Issue with setting the default applet

[Vomvas]

Hello,

I am having trouble setting the default applet on a new smart card, but I’m not sure if it’s a bug or if I am missing something.

Setup

Card: NXP JCOP 4 Java Card 3.0.5 Classic)
GP: GlobalPlatformPro v21.12.31-55-g52c3581
Platform: M1 MBP with MacOS 14.5
Applet: A simple "Hello World" applet that processes 2 APDUs and returns "Hello World"

Issue:

I attempted two methods to set the applet as the default:

1. Installing the applet with the --default flag. The applet is installed successfully with no warnings, but it's not set as default.
2. Using --make-default <aid> after the installation.

I would appreciate any ideas about how to proceed.

Command outputs

1. Install as default (gp -dv --install ant-javacard/HelloWorldApplet_0102030405_c81c8f12_3.0.5_jdk17.cap --default):

# gp -dv --install /Users/vomvas/workspace/tools/ant-javacard/HelloWorldApplet_0102030405_c81c8f12_3.0.5_jdk17.cap --default
# GlobalPlatformPro v21.12.31-55-g52c3581
# Running on Mac OS X 14.5 aarch64, Java 17.0.11 by Oracle Corporation
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("Identiv SCR3500 A Contact Reader", T=*) -> T=1, 3BFA180000910131FE454A33523331302D333535FF
A>> T=1 (4+0000) 00A40400 00
A<< (0018+2) (41ms) 6F108408A000000151000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000151000000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master keys with version 0 for setting up session with MAC
A>> T=1 (4+0008) 80500000 08 4C5FE032CD5A998D 00
A<< (0032+2) (52ms) 000023455016242048390103104980D1BF58FD2EBC3197BB3A94FCC8C2000007 9000
[DEBUG] GPSession - KDD: 00002345501624204839
[DEBUG] GPSession - SSC: 000007
[DEBUG] GPSession - Host challenge: 4C5FE032CD5A998D
[DEBUG] GPSession - Card challenge: 4980D1BF58FD2EBC
[DEBUG] GPSession - Card reports SCP03 (i=10) with key version 1 (0x01)
A>> T=1 (4+0016) 84820100 10 71C3EF253859B0F10E059228D56FAD5D
A<< (0000+2) (19ms) 9000
A>> T=1 (4+0010) 84F28002 0A 4F004EC6B7926D58FF2B 00
A<< (0040+2) (21ms) E3264F08A0000001510000009F700101C5039EFE80C407A0000001515350CC08A000000151000000 9000
A>> T=1 (4+0010) 84F24002 0A 4F00687CAD420EABDF3D 00
A<< (0000+2) (13ms) 6A88
A>> T=1 (4+0010) 84F21002 0A 4F00DD84EE9BBC138410 00
A<< (0039+2) (21ms) E3254F07A00000015153509F700101CE02FFFF8408A000000151535041CC08A000000151000000 9000
A>> T=1 (4+0010) 84F22002 0A 4F001A7236DB7EC82353 00
A<< (0029+2) (19ms) E31B4F07A00000015153509F700101CE02FFFFCC08A000000151000000 9000
CAP file (v2.1), contains: applets for JavaCard 3.0.5
Package: main.javacard.helloworld 0102030405 v0.1
Applet:  main.javacard.helloworld.HelloWorldApplet 0102030405060708
Import:  A0000000620101                   v1.6 javacard.framework
Import:  A0000000620001                   v1.0 java.lang
Generated by Oracle Corporation converter  [v3.2.0]
On Tue Jul 30 16:10:41 EDT 2024 with JDK 17.0.11 (Oracle Corporation)
Code size 398 bytes (559 with debug)
SHA-256 c81c8f126216abe45f6596873224861e333714f6bfab8fd10b2e74df2cf55d58
SHA-1   808dbb5bbd5ae516e2406aa3a24d56b48042bd92
A>> T=1 (4+0026) 84E60200 1A 05010203040508A0000001510000000000004726EF1B87DE8A08
A<< (0001+2) (77ms) 00 9000
A>> T=1 (4+0255) 84E80000 FF C482018E01000FDECAFFED010204010005010203040502001F000F001F000C0015003A00120097002800190000009E00060003001502010004001502060107A0000000620101000107A000000062000103000C01080102030405060708000C06001200800300FF00070400000017004C0065007E070097000110188C0000188B00017A02308F00023D8C00033B7A0321188B000460037A198B00052D1A042575001D00020030000D0032001518191A8B0006701018191A8B0007700818191A8B00087A05317B000992327B0009031A081F8D000A3B19081F8B000B7A05317B000C92327B000C031A081F8D000A3B19081F8B000B7A05316C8FE4A3893ECCB0
A<< (0001+2) (107ms) 00 9000
A>> T=1 (4+0163) 84E88001 A3 7B000D92327B000D031A081F8D000A3B19081F8B000B7A08002800060003000303000B48656C6C6F20576F726C6403000548656C6C6F030005576F726C640000000005003A000E068003000380030101000000060000010380030303800A0103000008030000090300000A050000020680100203800A0805000004050000000900190000001505040604080717080806050707060507070605070769C4C2BC7DCC955C
A<< (0001+2) (275ms) 00 9000
/Users/vomvas/workspace/tools/ant-javacard/HelloWorldApplet_0102030405_c81c8f12_3.0.5_jdk17.cap loaded: main.javacard.helloworld 0102030405
A>> T=1 (4+0010) 84F28002 0A 4F0065334FDCF5ACB91E 00
A<< (0040+2) (21ms) E3264F08A0000001510000009F700101C5039EFE80C407A0000001515350CC08A000000151000000 9000
A>> T=1 (4+0010) 84F24002 0A 4F0092F38664F5BC2B62 00
A<< (0000+2) (14ms) 6A88
A>> T=1 (4+0010) 84F21002 0A 4F00416216DF59EF5D25 00
A<< (0076+2) (30ms) E3254F07A00000015153509F700101CE02FFFF8408A000000151535041CC08A000000151000000E3234F0501020304059F700101CE02000184080102030405060708CC08A000000151000000 9000
A>> T=1 (4+0010) 84F22002 0A 4F00D8BC0F568F81470A 00
A<< (0056+2) (26ms) E31B4F07A00000015153509F700101CE02FFFFCC08A000000151000000E3194F0501020304059F700101CE020001CC08A000000151000000 9000
A>> T=1 (4+0038) 84E60C00 26 050102030405080102030405060708080102030405060708010002C900000633E803F33F560C
A<< (0001+2) (189ms) 00 9000
# SCardDisconnect("Identiv SCR3500 A Contact Reader", false) tx:670/rx:364 in 1s12ms

