The OpenSC-devel mailing list has also a drop in number of messages. Statistics for 2011 are available in OpenSC mailing list statistics for 2011.

Statistics from 1.1.2012 to 31.12.2012
for opensc-devel@lists.opensc-project.org

People who have written most messages:

Best authors, by total size of their messages (w/o quoting):

Best authors, by average size of their message (w/o quoting):

Table showing the most successful subjects:

Most used email clients:

Table of maximal quoting:

Graph showing number of messages written during hours of day:

msgs	14	12	1	0	2	2	5	5	19	70	56	48	26	37	44	41	38	30	34	28	24	28	38	24
hour	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23

Graph showing number of messages written during days of month:

msgs	7	15	25	18	22	19	13	15	19	22	19	25	13	13	10	20	21	19	28	28	38	30	41	23	29	22	39	14	7	6	5
day	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31

Graph showing number of messages written during days of week:

msgs	116	97	119	92	75	47	80
	Mon	Tue	Wed	Thu	Fri	Sat	Sun

Maximal quoting:

Longest message:

Most successful subject:

Final summary:

A new year is a good time for analysis of the past. As I did in 2009, 2010 and 2011 I propose some statistics of the MUSCLE mailing list usage.

• Maybe PC/SC on Unix is mature enough and problems are now solved (or with solutions available from the mailing list archives, blogs, etc.).
• Maybe PC/SC is a dead API, smart card is a dying technology and people are moving to something else/newer/more fun like NFC
• I also note that the activity of the PC/SC workgroup is very limited. Microsoft is no more a member of the PC/SC workgroup. Do not expect many changes in the Windows PC/SC layer.

Statistics from 3.1.2012 to 11.12.2012
for muscle@lists.musclecard.com

People who have written most messages:

Best authors, by total size of their messages (w/o quoting):

Best authors, by average size of their message (w/o quoting):

Table showing the most successful subjects:

Most used email clients:

Table of maximal quoting:

Graph showing number of messages written during hours of day:

msgs	3	2	1	0	0	1	1	2	4	19	17	12	15	18	22	18	21	9	13	7	5	9	4	3
hour	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23

Graph showing number of messages written during days of month:

msgs	4	3	8	5	14	8	11	4	8	4	13	7	1	4	0	5	4	12	6	5	6	8	7	8	7	8	4	11	8	6	7
day	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31

Graph showing number of messages written during days of week:

msgs	21	50	31	48	28	16	12
	Mon	Tue	Wed	Thu	Fri	Sat	Sun

Maximal quoting:

Longest message:

Most successful subject:

Final summary:

I just released a new version of pcsc-lite 1.8.7.

Changes:
pcsc-lite-1.8.7: Ludovic Rousseau
28 November 2012

• Fix a problem when a reader is unplugged (and the reader is still in use)

I made some graphical design (using CSS) for my Smart card ATR parsing online application.

I am not a web designer (you may have noticed). But I tried to make the interface nicer.

The new interface looks like:

• Parsing an ATR
• ATR not (yet) in my database

To continue the list of PC/SC wrapper initiated more than two years ago with "PC/SC sample in different languages" I now present a PC/SC sample in lua.

In a previous blog article "cardpeek: A tool to read the contents of smartcards" I presented an application using the lua language to interact with smart cards.

PC/SC access from lua

• connect
• disconnect
• warm_reset
• last_atr
• info
• send
• set_command_interval
• make_file_path

Source code

function hex_tostring(data)
 local r = ""
 local i
 for i=0,#data-1 do
  r = r .. string.char(data[i]) 
 end 
 return r
end

if card.connect() then
 card.tree_startup("ATR")

 -- Select applet
 select = bytes.new(8, "00 A4 04 00 0A A0 00 00 00 62 03 01 0C 06 01")
 sw, resp = card.send(select)
 print(string.format("SW: %X", sw))
 print(resp)

 -- Send command
 command = bytes.new(8, "00 00 00 00")
 sw, resp = card.send(command)
 print(string.format("SW: %X", sw))
 print(hex_tostring(resp))

 card.disconnect()
end

Remarks

Output

In the console

SW: 9000

SW: 9000
Hello world!

In cardpeek

Conclusion

A few days ago I discovered a nice tool: cardpeek.

