Smart Card Guy

Smart Card / Java Card, Cyber Security, IoT Device Security, Root of Trust, 標準化等

APDU (Application Protocol Data Unit) プロトコル

定義

  • ISO 7816-4で定義したSmart Card向け通信プロトコル
  • CAD(Card Acceptance Device - Reader、TerminalのようなHost)側からCardへ送るCommand APDU(C-APDU)と、Card側からCADへ送るResponse APDU(R-APDU)で構成。
  • Smart Card - CADの構成で、Smart Cardはいつもpassive(Slave)ロール。CAD側からC-APDUが来るのを待ってそれに対し、R-APDUを返す。
  • Transport LayerにはTPDUプロトコルがISO 7816-3で定義。簡単に以下の2つのパターンが存在するということだけ抑えておこう。
    • T=0 protocol : byte-oriented
    • T=1 protocol : block-oriented

Command APDU

f:id:blog-guy:20180630102534p:plain

header (Mandatory)
  • CLA : Class of Instruction
  • INS : Instruction Code
  • P1 : Parameter 1
  • P2 : Parameter 2
body (Optional)
  • Lc : length of data field
  • Data Field : Cardへ送るデータ
  • Le : Maximum of bytes expected in the data field of the response to the command

Response APDU

f:id:blog-guy:20180630102552p:plain

body (Optional)
  • Data Field
trailer (Mandatory)
  • SW1 : Status word 1
  • SW2 : Status word 2. SW1, SW2と合わせてステータスを表す。例)0x9000 : Success

C-APDU / R-APDUパターン (4 cases)

f:id:blog-guy:20190222171540p:plain

Case 1 - No command data, no reponse data
  • No data are transferred to or from the card.
  • C-APDU contains only the header.
  • R-APDU contains only the trailer status word.
Case 2 - No command data, send reponse data
  • No data are transferred to the card, but data are returned from the card.
  • The body of the C-APDU contains one byte - the Le field, which specifies the number of data bytes in the corresponding R-APDU.
Case 3 - Receive command data, no reponse data
  • Data are transferred to the card, but no data are returned from the card as a result of processing the command.
  • The body of the C-APDU includes the Lc field and the data field. The Lc byte specifies the length of the data field.
  • The R-APDU contains only the trailer status word.
Case 4 - Receive command data, send reponse data
  • Data are transferred to the card, and data are returned from the card as a result of processing the command.
  • The body of the C-APDU includes the Lc field, the data field, and the Le field.
  • The R-APDU contains both the data and the trailer status word.

Status Word

cardwerk.com