在 PyApduTool 上更改密钥后下载小程序失败
download applet failed after changing key on PyApduTool
下载小程序不再有效，因为我更改了所有 3 个默认密钥。
我可以使用此脚本 GPSshell 进行身份验证
mode_211
enable_trace
establish_context
card_connect
select -AID A000000003000000
open_sc -scp 2 -scpimpl 0x15 -security 1 -keyind 0 -keyver 0 -key a068cd198555af5acc823dfae8a7827a -mac_key a068cd198555af5acc823dfae8a7827a -enc_key a068cd198555af5acc823dfae8a7827a -kek_key a068cd198555af5acc823dfae8a7827a // Open secure channel
card_disconnect
release_context
如果我使用 pyApdutool 下载脚本，我会遇到这个错误：
Download Cap error: Check Card Cryptogram failed.
如果我更改密钥 GlobalPlatform/Auth 并单击按钮 GP 验证，我会遇到此错误：
GP Verify error: Check Card Cryptogram failed.
使用 pyResMan v2.1，如果我将新密钥放在密钥管理器上并单击“相互身份验证”按钮，它会起作用：
doMutualAuth(): Start...
doMutualAuth(): Succeeded.
我也注意到，自从我换了key之后，key的版本号变成了2，之前的版本是1。
image
gp.exe -i -d -v:
#
# gp -i -d -v
SCardConnect("Athena ASEDrive IIIe USB 0", T=*) -> T=1, 3BF81300008131FE454A434F5076323431B7
# GlobalPlatformPro 325fe84
# Running on Windows 10 10.0 amd64, Java 1.8.0_261 by Oracle Corporation
A>> T=1 (4+0000) 00A40400 00
A<< (0103+2) (54ms) 6F658408A000000003000000A5599F6501FF9F6E06479100783300734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E0102 9000
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
A>> T=1 (4+0000) 80CA9F7F 00
A<< (0045+2) (27ms) 9F7F2A479050354791007833009005024992991894481290120000000006072432343939320000000000000000 9000
[WARN] GPData - Invalid CPLC date: 2432
CPLC: ICFabricator=4790
ICType=5035
OperatingSystemID=4791
OperatingSystemReleaseDate=0078 (2010-03-19)
OperatingSystemReleaseLevel=3300
ICFabricationDate=9005 (2019-01-05)
ICSerialNumber=02499299
ICBatchIdentifier=1894
ICModuleFabricator=4812
ICModulePackagingDate=9012 (2019-01-12)
ICCManufacturer=0000
ICEmbeddingDate=0000 (2010-01-01)
ICPrePersonalizer=0607
ICPrePersonalizationEquipmentDate=2432 (invalid date format)
ICPrePersonalizationEquipmentID=34393932
ICPersonalizer=0000
ICPersonalizationDate=0000 (2010-01-01)
ICPersonalizationEquipmentID=00000000
A>> T=1 (4+0000) 80CA0042 00
A<< (0000+2) (15ms) 6A88
[DEBUG] GPData - GET DATA(IIN): N/A
A>> T=1 (4+0000) 80CA0045 00
A<< (0000+2) (17ms) 6A88
[DEBUG] GPData - GET DATA(CIN): N/A
Card Data:
A>> T=1 (4+0000) 80CA0066 00
A<< (0078+2) (38ms) 664C734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E0102 9000
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
Tag 64: 1.2.840.114283.4.2.21
-> GP SCP02 i=15
Tag 65: 1.3.656.840.100.2.1.3
Tag 66: 1.3.6.1.4.1.42.2.110.1.2
-> JavaCard v2
Card Capabilities:
A>> T=1 (4+0000) 80CA0067 00
A<< (0000+2) (16ms) 6A88
[DEBUG] GPData - GET DATA(Card Capabilities): N/A
A>> T=1 (4+0000) 80CA00E0 00
A<< (0020+2) (21ms) E012C00401028010C00402028010C00403028010 9000
Version: 2 (0x02) ID: 1 (0x01) type: DES3 length: 16
Version: 2 (0x02) ID: 2 (0x02) type: DES3 length: 16
Version: 2 (0x02) ID: 3 (0x03) type: DES3 length: 16
Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
SCardDisconnect("Athena ASEDrive IIIe USB 0", true) tx:35/rx:260
（我的卡未融合且未受保护）
我可以在 pyResMan 上加载、安装、select 小程序、验证，小程序工作正常。
但是命令gp.exe -l 不起作用。
Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
Failed to open secure channel: Card cryptogram invalid!