Project

Cardpeek is a Linux/Windows tool to read the contents of ISO7816 smartcards. It features a GTK GUI to represent card data is a tree view, and is extendable with a scripting language (LUA).

The goal of this project is to allow smartcard owners to be better informed about what type of personal information is stored in these devices.

The tool currently reads the contents of :

• EMV cards, including NFC ones.
• Navigo public transport cards (partially supports MOBIB as well)
• The French health card "Vitale 2"
• Electronic/Biometric passports in BAC security mode.

It can also read the following cards with limited interpretation of data:

• Some Mifare cards (such as the Thalys card);
• Moneo, the French electronic purse;
• GSM SIM cards.

Installation

Examples

EMV

Navigo Pass

The "calypso" script included in cardpeek can read the content of Navigo cards used in Paris. It provides enhanced "event log" analysis notably with subway/train station names, as illustrated in the screenshot above. It has been successfully tested on Navigo Découverte, Navigo and Navigo Intégrale cards.

SIM

Conclusion

I just released a version 1.4.8 of libccid the free software CCID class smart card reader driver.

1.4.8 - 22 June 2012, Ludovic Rousseau

• Add support of
  
  • SCR3310-NTTCom USB (was removed in version 1.4.6)
  • Inside Secure VaultIC 420 Smart Object
  • Inside Secure VaultIC 440 Smart Object
• Wait up to 3 seconds for reader start up
• Add support of new PC/SC V2 part 10 properties:
  
  • dwMaxAPDUDataSize
  • wIdVendor
  • wIdProduct
• Use helper functions from libPCSCv2part10 to parse the PC/SC v2 part 10 features

Since 2010 I provide a way to parse an ATR online using a web page. I also provide a Python script to do the same using a command line tool.

I am not a user interface design expert. But I like to have important elements in color. Syntax colorization is a great invention. So I decided to add color to the ATR parsing results.

Web page

Before

(compact TLV data object)
    Tag: 3, Len: 1 (card service data byte)
      Card service data byte: 193
        - Application selection: by full DF name
        - Application selection: by partial DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card without MF
    Tag: 7, Len: 3 (card capabilities)
      Selection methods: 192
        - DF selection by partial DF name
        - DF selection by full DF name
      Data coding byte: 1
        - Behaviour of write functions: one-time write
        - Value 'FF' for the first byte of BER-TLV tag fields: valid
        - Data unit in quartets: 1
     Command chaining, length fields and logical channels: 0
        - Logical channel number assignment: No logical channel
        - Maximum number of logical channels: 0
    Mandatory status indicator (3 last bytes)
      LCS (life card cycle): 0 (No information given)
      SW: 9000 ()

After

(compact TLV data object)
    Tag: 3, Len: 1 (card service data byte)
      Card service data byte: 193
        - Application selection: by full DF name
        - Application selection: by partial DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card without MF
    Tag: 7, Len: 3 (card capabilities)
      Selection methods: 192
        - DF selection by partial DF name
        - DF selection by full DF name
      Data coding byte: 1
        - Behaviour of write functions: one-time write
        - Value 'FF' for the first byte of BER-TLV tag fields: valid
        - Data unit in quartets: 1
      Command chaining, length fields and logical channels: 0
        - Logical channel number assignment: No logical channel
        - Maximum number of logical channels: 0
    Mandatory status indicator (3 last bytes)
      LCS (life card cycle): 0 (No information given)
      SW: 90 00 ()

