Forgive me folks, Im still working through the security issues relating PC/to automatic IFSC exchange- following up a question posed earlier. The issue is more interesting than it first seemed, and may distinguish PC/SC CCID from PC/SC in non CCID modes of operation.

(a) any muscle IFD driver can always auto perform an IFSC exchange, before returning from a request to complete the host's command to perform "protocol selection". This would imply that, in PC/SC direct mode, if the client indicates through the PC/SC API that it requires selection of a particular protocol, then some drivers would re-negotiate the block size at the time. However, one driver may exchange the IFSD command, another may not, according to its own capabiities, and the ICC under consideration. PCSC users may know the result of this process through the PC/SC API, but may not influence it. All they can really do is request protocol change, which has the IFSD sideeffect.

Issue: It is not clear to me whether a T1 exchange might be used to set the IFSD ( on multi-protocol cards), even if the protocol being selected is not T1. It seems clear, that a reader or driver can always of course use a proprietary means, to set IFSD.

(b) the CCID case seems to be simpler. The CCID application process in the reader indicates its support of feature|=400h during enumeration. If this bit is set, IFSD exchange occurs as the first exchange, automatically, for any ICC in any of the 16 slots. It seems the issue of IFSD exchange has been devolved from the driver to the CCID in the reader. We know from Microsoft's implementation of CCID, that the current IFSD information is available to a PC/SC client, through the API, as above.

Issue": "First exchange" for the CCID case. Is this before or after the PPS exchange selecting T1 in a multi-protocol card?

(c) my assumptions about CCID removing proprietary signalling and setup on the host->reader link was obviously wrong. The standard unfortunately seems to expressly cater to the proprietary nature of the reader market. For example, during protocol negotiation and timing parameter negotiation, a process which may be automatic or otherwise, the host can send proprietary escape sequences to the CCID which can influence the communication setup between the reader microcontroller and 1 or more ICCs, downstream. A benign sequence could set IFSD.

Peter.

_________________________________________________________________
MSN Toolbar provides one-click access to Hotmail from any Web page � FREE download! http://toolbar.msn.com/go/onm00200413ave/direct/01/


_______________________________________________
Muscle mailing list
[EMAIL PROTECTED]
http://lists.drizzle.com/mailman/listinfo/muscle

Reply via email to