Received: 40FCC922B688B08C
Expected: 327AEEAC380376EC
!!! DO NOT RE-TRY THE SAME COMMAND/KEYS OR YOU MAY BRICK YOUR CARD !!!
Read more from https://github.com/martinpaljak/GlobalP ... /wiki/Keys
怎么了，如果我可以使用 gpshell 脚本进行身份验证？
有什么想法吗？
提前致谢。
（假设您已经通过编辑配置文件解决了 problem with PyApduTool in this question）
您必须指定 GlobalPlatformPro 应该使用的键值（否则它使用 well-known 默认键值 404142434445464748494A4B4C4D4E4F）：
java -jar /opt/gp.jar -v -l --key a068cd198555af5acc823dfae8a7827a
或者：
java -jar /opt/gp.jar -v -l --key-dek a068cd198555af5acc823dfae8a7827a --key-enc a068cd198555af5acc823dfae8a7827a --key-mac a068cd198555af5acc823dfae8a7827a
实际卡的命令跟踪（gpshell）：
mode_211
enable_trace
establish_context
card_connect
* reader name Gemalto PC Twin Reader 00 00
select -AID A000000003000000
Command --> 00A4040008A000000003000000
Wrapped command --> 00A4040008A000000003000000
Response <-- 6F108408A000000003000000A5049F6501099000
open_sc -scp 2 -scpimpl 0x15 -security 1 -keyind 0 -keyver 0 -key a068cd198555af5acc823dfae8a7827a -mac_key a068cd198555af5acc823dfae8a7827a -enc_key a068cd198555af5acc823dfae8a7827a -kek_key a068cd198555af5acc823dfae8a7827a
Command --> 8050000008EABF19238386F99C00
Wrapped command --> 8050000008EABF19238386F99C00
Response <-- FFFFFFFFFFF71062DA69010200098315C89B44BFA1ED8320EED926819000
Command --> 8482010010C9F1E010B369F4C0018D22DAC134F1DB
Wrapped command --> 8482010010C9F1E010B369F4C0018D22DAC134F1DB
Response <-- 9000
card_disconnect
release_context
使用实际卡 (GlobalPlatformPro) 的命令跟踪：
[DEBUG] GlobalPlatform - Auto-detected ISD: A000000003000000
[TRACE] GlobalPlatform - Generated host challenge: 292B93656D145F9C
A>> T=0 (4+0008) 80500000 08 292B93656D145F9C 00
A<< (0028+2) (35ms) FFFFFFFFFFF71062DA690102000CAF7BB18519650456126907678D0F 9000
[DEBUG] GlobalPlatform - Host challenge: 292B93656D145F9C
[DEBUG] GlobalPlatform - Card challenge: 000CAF7BB1851965
[DEBUG] GlobalPlatform - Card reports SCP02 with key version 1 (0x01)
[DEBUG] GlobalPlatform - Will do SCP02 (8)
[DEBUG] PlaintextKeys - Card keys: {ENC=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A, MAC=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A, DEK=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A}
[TRACE] PlaintextKeys - Session keys: {ENC=type=DES3 bytes=FB03954624ADB9A3EC89AE5D2B324D8B kcv=799E36, MAC=type=DES3 bytes=321E2B911ACDCF923C58E93AA44DD7B2 kcv=D7E17A, DEK=type=DES3 bytes=B05E11FF73ECBFB45384446C2E8D5B9F kcv=8DF462}
[DEBUG] GlobalPlatform - Verified card cryptogram: 0456126907678D0F
[DEBUG] GlobalPlatform - Calculated host cryptogram: D4F2E6ABD58F2532
A>> T=0 (4+0016) 84820100 10 D4F2E6ABD58F253245169D0334285F91
A<< (0000+2) (18ms) 9000
下载小程序不再有效，因为我更改了所有 3 个默认密钥。
我可以使用此脚本 GPSshell 进行身份验证
mode_211
enable_trace
establish_context
card_connect
select -AID A000000003000000
open_sc -scp 2 -scpimpl 0x15 -security 1 -keyind 0 -keyver 0 -key a068cd198555af5acc823dfae8a7827a -mac_key a068cd198555af5acc823dfae8a7827a -enc_key a068cd198555af5acc823dfae8a7827a -kek_key a068cd198555af5acc823dfae8a7827a // Open secure channel
card_disconnect
release_context
如果我使用 pyApdutool 下载脚本，我会遇到这个错误：
Download Cap error: Check Card Cryptogram failed.