Command line

Before

ATR: 3B FA 13 00 FF 81 31 80 45 00 31 C1 73 C0 01 00 00 90 00 B1
TS = 0x3B --> Direct Convention
T0 = 0xFA --> Y(1): b1111, K: 10 (historical bytes)
 TA(1) = 0x13 --> Fi=372, Di=4, 93 cycles/ETU (43010 bits/s at 4.00 MHz, 53763 bits/s for fMax=5 MHz)
 TB(1) = 0x00 --> VPP is not electrically connected
 TC(1) = 0xFF --> Extra guard time: 255 (special value)
 TD(1) = 0x81 --> Y(i+1) = b1000, Protocol T=1
----
 TD(2) = 0x31 --> Y(i+1) = b0011, Protocol T=1
----
 TA(3) = 0x80 --> IFSC: 128
 TB(3) = 0x45 --> Block Waiting Integer: 4 - Character Waiting Integer: 5
----
Historical bytes --> 00 31 C1 73 C0 01 00 00 90 00
  Category indicator byte: 0x00 -->  (compact TLV data object)
    Tag: 3, Len: 1 (card service data byte)
      Card service data byte: 193
        - Application selection: by full DF name
        - Application selection: by partial DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card without MF
    Tag: 7, Len: 3 (card capabilities)
      Selection methods: 192
        - DF selection by partial DF name
        - DF selection by full DF name
      Data coding byte: 1
        - Behaviour of write functions: one-time write
        - Value 'FF' for the first byte of BER-TLV tag fields: valid
        - Data unit in quartets: 1
      Command chaining, length fields and logical channels: 0
        - Logical channel number assignment: No logical channel
        - Maximum number of logical channels: 0
    Mandatory status indicator (3 last bytes)
      LCS (life card cycle): 0 (No information given)
      SW: 9000 ()
TCK = 0xB1  --> (correct checksum)
Possibly identified card: OpenPGP

After

ATR: 3B FA 13 00 FF 81 31 80 45 00 31 C1 73 C0 01 00 00 90 00 B1
TS = 0x3B --> Direct Convention
T0 = 0xFA --> Y(1): b1111, K: 10 (historical bytes)
 TA(1) = 0x13 --> Fi=372, Di=4, 93 cycles/ETU (43010 bits/s at 4.00 MHz, 53763 bits/s for fMax=5 MHz)
 TB(1) = 0x00 --> VPP is not electrically connected
 TC(1) = 0xFF --> Extra guard time: 255 (special value)
 TD(1) = 0x81 --> Y(i+1) = b1000, Protocol T=1
----
 TD(2) = 0x31 --> Y(i+1) = b0011, Protocol T=1
----
 TA(3) = 0x80 --> IFSC: 128
 TB(3) = 0x45 --> Block Waiting Integer: 4 - Character Waiting Integer: 5
----
Historical bytes --> 00 31 C1 73 C0 01 00 00 90 00
  Category indicator byte: 0x00 -->  (compact TLV data object)
    Tag: 3, Len: 1 (card service data byte)
      Card service data byte: 193
        - Application selection: by full DF name
        - Application selection: by partial DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card without MF
    Tag: 7, Len: 3 (card capabilities)
      Selection methods: 192
        - DF selection by partial DF name
        - DF selection by full DF name
      Data coding byte: 1
        - Behaviour of write functions: one-time write
        - Value 'FF' for the first byte of BER-TLV tag fields: valid
        - Data unit in quartets: 1
      Command chaining, length fields and logical channels: 0
        - Logical channel number assignment: No logical channel
        - Maximum number of logical channels: 0
    Mandatory status indicator (3 last bytes)
      LCS (life card cycle): 0 (No information given)
      SW: 90 00 ()
TCK = 0xB1  --> correct checksum
Possibly identified card: OpenPGP

Conclusion

Adobe just published an article "Inappropriate Use of Adobe Code Signing Certificate" describing the inappropriate use of their code signature private key.

Adobe uses a Hardware Security Module (HSM) to store the private key. The signature requests are sent by build servers and signed by the HSM.

Unfortunately one build server has been compromised and malicious software has been signed.

Lessons

• only one signed document may be enough for the attacker
• noticing something is wrong requests some user intelligence

Conclusion

• provide systems simple to understand
• provide some kind of detection of strange events
• provide a way to easily revoke a compromised key

2 months after the release of Mountain Lion, Apple (Shawn Gedddis) just released a new (beta) tokend package installer for Mountain Lion (10.8).

From http://smartcardservices.macosforge.org/trac/wiki/installers

« This installs the Tokend modules which no longer ship from Apple as part of Mac OS X beginning with OS X Lion (v10.7). Note that this installer will ONLY install onto OS X Mountain Lion v10.8. The Tokend modules installed are: BELPIC, CAC, CACNG, JPKI and PIV.

New to this release:
• JPKI.Tokend - Build 38522 added to the update to support LASCOM in Japan.
• cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations.
• SystemCACertificates.keychain - Automatically added to the Keychain Search List if not already present. »