I want to use GloblaPlatformPro to load a new applet in a SIM card. I do have the key-mac , key-dek, and key-enc. However, I’m getting this error when GPPro tries to secure the channel to simply list the content of the card.
Failed to open secure channel: Card cryptogram invalid!
Here’s a full log (however, I redacted the keys from the log just to be safe)
# GP_READER='Generic USB2.0-CRW 01'
# gp -d -v -i -l --key-enc XXXXXXXXXXXXXXXXXX --key-mac XXXXXXXXXXXXXXXXXX --key-dek XXXXXXXXXXXXXXXXXX
# GlobalPlatformPro v21.12.31-55-g52c3581
# Running on Mac OS X 14.1 aarch64, Java 11.0.21 by Amazon.com Inc.
[DEBUG] TerminalManager - Processing 2 readers with 'Generic USB2.0-CRW 01' as preferred and null as ignored
[DEBUG] TerminalManager - Preferred reader: Optional.empty
# SCardConnect("Generic EMV Smartcard Reader", T=*) -> T=0, 3B9F97C00A1FC78031E073FE211F65D00233150E810FE9
A>> T=0 (4+0000) 00A40400 00
A<< (0140+2) (16ms) 6F81898407A0000000030000A57E73... 9000
[DEBUG] GPSession - Auto-detected ISD: A0000000030000
A>> T=0 (4+0000) 80CA9F7F 00
A<< (0045+2) (10ms) 9F7F2A129000D200770115011D33A2FF2D00720018FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9000
[WARN] GPData - Invalid CPLC date: 33A2
[DEBUG] GPData - 0x0000/0xFFFF does not represent a valid date
[DEBUG] GPData - 0x0000/0xFFFF does not represent a valid date
[DEBUG] GPData - 0x0000/0xFFFF does not represent a valid date
[DEBUG] GPData - 0x0000/0xFFFF does not represent a valid date
CPLC: ICFabricator=1290
ICType=00D2
OperatingSystemID=0077
OperatingSystemReleaseDate=0115 (2020-04-24)
OperatingSystemReleaseLevel=011D
ICFabricationDate=33A2 (invalid date format)
ICSerialNumber=FF2D0072
ICBatchIdentifier=0018
ICModuleFabricator=FFFF
ICModulePackagingDate=FFFF (invalid date format)
ICCManufacturer=FFFF
ICEmbeddingDate=FFFF (invalid date format)
ICPrePersonalizer=FFFF
ICPrePersonalizationEquipmentDate=FFFF (invalid date format)
ICPrePersonalizationEquipmentID=FFFFFFFF
ICPersonalizer=FFFF
ICPersonalizationDate=FFFF (invalid date format)
ICPersonalizationEquipmentID=FFFFFFFF
A>> T=0 (4+0000) 80CA0042 00
A<< (0000+2) (6ms) 6A88
[DEBUG] GPData - GET DATA(IIN): N/A
A>> T=0 (4+0000) 80CA0045 00
A<< (0018+2) (9ms) 4510020300010100XXXXXXXXXXXXXXXX 9000
CIN: 4510020300010100XXXXXXXXXXXXXXXXX
A>> T=0 (4+0000) 80CA00CF 00
A<< (0012+2) (9ms) CF0A000033A2FF2D00720018 9000
KDD: CF0A000033A2FF2D00720018
A>> T=0 (4+0000) 80CA00C1 00
A<< (0004+2) (9ms) C1020000 9000
SSC: C1020000
Card Data:
A>> T=0 (4+0000) 80CA0066 00
A<< (0115+2) (13ms) 6671736F06072A864886FC6B01600B06092A864886FC6B020202630906072A864886FC6B03640B06092A864886FC6B048000640B06092A864886FC6B040255640B06092A864886FC6B048107650D060B2A864886FC6B05040200006616060A2B060104012A026E0103060847544F303034011D 9000
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.2
-> GP Version: 2.2
Tag 63: 1.2.840.114283.3
-> GP card is uniquely identified by the Issuer Identification Number (IIN) and Card Image Number (CIN)
Tag 6: 1.2.840.114283.4.0
-> GP SCP80 i=00
Tag 6: 1.2.840.114283.4.2.85
-> GP SCP02 i=55
Tag 6: 1.2.840.114283.4.135
-> GP SCP81 i=07
Tag 66: 1.3.6.1.4.1.42.2.110.1.3
-> JavaCard v3
Card Capabilities:
A>> T=0 (4+0000) 80CA0067 00
A<< (0099+2) (17ms) 6761A0088001028103051555A00E8001038106001020306070820107A006800180810100A01B800181810701020304050607830A008B008C002C00AE00B08401408103FFFFF082031E873083040102030484018F8502FF038602FF038702FF03880100 9000