如果我更改密钥 GlobalPlatform/Auth 并单击按钮 GP 验证，我会遇到此错误：
GP Verify error: Check Card Cryptogram failed.
使用 pyResMan v2.1，如果我将新密钥放在密钥管理器上并单击“相互身份验证”按钮，它会起作用：
doMutualAuth(): Start...
doMutualAuth(): Succeeded.
我也注意到，自从我换了key之后，key的版本号变成了2，之前的版本是1。
image
gp.exe -i -d -v:
#
# gp -i -d -v
SCardConnect("Athena ASEDrive IIIe USB 0", T=*) -> T=1, 3BF81300008131FE454A434F5076323431B7
# GlobalPlatformPro 325fe84
# Running on Windows 10 10.0 amd64, Java 1.8.0_261 by Oracle Corporation
A>> T=1 (4+0000) 00A40400 00
A<< (0103+2) (54ms) 6F658408A000000003000000A5599F6501FF9F6E06479100783300734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E0102 9000
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
A>> T=1 (4+0000) 80CA9F7F 00
A<< (0045+2) (27ms) 9F7F2A479050354791007833009005024992991894481290120000000006072432343939320000000000000000 9000
[WARN] GPData - Invalid CPLC date: 2432
CPLC: ICFabricator=4790
ICType=5035
OperatingSystemID=4791
OperatingSystemReleaseDate=0078 (2010-03-19)
OperatingSystemReleaseLevel=3300
ICFabricationDate=9005 (2019-01-05)
ICSerialNumber=02499299
ICBatchIdentifier=1894
ICModuleFabricator=4812
ICModulePackagingDate=9012 (2019-01-12)
ICCManufacturer=0000
ICEmbeddingDate=0000 (2010-01-01)
ICPrePersonalizer=0607
ICPrePersonalizationEquipmentDate=2432 (invalid date format)
ICPrePersonalizationEquipmentID=34393932
ICPersonalizer=0000
ICPersonalizationDate=0000 (2010-01-01)
ICPersonalizationEquipmentID=00000000
A>> T=1 (4+0000) 80CA0042 00
A<< (0000+2) (15ms) 6A88
[DEBUG] GPData - GET DATA(IIN): N/A
A>> T=1 (4+0000) 80CA0045 00
A<< (0000+2) (17ms) 6A88
[DEBUG] GPData - GET DATA(CIN): N/A
Card Data:
A>> T=1 (4+0000) 80CA0066 00
A<< (0078+2) (38ms) 664C734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E0102 9000
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
Tag 64: 1.2.840.114283.4.2.21
-> GP SCP02 i=15
Tag 65: 1.3.656.840.100.2.1.3
Tag 66: 1.3.6.1.4.1.42.2.110.1.2
-> JavaCard v2
Card Capabilities:
A>> T=1 (4+0000) 80CA0067 00
A<< (0000+2) (16ms) 6A88
[DEBUG] GPData - GET DATA(Card Capabilities): N/A
A>> T=1 (4+0000) 80CA00E0 00
A<< (0020+2) (21ms) E012C00401028010C00402028010C00403028010 9000
Version: 2 (0x02) ID: 1 (0x01) type: DES3 length: 16
Version: 2 (0x02) ID: 2 (0x02) type: DES3 length: 16
Version: 2 (0x02) ID: 3 (0x03) type: DES3 length: 16
Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
SCardDisconnect("Athena ASEDrive IIIe USB 0", true) tx:35/rx:260
（我的卡未融合且未受保护）
我可以在 pyResMan 上加载、安装、select 小程序、验证，小程序工作正常。
但是命令gp.exe -l 不起作用。
Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
Failed to open secure channel: Card cryptogram invalid!
