Communicate with smartcard reader through Android

Question

I'm trying to send a command to a smart card. I use a Gemalto IDBridge CT30 (PC TWIN reader) and a IDBridge K30 connected to the Android device over USB.

I try to send a SELECT APDU command over USB:

boolean claim = openedConnection.claimInterface(usbInterface, true);
byte[] data = new byte[]{
        (byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x0C,
        (byte) 0x07, (byte) 0xA0, (byte) 0x00, (byte) 0x00,
        (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x4E};

After that I receive an answer:

final int dataTransferred = this.openedConnection.bulkTransfer(endPointOut, data, data.length, TIMEOUT_MS);
if(!(dataTransferred == 0 || dataTransferred == data.length)) {
    throw new Exception("Error durring sending command [" + dataTransferred + " ; " + data.length + "]"); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
}

final byte[] responseBuffer = new byte[endPointIn.getMaxPacketSize()];
final int dataTransferred = this.openedConnection.bulkTransfer(this.endPointIn, responseBuffer, responseBuffer.length, TIMEOUT_MS);
Console.writeLine("USB Retrieve: " + dataTransferred + " " + responseBuffer.length);
if(dataTransferred >= 0){
    return responseBuffer;
}
throw new Exception("Error durring receinving response [" + dataTransferred + "]");

That answer is

0x00 0x00 0x00 0x00 0x00 0xA0 0x00 0x41 0x03 0x00

However, I should get an answer of 0x90 0x00 according to the test project here.

What am I doing wrong? Can anybody help me? Do I use the correct approach? I'm not using the default package classes of javax.smartcardio. I use the USB interface classes (e.g. UsbDevice) directly.

Answer 1

Your reader device speaks CCID over the USB interface. You cannot simply send an APDU (smartcard command) over the bulk-out endpoint and expect to receive a response APDU over the bulk-in endpoint. Instead you need to implement the CCID device class protocol (see USB Device Class Specifications). The steps are something like:

1. Send PC_to_RDR_IccPowerOn command to activate the card.

   62 00000000 00 00 00 0000 
   |  |        |  |  |  |    |
   |  |        |  |  |  |    \--> Empty data field
   |  |        |  |  |  \-------> Unused, set to 0x0000
   |  |        |  |  \----------> Power select: 0x00 indicates automatic selection
   |  |        |  \-------------> Sequence number (increment for each command)
   |  |        \----------------> Slot number (seems to be zero for your device)
   |  \-------------------------> Length of data field (LSB first)
   \----------------------------> Message type: 0x62 indicates PC_to_RDR_IccPowerOn
   

2. Receive the ATR through RDR_to_PC_DataBlock.

   80 18000000 00 00 00 00 00 3BBF11008131FE45455041000000000000000000000000F1 
   |  |        |  |  |  |  |  |
   |  |        |  |  |  |  |  \--> Data field: ATR
   |  |        |  |  |  |  \-----> Level parameter
   |  |        |  |  |  \--------> Error register (should be zero on success)
   |  |        |  |  \-----------> Status register (should be zero on success)
   |  |        |  \--------------> Sequence number (matches the sequence number of the command)
   |  |        \-----------------> Slot number (matches the slot number of the command)
   |  \--------------------------> Length of data field (LSB first)
   \-----------------------------> Message type: 0x80 indicates RDR_to_PC_DataBlock
   

3. Send command APDU wrapped into PC_to_RDR_XfrBlock command

   6F 0C000000 00 01 00 0000 00A4040C07A000000118454E
   |  |        |  |  |  |    |
   |  |        |  |  |  |    \--> Data field: Command APDU
   |  |        |  |  |  \-------> Level parameter (0x0000 for normal length APDUs)
   |  |        |  |  \----------> Block waiting timeout
   |  |        |  \-------------> Sequence number (increment for each command)
   |  |        \----------------> Slot number (seems to be zero for your device)
   |  \-------------------------> Length of data field (LSB first)
   \----------------------------> Message type: 0x6F indicates PC_to_RDR_XfrBlock
   

4. Receive response APDU through RDR_to_PC_DataBlock.

   80 02000000 00 01 00 00 00 9000 
   |  |        |  |  |  |  |  |
   |  |        |  |  |  |  |  \--> Data field: Response APDU
   |  |        |  |  |  |  \-----> Level parameter
   |  |        |  |  |  \--------> Error register (should be zero on success)
   |  |        |  |  \-----------> Status register (should be zero on success)
   |  |        |  \--------------> Sequence number (matches the sequence number of the command)
   |  |        \-----------------> Slot number (matches the slot number of the command)
   |  \--------------------------> Length of data field (LSB first)
   \-----------------------------> Message type: 0x80 indicates RDR_to_PC_DataBlock
   

5. Repeat steps 3 and 4 for each APDU exchange (don't forget to increment the sequence number).

Since the ATR indicates T=1 as first protocol, you might need to wrap your APDU into T=1 TPDUs (depending on the reader configuration). The I-block for the first APDU would look something like:

00 00 0C 00A4040C07A000000118454E 15
|  |  |  |                        |
|  |  |  |                        \--> LRC (due to missing TC in ATR): XOR checksum over all other bytes
|  |  |  \---------------------------> INF: APDU
|  |  \------------------------------> LEN: length of INF field
|  \---------------------------------> PCB: toggle between 0x00 and 0x40 for every other I-block
\------------------------------------> NAD: node addressing

So your PC_to_RDR_XfrBlock command would look like:

6F 10000000 00 01 00 0000  00 00 0C 00A4040C07A000000118454E 15

You would then either receive your answer wrapped in an I-block or an R- or S-block indicating that some special/error treatment is necessary.

Answer 2

What you send is a SELECT command, with a given AID, which easily could produce a result. You clearly indicate, however, that you are not interested in a response, by

• setting P2 to '0C'
• not providing an LE byte (assuming a block based protocol, surely reasonable for USB)

So one may conclude, that your card is not compliant to ISO 7816-4; on the other hand, the response does not contain anything looking like an error SW1/SW2 status either, are you sure, to have responsebuffer dumped?