2. List applets relevant output (gp -vl):

ISD: A000000151000000 (OP_READY)
     Parent:   A000000151000000
     From:     A0000001515350
     Privs:    SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

APP: 0102030405060708 (SELECTABLE) (|........|)
     Parent:   A000000151000000
     From:     0102030405

PKG: A0000001515350 (LOADED) (SSD creation package)
     Parent:   A000000151000000
     Version:  255.255
     Applet:   A000000151535041 (SSD creation applet)

PKG: 0102030405 (LOADED) (|.....|)
     Parent:   A000000151000000
     Version:  0.1
     Applet:   0102030405060708 (|........|)

3. Make default after installation (gp -dv --make-default 0102030405060708):

# gp -dv --make-default 0102030405060708
# GlobalPlatformPro v21.12.31-55-g52c3581
# Running on Mac OS X 14.5 aarch64, Java 17.0.11 by Oracle Corporation
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("Identiv SCR3500 A Contact Reader", T=*) -> T=1, 3BFA180000910131FE454A33523331302D333535FF
A>> T=1 (4+0000) 00A40400 00
A<< (0018+2) (14ms) 6F108408A000000151000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000151000000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master keys with version 0 for setting up session with MAC
A>> T=1 (4+0008) 80500000 08 D3100ED23F87EC0C 00
A<< (0032+2) (52ms) 00002345501624204839010310397208F767402316FA59C48C9C68BC3C00000D 9000
[DEBUG] GPSession - KDD: 00002345501624204839
[DEBUG] GPSession - SSC: 00000D
[DEBUG] GPSession - Host challenge: D3100ED23F87EC0C
[DEBUG] GPSession - Card challenge: 397208F767402316
[DEBUG] GPSession - Card reports SCP03 (i=10) with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=404142434445464748494A4B4C4D4E4F (KCV: 504A77) MAC=404142434445464748494A4B4C4D4E4F (KCV: 504A77) DEK=404142434445464748494A4B4C4D4E4F (KCV: 504A77) for SCP03
[INFO] GPSession - Session keys: ENC=AB0F82F1ED1BED8D1AF3F71A22C986F9 MAC=C4C09C749BE2B7EDB420324442267A6E RMAC=4DCBDDBC1A2B70E7DD70D2C650A1DC16
[DEBUG] GPSession - Verified card cryptogram: FA59C48C9C68BC3C
[DEBUG] GPSession - Calculated host cryptogram: 0057FCCB07DFFFE0
A>> T=1 (4+0016) 84820100 10 0057FCCB07DFFFE094A598A1FD9658A6
A<< (0000+2) (19ms) 9000
A>> T=1 (4+0023) 84E60800 17 000008010203040506070801040000B3A8BFEA82B1E22A
A<< (0000+2) (83ms) 6A80
Error: INSTALL [for make selectable] failed: 0x6A80 (Wrong data/incorrect values in data)
# SCardDisconnect("Identiv SCR3500 A Contact Reader", false) tx:68/rx:58 in 213ms

[martinpaljak]

Please use --privs CardReset instead, the old --default is meant for retiremen.

[Vomvas]

Thank you, that seems to take away the CardReset privilege from the ISD and give it to the applet:

ISD: A000000151000000 (OP_READY)
     Parent:   A000000151000000
     From:     A0000001515350
     Privs:    SecurityDomain, CardLock, CardTerminate, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

APP: 0102030405060708 (SELECTABLE) (|........|)
     Parent:   A000000151000000
     From:     0102030405
     Privs:    CardReset

However when I try to select the default applet it seems to still return the ISD. Is this expected?

# gp -dv -apdu 00A4040000
# GlobalPlatformPro v21.12.31-55-g52c3581
# Running on Mac OS X 14.6.1 aarch64, Java 17.0.11 by Oracle Corporation
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("Identiv SCR3500 A Contact Reader", T=*) -> T=1, 3BFA180000910131FE454A33523331302D333535FF
A>> T=1 (4+0000) 00A40400 00
A<< (0018+2) (43ms) 6F108408A000000151000000A5049F6501FF 9000
[6f]
     [84] a000000151000000
     [a5]
          [9f65] ff
A>> T=1 (4+0000) 00A40400 00
A<< (0018+2) (11ms) 6F108408A000000151000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000151000000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
# SCardDisconnect("Identiv SCR3500 A Contact Reader", false) tx:10/rx:40 in 150ms

[martinpaljak]

This is expected, as this is the method to select the ISD. Just send an APDU expected by your applet without any SELECT-s.

[Vomvas]

Great, it works! Thank you for the clarification :)