Received: 40FCC922B688B08C
Expected: 327AEEAC380376EC
!!! DO NOT RE-TRY THE SAME COMMAND/KEYS OR YOU MAY BRICK YOUR CARD !!!
Read more from https://github.com/martinpaljak/GlobalP ... /wiki/Keys
怎么了，如果我可以使用 gpshell 脚本进行身份验证？
有什么想法吗？
提前致谢。
（假设您已经通过编辑配置文件解决了 problem with PyApduTool in this question）
您必须指定 GlobalPlatformPro 应该使用的键值（否则它使用 well-known 默认键值 404142434445464748494A4B4C4D4E4F）：
java -jar /opt/gp.jar -v -l --key a068cd198555af5acc823dfae8a7827a
或者：
java -jar /opt/gp.jar -v -l --key-dek a068cd198555af5acc823dfae8a7827a --key-enc a068cd198555af5acc823dfae8a7827a --key-mac a068cd198555af5acc823dfae8a7827a
实际卡的命令跟踪（gpshell）：
mode_211
enable_trace
establish_context
card_connect
* reader name Gemalto PC Twin Reader 00 00
select -AID A000000003000000
Command --> 00A4040008A000000003000000
Wrapped command --> 00A4040008A000000003000000
Response <-- 6F108408A000000003000000A5049F6501099000
open_sc -scp 2 -scpimpl 0x15 -security 1 -keyind 0 -keyver 0 -key a068cd198555af5acc823dfae8a7827a -mac_key a068cd198555af5acc823dfae8a7827a -enc_key a068cd198555af5acc823dfae8a7827a -kek_key a068cd198555af5acc823dfae8a7827a
Command --> 8050000008EABF19238386F99C00
Wrapped command --> 8050000008EABF19238386F99C00
Response <-- FFFFFFFFFFF71062DA69010200098315C89B44BFA1ED8320EED926819000
Command --> 8482010010C9F1E010B369F4C0018D22DAC134F1DB
Wrapped command --> 8482010010C9F1E010B369F4C0018D22DAC134F1DB
Response <-- 9000
card_disconnect
release_context
使用实际卡 (GlobalPlatformPro) 的命令跟踪：
[DEBUG] GlobalPlatform - Auto-detected ISD: A000000003000000
[TRACE] GlobalPlatform - Generated host challenge: 292B93656D145F9C
A>> T=0 (4+0008) 80500000 08 292B93656D145F9C 00
A<< (0028+2) (35ms) FFFFFFFFFFF71062DA690102000CAF7BB18519650456126907678D0F 9000
[DEBUG] GlobalPlatform - Host challenge: 292B93656D145F9C
[DEBUG] GlobalPlatform - Card challenge: 000CAF7BB1851965
[DEBUG] GlobalPlatform - Card reports SCP02 with key version 1 (0x01)
[DEBUG] GlobalPlatform - Will do SCP02 (8)
[DEBUG] PlaintextKeys - Card keys: {ENC=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A, MAC=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A, DEK=type=RAW bytes=A068CD198555AF5ACC823DFAE8A7827A}
[TRACE] PlaintextKeys - Session keys: {ENC=type=DES3 bytes=FB03954624ADB9A3EC89AE5D2B324D8B kcv=799E36, MAC=type=DES3 bytes=321E2B911ACDCF923C58E93AA44DD7B2 kcv=D7E17A, DEK=type=DES3 bytes=B05E11FF73ECBFB45384446C2E8D5B9F kcv=8DF462}
[DEBUG] GlobalPlatform - Verified card cryptogram: 0456126907678D0F
[DEBUG] GlobalPlatform - Calculated host cryptogram: D4F2E6ABD58F2532
A>> T=0 (4+0016) 84820100 10 D4F2E6ABD58F253245169D0334285F91
A<< (0000+2) (18ms) 9000