<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 11, 2015 at 3:18 PM, Frank Morgner <span dir="ltr"><<a href="mailto:morgner@informatik.hu-berlin.de" target="_blank">morgner@informatik.hu-berlin.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wednesday, March 11 at 03:08PM, William Roberts wrote:<br>
> Ok got it thanks.<br>
><br>
> I was looking at the code for jcardsim and it looks like the crypto<br>
> operations are backed by bouncycastle. It also appears that their<br>
> are no Keystore interfaces. On actual smart cards, can an applet call<br>
> PrivateKey.getEncoded() and actually retreive the raw key bytes?<br>
><br>
> It would be nice to interface this stuff into AndroidKeyStore so private<br>
> keys cannot be leaked.<br>
<br>
</span>A Java Card applet expects the underlying platform to be secure by<br>
design. This should be handled in the crypto layer (i.e. spongycastle<br>
which is an Android substitute for bouncycastle).<br></blockquote><div><br></div><div>Android ships with a crippled bouncy castle built into the framework jar (device binary), which is why their is</div><div>the spongy castly split FYI. However, in either case, the keys are stored in your application</div><div>folder. So if anyone comprimises the app sandbox, they comprimise your keys and can offload them.</div><div><br></div><div>If you use Android Keystore, it stores and generates keys in TrustZone, or some other priveleged</div><div>component or discrete hardware. The key bytes are never released from the "secure element", whether</div><div>it be trustzone, TPM, etc.</div><div><br></div><div>Android has a much larger attack surface than a smartcard so using the keystore is a nice to have thing.</div><div><br></div><div>But this is really cool, I didn't know their was these off the shelf compoenents, thanks for sharing.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br>
> On Wed, Mar 11, 2015 at 12:11 AM, Frank Morgner <<br>
> <a href="mailto:morgner@informatik.hu-berlin.de">morgner@informatik.hu-berlin.de</a>> wrote:<br>
><br>
> > On Tuesday, March 10 at 05:52PM, William Roberts wrote:<br>
> > > On Tue, Mar 10, 2015 at 5:19 PM, Frank Morgner <<br>
> > > <a href="mailto:morgner@informatik.hu-berlin.de">morgner@informatik.hu-berlin.de</a>> wrote:<br>
> > ><br>
> > > > Hi!<br>
> > > ><br>
> > > > I created a simple App which uses Android’s HCE to fetch APDUs from a<br>
> > > > contact-less reader and delegate them to Java Card Applets. The app<br>
> > > > includes the Java Card simulation runtime of jCardSim [1] as well as<br>
> > the<br>
> > > > following Java Card applets:<br>
> > > ><br>
> > > > - Hello World applet [2]<br>
> > > > - OpenPGP applet [3]<br>
> > > > - OATH applet [4]<br>
> > > > - ISO applet [5]<br>
> > > ><br>
> > > > With some more effort I think this could be quite interesting for a<br>
> > > > variety of use cases. What do you think?<br>
> > > ><br>
> > ><br>
> > > Def tons of use cases. Can you elaborate on jcardsim? Looks like its<br>
> > just a<br>
> > > jar file you can load applet byte code into.<br>
> ><br>
> > Yes and no. jCardSim essentially provides all the packages of a standard<br>
> > Java Card as well as some simulation glue code (see<br>
> > <a href="http://jcardsim.org/docs/quick-start-guide-simulator-api" target="_blank">http://jcardsim.org/docs/quick-start-guide-simulator-api</a>). You need to<br>
> > have the applet compiled for the JRE (in my case Dalvik VM) to let the<br>
> > applet 'use' the java card environment of jCardSim.<br>
> ><br>
> > > > Greets, Frank.<br>
> > > ><br>
> > > ><br>
> > > > [0]<br>
> > <a href="https://frankmorgner.github.io/vsmartcard/ACardEmulator/README.html" target="_blank">https://frankmorgner.github.io/vsmartcard/ACardEmulator/README.html</a><br>
> > > > [1] <a href="http://www.jcardsim.org/" target="_blank">http://www.jcardsim.org/</a><br>
> > > > [2]<br>
> > > ><br>
> > <a href="https://github.com/licel/jcardsim/blob/master/src/main/java/com/licel/jcardsim/samples/HelloWorldApplet.java" target="_blank">https://github.com/licel/jcardsim/blob/master/src/main/java/com/licel/jcardsim/samples/HelloWorldApplet.java</a><br>
> > > > [3] <a href="https://developers.yubico.com/ykneo-openpgp/" target="_blank">https://developers.yubico.com/ykneo-openpgp/</a><br>
> > > > [4] <a href="https://developers.yubico.com/ykneo-oath/" target="_blank">https://developers.yubico.com/ykneo-oath/</a><br>
> > > > [5] <a href="http://www.pwendland.net/IsoApplet/" target="_blank">http://www.pwendland.net/IsoApplet/</a><br>
> ><br>
> > --<br>
> > Frank Morgner<br>
> ><br>
> > Virtual Smart Card Architecture <a href="http://vsmartcard.sourceforge.net" target="_blank">http://vsmartcard.sourceforge.net</a><br>
> > OpenPACE <a href="http://openpace.sourceforge.net" target="_blank">http://openpace.sourceforge.net</a><br>
> > IFD Handler for libnfc Devices <a href="http://sourceforge.net/projects/ifdnfc" target="_blank">http://sourceforge.net/projects/ifdnfc</a><br>
> ><br>
> > _______________________________________________<br>
> > Pcsclite-muscle mailing list<br>
> > <a href="mailto:Pcsclite-muscle@lists.alioth.debian.org">Pcsclite-muscle@lists.alioth.debian.org</a><br>
> > <a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle</a><br>
> ><br>
><br>
><br>
><br>
> --<br>
> Respectfully,<br>
><br>
> William C Roberts<br>
<br>
> _______________________________________________<br>
> Pcsclite-muscle mailing list<br>
> <a href="mailto:Pcsclite-muscle@lists.alioth.debian.org">Pcsclite-muscle@lists.alioth.debian.org</a><br>
> <a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle</a><br>
<br>
--<br>
Frank Morgner<br>
<br>
Virtual Smart Card Architecture <a href="http://vsmartcard.sourceforge.net" target="_blank">http://vsmartcard.sourceforge.net</a><br>
OpenPACE <a href="http://openpace.sourceforge.net" target="_blank">http://openpace.sourceforge.net</a><br>
IFD Handler for libnfc Devices <a href="http://sourceforge.net/projects/ifdnfc" target="_blank">http://sourceforge.net/projects/ifdnfc</a><br>
</div></div><br>_______________________________________________<br>
Pcsclite-muscle mailing list<br>
<a href="mailto:Pcsclite-muscle@lists.alioth.debian.org">Pcsclite-muscle@lists.alioth.debian.org</a><br>
<a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Respectfully,<br><br>William C Roberts<br><br></div>
</div></div>