GlobalPlatformPro, Gemalto IDPrime PIV 2.0 card, Gemalto IDBridge CL3000 Dual Interface Smart Card Reader, Ubuntu 14.4

Information on how to load your own applets onto a Gemalto PIV card are hard to come by, so below is a quick write up of how to do it. This also gets you GlobalPlatform access to the card, which is difficult to figure out due to little documentation available on the key diversification used. The spec sheet for the Gemalto IDPrime PIV 2.0 card can be found here.

Make sure your smart card reader is attached. If it isn't you may have to restart pcscd to get it to show up:

rchapman@vagrant-ubuntu-trusty-64:~$ opensc-tool -l
No smart card readers found.

rchapman@vagrant-ubuntu-trusty-64:~$ sudo service pcscd restart
[sudo] password for rchapman:
 * Restarting PCSC Lite resource manager pcscd                                                                                                 [ OK ]

rchapman@vagrant-ubuntu-trusty-64:~$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    No              Gemalto Prox-DU [Prox-DU HID_15100775] 00 00
1    Yes             Gemalto Prox-DU [Prox-DU HID_15100775] 00 01

Download GlobalPlatformPro

rchapman@vagrant-ubuntu-trusty-64:~$ wget https://github.com/martinpaljak/GlobalPlatformPro/releases/download/v0.3.6/gp.jar
--2016-02-10 06:06:51--  https://github.com/martinpaljak/GlobalPlatformPro/releases/download/v0.3.6/gp.jar
Resolving github.com (github.com)... 192.30.252.131
Connecting to github.com (github.com)|192.30.252.131|:443... connected.
[...]
HTTP request sent, awaiting response... 200 OK
Length: 995937 (973K) [application/octet-stream]
Saving to: ‘gp.jar’

100%[============================================================================================================>] 995,937      915KB/s   in 1.1s

2016-02-10 06:06:53 (915 KB/s) - ‘gp.jar’ saved [995937/995937]

Make sure you can list the applets on the card. Be careful, some cards will lock you out if you fail to authenticate to the card a certain number of times. From my experience with the Gemalto card I bought from the Gemalto WEB store, it didn't lock me out even though it took me over a hundred attempts to get the auth working. The key below works with the Gemalto IDPrime PIV 2.0 cards I purchased from the Gemalto WEB store as well as smartcardfocus.us.

rchapman@vagrant-ubuntu-trusty-64:~$ java -jar ~/gp.jar -visa2 -key 47454D5850524553534F53414D504C45 -mode clr --list
AID: A000000003000000 (|........|)
     ISD INITIALIZED: Security Domain, Card lock, Card terminate, CVM (PIN) management

AID: A000000308000010000100 (|...........|)
     App SELECTABLE: Default selected, CVM (PIN) management

AID: A000000308000010000200 (|...........|)
     App SELECTABLE: CVM (PIN) management

AID: A0000000620001 (|....b..|)
     ExM LOADED: (none)

AID: A0000000620002 (|....b..|)
     ExM LOADED: (none)

AID: A0000000620003 (|....b..|)
     ExM LOADED: (none)

AID: A0000000620101 (|....b..|)
     ExM LOADED: (none)

AID: A000000062010101 (|....b...|)
     ExM LOADED: (none)

AID: A0000000620102 (|....b..|)
     ExM LOADED: (none)

AID: A0000000620201 (|....b..|)
     ExM LOADED: (none)

AID: A0000000030000 (|.......|)
     ExM LOADED: (none)

AID: A0000000620202 (|....b..|)
     ExM LOADED: (none)

AID: A000000018100106 (|........|)
     ExM LOADED: (none)

AID: A000000018100201 (|........|)
     ExM LOADED: (none)

AID: A000000018100101 (|........|)
     ExM LOADED: (none)
     A000000018534441 (|.....SDA|)

AID: A00000015100 (|....Q.|)
     ExM LOADED: (none)

AID: A000000018100108 (|........|)
     ExM LOADED: (none)

AID: A000000018100109 (|........|)
     ExM LOADED: (none)

AID: A000000018100401 (|........|)
     ExM LOADED: (none)

AID: A000000018100402 (|........|)
     ExM LOADED: (none)

AID: A00000030800001000 (|.........|)
     ExM LOADED: (none)
     A000000308000010000100 (|...........|)
     A000000308000010000200 (|...........|)

rchapman@vagrant-ubuntu-trusty-64:~$

Download gpshell to obtain the hello world applet, already compiled into a cap file:

rchapman@vagrant-ubuntu-trusty-64:~$ curl -Lo gpshell.tar.gz 'http://downloads.sourceforge.net/project/globalplatform/GPShell/GPShell-1.4.4/gpshell-1.4.4.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fglobalplatform%2Ffiles%2FGPShell%2FGPShell-1.4.4%2F&ts=1455092038&use_mirror=superb-dca2'
[...]

rchapman@vagrant-ubuntu-trusty-64:~$ tar zxvf gpshell.tar.gz
[...]
gpshell-1.4.4/helloworld.cap
[...]

Install the hello world applet:

rchapman@vagrant-ubuntu-trusty-64:~$ java -jar ~/gp.jar -visa2 -key 47454D5850524553534F53414D504C45 -mode clr --install gpshell-1.4.4/helloworld.cap
CAP loaded

List applets again to find AID (applet ID) of hello world. It should be D0D1D2D3D4D501.

rchapman@vagrant-ubuntu-trusty-64:~$ java -jar ~/gp.jar -visa2 -key 47454D5850524553534F53414D504C45 -mode clr --list | grep -A 4 'AID: D0D1D2D3D4D501 '
AID: D0D1D2D3D4D501 (|.......|)
     ExM LOADED: (none)
     D0D1D2D3D4D50101 (|........|)

Run the applet on the card by selecting the AID D0D1D2D3D4D501, then send any valid APDU (doesn't matter what it is, the app will always return "Hello World!")

rchapman@vagrant-ubuntu-trusty-64:~$ opensc-tool -s "00 A4 04 00 07 D0 D1 D2 D3 D4 D5 01" -s "00:CB:3F:FF:05:5C:03:5F:C1:02:00"
Using reader with a card: Gemalto Prox-DU [Prox-DU HID_15100775] 00 01
Sending: 00 A4 04 00 07 D0 D1 D2 D3 D4 D5 01
Received (SW1=0x90, SW2=0x00)
Sending: 00 CB 3F FF 05 5C 03 5F C1 02 00
Received (SW1=0x90, SW2=0x00):
48 65 6C 6C 6F 20 57 6F 72 6C 64 21 Hello World!

If you want to uninstall the applet from the card, run:

rchapman@vagrant-ubuntu-trusty-64:~$ java -jar ~/gp.jar -visa2 -key 47454D5850524553534F53414D504C45 -mode clr --delete D0D1D2D3D4D501 --deletedeps
rchapman@vagrant-ubuntu-trusty-64:~$