Changing CardManager keyset on 6131 NFC Secure Element

[tdelazzari]

Hello,

I need technical support in order to set my own CardManager keys inside the smartcard of the NOKIA 6131 NFC (GlobalPlatform 2.1.1).
First think to know is that my secure element has been unlocked. So I can connect under JCOP Shell using NOKIA R&D keyset :
set-key 42/1/DES-ECB/404142434445464748494a4b4c4d4e4f 42/2/DES-ECB/404142434445464748494a4b4c4d4e4f 42/3/DES-ECB/404142434445464748494a4b4c4d4e4f
init-update 42

Then, I tried following commands to set my own keys :
set-key 26/1/DES-ECB/ff00ab123456789aabbccddaabbff992 26/2/DES-ECB/ff00ab123456789aabbccddaabbff992 26/3/DES-ECB/ff00ab123456789aabbccddaabbff992
put-keyset 26

But I have an error :
Add new key set didn't work, try modify ...

According to GP2.1.1, E.5.1 INITIALIZE UPDATE Command, the response contains key information: default key-set and the secure channel protocol to be used. Do you know if Nokia 6131 NFC uses SCP01 or SCP02 ?
SCP02 uses a session key (DEK) to encrypt the keys and SCP01 uses a static key to do this. SCP is set during card manufacturing.


Also do you know how to upload my Applet in association with a specific and personalized Security Domain ? Mutual Authentication to CardManager seems to be disabled or I missed something.


Regards,

[tsavinen]

I think you have got the answer through other channels, but here it
is for also other's to see.

The right command is store-keyset <keyset> if there is no keyset defined, and store-keyset -r <keyset> <keyset> (e.g: store-keyset 26, store-keyset -r 26 26). Also using help will describe more about this command.

[enyab]

How/Where do I get to know the key sets for my Nokia 6131 NFC ?
cheers
Ey

[geri-m]

@tdelazzari) Regarding the change of the keys: I didn't try it by hand, but using the G&D SmartCafe does a good job in this case. But anyway, you are right -- there is some way using GP to change the keys.

@enyab) After unlocking you can use the standards keys. You will never ever (!!) get the secure keys, as you are not a trusted party according to CC/EAL something ... There are only some party (Mastercard, Visa, Gemalto ...) that can afford installing a trust center with CCTV, 1 m concret walls etc. The Secure element IS NOT (!) a play ground.

Cheers, geri-m

[hplos]

hi there,

can anybody tell me how to do this with the pc sc lib in c++??

this would be verry helpfull.

[geri-m]

hey,

For talking to a smarcard you need pc/SC reader. You than can use the PC/SC (SmartcardResource Manager) of the Windows Platform or PC/SC Lite (for Linux) to establish a connection to the smartcard.

The GlobalPlatform Commands have to be implemented yourself in c++; for java there is a jPSCS.jar from IBM (off-card-API) already supporting the basic GP commands.

cheers, geri-m