Search code examples
smartcardjavacardapduglobalplatform

Logical channels in smartcard

The below image is output of pcsc_scan in ubuntu and as you see in ATR analyse, my javacard support 3 logical channel.

enter image description here

And this is a part of ISO 7816-4 that mentioned the low nibble bits in CLA, indicate logical channel number:

enter image description here

The question is : why when I want to send INITIAL-UPDATE APDU command via another logical channel than Basic logical channel, it fails?

Initial Update with CLA = 80 [Basic logical channel]

< 80 50 00 00 08 00
< 00 00 00 00 00 00 00 00
> 611C

< 00 C0 00 00 00 1C 
> 00 11 60 01 03 8A 79 0A F9 FF 02 00 35 F3 92 EC 2B 6F F5 10 2E BD 74 41 2F 25 B4
> 90 00

Initial Update with CLA = 81 or 82 [Supplementary logical channels]

< 81 50 00 00 08 00
< 00 00 00 00 00 00 00 00
> 6881

< 82 50 00 00 08 00
< 00 00 00 00 00 00 00 00
> 6881

As you see, I received SW = 6881, [= Logical channel not supported]. why?

Update :

"If a javacard has two/three logical channel, that mean we can select two/three applet in simultaneously", And is this right? if yes, what is other benefits of having more than one channel? if no, what is this channels for?

Solution

  • It rather depends on the interpretation of ISO 7816-4 how this is handled. ISO 7816-4 specifies very little about the internal state of smart cards. It is certainly sufficiently vague to leave this specific issue open to interpretation.

    Now normally you can have multiple logical channels by using the MANAGE CHANNEL (INS = 70h) APDU. You cannot simply switch over to another channel by specifying the bits in the CLA byte; the channel needs to be open first. Furthermore, it isn't said that the authentication or file system state is taken over by the new channel.

    You should see the logical channel as an option to run multiple applications at the same time, where the logical channels are used to interleave commands over the single (half-duplex) communication channel. This is useful if you have different services requiring smart card communication on your terminal (PC).

    Obviously logical channels have big drawbacks; you need to keep state for each logical channel. Possibly, you may need to mix state as well (i.e. a PIN VERIFY may be used for both channels). This is very specifically an issue with regards to transient memory (RAM) usage.

    Normally you see only cards with 2 logical channels. Most of the time, only one of them will be used. 99% of the time it is better to only allow exclusive access to a single service, and let the smart card services run in sequence. Note that many cards now run at 30 MHz or over, but still have only 8 KiB of RAM in total.

    You can try to use MANAGE CHANNEL, but it could be that your ATR is lying to you and that not all applications support logical channels (such as the Global Platform Card Manager). Note too that Global Platform uses proprietary APDU commands/responses (the highest bit set in CLA = 80h) so officially, you only have the Global Platform specification to refer to.