Sourcing 3.04 Javacards

[ffries]

Please don't close this message, it is a real issue from users. We all have difficulties sourcing 3.04 smartcards, so we cannot participate in the development and testing of SmartPGP.

At the moment the only 3.04 smarcards available online are Chinese.

Therefore could someone (not from the ANSSI) explain us how to buy a 3.04 Javacard online and have it delivered in Europe (France). I understand developers from the ANSSI cannot reply this question.

Please leave this thread open until a solution comes.

Kind regards,
French Fries

[breard-r]

The ACOS-J does support Java Card 3.0.4 and you can order some from smartcardfocus, they are based in the UK and deliver in France for a reasonable fee. The only thing to keep in mind is to use smartpgp-cli instead of gpg --card-edit if you wish to change the type of keys (see #15 for more details).

By the way, I highly recommend you to buy at least 3 of them (just to be sure I bought 4). I killed one while messing with it a little bit too much and you should always have a back-up, so 3 is a reasonable number.

I agree this in not the best card, but it's the only working one I have been able to by from France without a prohibitive delivery fee.

[ffries]

Thank you very much.
ACS is Chinese, right?

I want to work on OpenSC support and interoperability.
I am surprised, is 40k enough for the SmartPGP card ?

[breard-r]

I am surprised, is 40k enough for the SmartPGP card ?

Yes it is. The README is quite explicit about it.

[dschuermann]

You can also try NXP J3H145, works pretty okayish with SmartPGP (https://www.javacardos.com/store/products/10029).

[ffries]

Thanks a lot. I could also find the J3H145 here in Europe:
https://www.motechno.com/buy/j3h145-jcop3/
but too expensive

Finally, I bought 3 ACOS-J for testing.

I also found this information useful:

Supported algorithms:
https://www.fi.muni.cz/~xsvenda/jcalgtest/table.html

Martin Pajak buyer guide
https://github.com/martinpaljak/GlobalPlatformPro/tree/master/docs/JavaCardBuyersGuide#javacard-buyers-guide-of-2015

[bmunger]

Looks like the ACOS-J cards don't support RSA above 2048 which is disappointing. Would be nice to find something that could support 4096 at the same price point.

https://github.com/crocs-muni/JCAlgTest/blob/master/Profiles/results/ACS_ACOSJ_(Combi)_ALGSUPPORT__3b_69_00_02_41_43_4f_53_4a_76_31_30_31_(provided_by_Alexandre_Bouvier).csv

[breard-r]

I just had some serious issues with the ACOS-J cards. At some point (after 12 and 3 month of use in my case), after a successful decryption, the card suddenly stop working. GnuPG can see all details on the card but cannot have it do any cryptographic operation. Uploading new keys and factory-reset the card does not work. Trying to delete the applet does not work either and may make the card non-responsive. Since this is the second card that have this issue, I think it is save to say this model is defunct and I will stop recommending it.

Since SmartPGP has a JavaCard 3.0.1 version, I think that, when my current and last ACOS-J card dies, I will test the J3D081.

[bmunger]

Good to to know. Also will be testing J3H145. It can be SIM cut and also found in a few different places. Currently also having an issue with ACOS-J, unusable from factory.

[rileyg98]

The J3H145 is good - but exercise care with install/uninstall.

[bmunger]

I have not been able to get RSA4096 working on the J3H145 card. It advertises support and I requested that support be enabled.

On gpg keytocard, I get this error:
gpg: KEYTOCARD failed: Hardware problem

On suspicion, I loaded JCAlgTest v1.7.1 (last one with GP 2.2.1 support) and ran the test. From the output I have this:

TYPE_RSA_PUBLIC LENGTH_RSA_4096;yes;0.042000
TYPE_RSA_PRIVATE LENGTH_RSA_4096;yes;0.051000
TYPE_RSA_CRT_PRIVATE LENGTH_RSA_4096;yes;0.103000
ALG_RSA LENGTH_RSA_4096;no;
ALG_RSA_CRT LENGTH_RSA_4096;no;

I don't know what to make of that. It looks like it's not fully supported. Can anyone with this card confirm if RSA4096 actually works?
Thanks.

[rileyg98]

Should be ok to load the latest JCAlgTest on a J3H145 - it runs JC3.0.4.

I believe RSA4096 support needs to be either ordered from NXP for the J3H145 or enabled during the initalisation (it's not by default - possibly due to ram usage?).

[bmunger]

I did attempt to load the GP 2.2.2 cap file and it did not load, but I know for a fact the card only supports GP 2.2.1 so JCAlgTest last supported it in v1.7.1 which loaded just fine.

When I ordered the card, I asked it to be initialized with RSA4096 support. I don't know if it was completely done. I need to know if it's a problem with this card in general, or an initialization issue.

[rileyg98]

from what I can tell you, it's an initialization issue. NXP must give you the commands to upgrade that to 4096 from 2048 default, and it's done during init. If you have the cards and didn't have to initialize them yourself, it's too late to do so.

[bmunger]

I had to order them initialized since they don't give the documentation without an NDA with NXP for the proprietary commands to set these things.

[rileyg98]

Unfortunately, yes. It's why I have to be so vague. NXP NDA's are very strict - it took me months to get basic user manuals for their recent chips.