Supports SCP02 i=05 i=15 i=55
Supports SCP03 i=00 i=10 i=20 i=30 i=60 i=70 with AES-128 AES-196 AES-256
Supports SCP80 i=00
Supports SCP81 i=01 i=02 i=03 i=04 i=05 i=06 i=07
Supported DOM privileges: SecurityDomain, DAPVerification, DelegatedManagement, CardLock, CardTerminate, CardReset, CVMManagement, MandatedDAPVerification, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, GlobalService, ReceiptGeneration, CipheredLoadFileDataBlock, ContactlessActivation, ContactlessSelfActivation
Supported APP privileges: CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, GlobalRegistry, FinalApplication, GlobalService, ContactlessActivation, ContactlessSelfActivation
Supported LFDB hash: SHA-1, SHA-256, SHA-384, SHA-512
Supported Token Verification ciphers: RSA1024_SHA1, RSAPSS_SHA256, DES_MAC, CMAC_AES128, CMAC_AES192, CMAC_AES256, ECCP256_SHA256, ECCP384_SHA384, ECCP512_SHA512, ECCP521_SHA512
Supported Receipt Generation ciphers: RSA1024_SHA1, RSAPSS_SHA256, DES_MAC, CMAC_AES128, CMAC_AES192, CMAC_AES256, ECCP256_SHA256, ECCP384_SHA384, ECCP512_SHA512, ECCP521_SHA512
Supported DAP Verification ciphers: RSA1024_SHA1, RSAPSS_SHA256, DES_MAC, CMAC_AES128, CMAC_AES192, CMAC_AES256, ECCP256_SHA256, ECCP384_SHA384, ECCP512_SHA512, ECCP521_SHA512
Supported ECC Key Parameters: 00
A>> T=0 (4+0000) 80CA00E0 00
A<< (0050+2) (19ms) E030C00401208210C00402208210C00403208210C00401028010C00402028010C00403028010C00402408010C00401408510 9000
Version: 32 (0x20) ID: 1 (0x01) type: DES3_CBC length: 16
Version: 32 (0x20) ID: 2 (0x02) type: DES3_CBC length: 16
Version: 32 (0x20) ID: 3 (0x03) type: DES3_CBC length: 16
Version: 2 (0x02) ID: 1 (0x01) type: DES3 length: 16
Version: 2 (0x02) ID: 2 (0x02) type: DES3 length: 16
Version: 2 (0x02) ID: 3 (0x03) type: DES3 length: 16
Version: 64 (0x40) ID: 2 (0x02) type: DES3 length: 16
Version: 64 (0x40) ID: 1 (0x01) type: PSK_TLS length: 16
[INFO] GPSession - Using card master keys with version 0 for setting up session with MAC
A>> T=0 (4+0008) 80500000 08 538DA5BF2DD54691 00
A<< (0028+2) (56ms) 000033A2FF2D007200182002000006C9F2559BC33294BFBC45534DFC 9000
[DEBUG] GPSession - KDD: 000033A2FF2D00720018
[DEBUG] GPSession - SSC: 0000
[DEBUG] GPSession - Host challenge: 538DA5BF2DD54691
[DEBUG] GPSession - Card challenge: 000006C9F2559BC3
[DEBUG] GPSession - Card reports SCP02 with key version 32 (0x20)
[INFO] GPSession - Diversified card keys: ENC=XXXXXXXXXXXXXXXXXXXX (KCV: AAC628) MAC=XXXXXXXXXXXXXXXXXXXX (KCV: C041E8) DEK=XXXXXXXXXXXXXXXXXXXX (KCV: AEA2A9) for SCP02
[INFO] GPSession - Session keys: ENC=XXXXXXXXXXXXXXXXXXXX MAC=XXXXXXXXXXXXXXXXXXXX RMAC=XXXXXXXXXXXXXXXXXXXX
Failed to open secure channel: Card cryptogram invalid!
Received: 3294BFBC45534DFC
Expected: 169E9D19B6253CDB
!!! DO NOT RE-TRY THE SAME COMMAND/KEYS OR YOU MAY BRICK YOUR CARD !!!
Read more from https://github.com/martinpaljak/GlobalPlatformPro/wiki/Keys
# SCardDisconnect("Generic EMV Smartcard Reader", false) tx:59/rx:531 in 215ms
I’ve tried to specify the key version with –key-ver and set it to 32 (based on the output from above), but got the same result. I don’t want to keep trying since I’m sure I will eventually brick the card.
Most likely I’m going something wrong, or I’m just simply not passing the right args (or missing some args) to GPPro, but I just can’t figure out what.