>16</SUB>
<TD>D6<SUB>16</SUB>
<TD>00<SUB>16</SUB>
<TD>00<SUB>16</SUB>
<TD>08<SUB>16</SUB>
</TABLE>
<P>The card responds with
</P>
<P>64<SUB>16</SUB> 46<SUB>16</SUB> 27<SUB>16</SUB> E0<SUB>16</SUB> 07<SUB>16</SUB> 9D<SUB>16</SUB> D8<SUB>16</SUB> 6C<SUB>16</SUB> 90<SUB>16</SUB> 00<SUB>16</SUB></P>
<P>which is 8 random bytes followed by the normal completion status return. The terminal DES encrypts these with key 1 in the external authentication key file (47<SUB>16</SUB> 46<SUB>16</SUB> 58<SUB>16</SUB> 49<SUB>16</SUB> 32<SUB>16</SUB> 78<SUB>16</SUB> 40<SUB>16</SUB>) and sends the card the <TT>Update</TT> command together with this encryption:</P>
<TABLE WIDTH="100%"><TR>
<TH WIDTH="10%" ALIGN="LEFT">CLA
<TH WIDTH="10%" ALIGN="LEFT">INS
<TH WIDTH="20%" ALIGN="LEFT">Offset High
<TH WIDTH="15%" ALIGN="LEFT">Offset Low
<TH WIDTH="15%" ALIGN="LEFT">Length
<TH WIDTH="30%" ALIGN="LEFT">Cryptogram
<TR>
<TD COLSPAN="6"><HR>
<TR>
<TD VALIGN="TOP">C0<SUB>16</SUB>
<TD VALIGN="TOP">84<SUB>16</SUB>
<TD VALIGN="TOP">00<SUB>16</SUB>
<TD VALIGN="TOP">00<SUB>16</SUB>
<TD VALIGN="TOP">0A<SUB>16</SUB>
<TD>61<SUB>16</SUB> 62<SUB>16</SUB> 0D<SUB>16</SUB> 31<SUB>16</SUB> A8<SUB>16</SUB> F3<SUB>16</SUB> 1C<SUB>16</SUB> EF<SUB>16</SUB> 78<SUB>16</SUB> F8<SUB>16</SUB>
</TABLE>
<P>Here 61<SUB>16</SUB> 62<SUB>16</SUB> is the character sequence <TT>ab</TT> that the command will write starting at offset 0000<SUB>16</SUB> in the file and 0D<SUB>16</SUB> 31<SUB>16</SUB> A8<SUB>16</SUB> F3<SUB>16</SUB> 1C<SUB>16</SUB> EF<SUB>16</SUB> 78<SUB>16</SUB> F8<SUB>16</SUB> is the DES encryption of the challenge.</P>
<P>The card decrypts the trailing 8 bytes using the key associated with the <TT>Update</TT> command in the current external authentication key file, and upon getting what it sent in response to the <TT>Get Challenge</TT> command, which it remembered, executes the <TT>Update</TT> command.</P>
<H3><A NAME="Heading12"></A><FONT COLOR="#000077">Internal and External Authentication</FONT></H3>
<P>As you may have already gathered, the way you establish your identity in the world of smart cards is by demonstrating possession of a secret—typically a key of some sort. You can demonstrate such a possession by simply showing the secret, as in the case of a PIN, or you can demonstrate possession of it by doing something that only somebody with the secret could do, such as encrypting a message with the key.
</P>
<P>Internal and external authentication use the latter technique to establish identity. The terminal uses internal authentication to establish the identity of the card and the card uses external authentication to establish the identity of the terminal.</P>
<P>Both protocols start by wondering about the other side’s identity and sending a challenge—a random 8-byte sequence—to the side whose identity is being questioned. The side receiving the challenge encrypts it with its secret, a particular key, and sends back the encrypted result. The side that originally sent the challenge decrypts the encrypted message using the key it knows the other possesses if it is authentic. If the message decrypts satisfactorily (that is, the decrypted challenge is identical to the challenge originally sent), then the side sending the original challenge knows that the other side possesses a particular key and this establishes its identity. What is critical is to note this possession has been demonstrated without exposing the secret itself.</P>
<P>Since we’ve already seen two examples of the card establishing the identity of the external world, <TT>Verify PIN</TT> and <TT>Verify Key</TT>, let’s walk through an example of the terminal establishing the identity of the card. A terminal would do this to ensure that it isn’t unwittingly talking to a rogue smart card; that is, a smart card that looks like the real thing to the terminal but isn’t.</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="102-105.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="107-109.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
</BODY></HTML>
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -